Network Event API definitions

[George_Viking]

Can anyone point me toward a reference of the different event types and payloads associated with the getNetworkEvents API?

For example I know that cf_block is content filtering blocked URL through reverse engineering and know the payload associated, but was hoping to find a reference so we didnt have to do the same for each event type as we encounter it.

Hope that makes sense and thank you

[PhilipDAth]

I don't know of a definitive list and with each new product family released the list of events keeps growing.

I did find this API call to return the event types.

https://developer.cisco.com/meraki/api-v1/#!get-network-environmental-events-event-types 

[George_Viking]

Thanks for the reply and yes I found that which certainly makes the translation from cryptic event type to something more descriptive easier, but doesnt really speak to the rest of the question.

If anyone in Cisco reads this, such a list exists in your database for the purpose of displaying it in the dashboard.  If that reference can be make public it'll make navigating your API so much more useful for your partners.

[DexterLaBora]

This endpoint should return the index of all possible network event types

https://developer.cisco.com/meraki/api-v1/#!get-network-events-event-types

[
    {
        "category": "Status",
        "type": "carrier_event",
        "description": "Ethernet port carrier change"
    },
    {
        "category": "Appliance status",
        "type": "failover_event",
        "description": "Primary uplink status change"
    },
    {
        "category": "Client status",
        "type": "client_connectivity",
        "description": "Client connectivity status change"
    },
    {
        "category": "Events dropped",
        "type": "events_dropped2",
        "description": "Events dropped"
    },
    {
        "category": "Auth",
        "type": "splash_auth",
        "description": "Splash authentication"
    },
    {
        "category": "Auth",
        "type": "ad_auth",
        "description": "Domain authentication"
    },
    {
        "category": "Auth",
        "type": "ad_connect",
        "description": "Connected to Domain Controller"
    },
    {
        "category": "Auth",
        "type": "ad_failure",
        "description": "Unable to connect to Domain Controller"
    },
    {
        "category": "Auth",
        "type": "radius_mac_auth",
        "description": "RADIUS authentication"
    },
    {
        "category": "Auth",
        "type": "radius_mac_auth_failover",
        "description": "RADIUS authentication failover to Guest VLAN"
    },
    {
        "category": "DHCP",
        "type": "dhcp_lease",
        "description": "DHCP lease"
    },
    {
        "category": "DHCP",
        "type": "dhcp_release",
        "description": "DHCP release"
    },
    {
        "category": "DHCP",
        "type": "dhcp_nak",
        "description": "DHCP NAK"
    },
    {
        "category": "DHCP",
        "type": "dhcp_problem",
        "description": "DHCP problem"
    },
    {
        "category": "DHCP",
        "type": "multiple_dhcp_servers_detected",
        "description": "Multiple DHCP servers detected"
    },
    {
        "category": "DHCP",
        "type": "dhcp_no_leases",
        "description": "No DHCP lease available"
    },
    {
        "category": "DHCP",
        "type": "rogue_dhcp",
        "description": "Rogue DHCP server detected"
    },
    {
        "category": "DHCP",
        "type": "dhcp_blocked",
        "description": "DHCP blocked"
    },
    {
        "category": "DHCP",
        "type": "dai_blocked",
        "description": "DAI blocked"
    },
    {
        "category": "IP conflict",
        "type": "ip_conflict",
        "description": "Client IP conflict"
    },
    {
        "category": "IP conflict",
        "type": "martian_vlan",
        "description": "Source IP and/or VLAN mismatch"
    },
    {
        "category": "IP conflict",
        "type": "martian_src",
        "description": "Internet martian"
    },
    {
        "category": "Non-Meraki / Client VPN",
        "type": "vpn",
        "description": "Non-Meraki / Client VPN negotiation"
    },
    {
        "category": "Non-Meraki / Client VPN",
        "type": "client_vpn_connect",
        "description": "VPN client connected"
    },
    {
        "category": "Non-Meraki / Client VPN",
        "type": "client_vpn_disconnect",
        "description": "VPN client disconnected"
    },
    {
        "category": "Non-Meraki / Client VPN",
        "type": "client_vpn_address_pool_empty",
        "description": "VPN client address pool empty"
    },
    {
        "category": "Meraki VPN",
        "type": "vpn_connectivity_change",
        "description": "VPN tunnel connectivity change"
    },
    {
        "category": "Meraki VPN",
        "type": "vpn_registry_change",
        "description": "VPN registry connectivity change"
    },
    {
        "category": "Cellular",
        "type": "cellular_up",
        "description": "Cellular connection up"
    },
    {
        "category": "Cellular",
        "type": "cellular_down",
        "description": "Cellular connection down"
    },
    {
        "category": "VRRP",
        "type": "vrrp",
        "description": "VRRP transition"
    },
    {
        "category": "VRRP",
        "type": "vrrp_state_change",
        "description": "VRRP transition"
    },
    {
        "category": "VRRP",
        "type": "vrrp_vrid_collision",
        "description": "Virtual router collision"
    },
    {
        "category": "Web caching",
        "type": "web_cache_stopped",
        "description": "Web cache stopped"
    },
    {
        "category": "Web caching",
        "type": "web_cache_started",
        "description": "Web cache started"
    },
    {
        "category": "Route tracking",
        "type": "route_connection_change",
        "description": "Route connection change"
    },
    {
        "category": "Route tracking",
        "type": "network_test",
        "description": "Network test"
    },
    {
        "category": "OSPF",
        "type": "ospf_neighbor_init",
        "description": "OSPF neighbor init"
    },
    {
        "category": "OSPF",
        "type": "ospf_neighbor_full",
        "description": "OSPF neighbor up"
    },
    {
        "category": "OSPF",
        "type": "ospf_neighbor_down",
        "description": "OSPF neighbor down"
    },
    {
        "category": "OSPF",
        "type": "ospf_route_iface_overlap",
        "description": "OSPF route interface overlap"
    },
    {
        "category": "OSPF",
        "type": "ospf_route_overflow",
        "description": "OSPF route table overflow"
    },
    {
        "category": "BGP",
        "type": "bgp_received_notification",
        "description": "BGP received notification"
    },
    {
        "category": "BGP",
        "type": "bgp_sent_notification",
        "description": "BGP sent notification"
    },
    {
        "category": "BGP",
        "type": "bgp_session_established",
        "description": "BGP session established"
    },
    {
        "category": "BGP",
        "type": "bgp_session_unestablished",
        "description": "BGP session no longer established"
    },
    {
        "category": "Filtering",
        "type": "cf_block",
        "description": "Content filtering blocked URL"
    },
    {
        "category": "Filtering",
        "type": "sf_url_block",
        "description": "Security blocked URL"
    },
    {
        "category": "Filtering",
        "type": "sf_binary_block",
        "description": "Security blocked file"
    },
    {
        "category": "Intrusion Detection",
        "type": "ids_start",
        "description": "Intrusion detection started"
    },
    {
        "category": "Intrusion Detection",
        "type": "ids_error",
        "description": "Intrusion detection error"
    },
    {
        "category": "Intrusion Detection",
        "type": "ids_update",
        "description": "Intrusion detection rules update"
    },
    {
        "category": "Switch status",
        "type": "poe_budget_change",
        "description": "PoE budget change"
    },
    {
        "category": "Switch status",
        "type": "psu_insert",
        "description": "Power supply inserted"
    },
    {
        "category": "Switch status",
        "type": "psu_remove",
        "description": "Power supply removed"
    },
    {
        "category": "Switch status",
        "type": "temp_critical",
        "description": "Temperature Alert"
    },
    {
        "category": "802.1X",
        "type": "8021x_auth",
        "description": "802.1X authentication"
    },
    {
        "category": "802.1X",
        "type": "8021x_guest_auth",
        "description": "802.1X guest authentication"
    },
    {
        "category": "802.1X",
        "type": "8021x_critical_auth",
        "description": "802.1X critical authentication"
    },
    {
        "category": "802.1X",
        "type": "8021x_deauth",
        "description": "802.1X deauthentication"
    },
    {
        "category": "802.1X",
        "type": "8021x_client_deauth",
        "description": "802.1X client deauthentication"
    },
    {
        "category": "802.1X",
        "type": "8021x_eap_success",
        "description": "802.1X EAP success"
    },
    {
        "category": "802.1X",
        "type": "8021x_eap_failure",
        "description": "802.1X EAP failure"
    },
    {
        "category": "802.1X",
        "type": "8021x_radius_timeout",
        "description": "802.1X RADIUS timeout"
    },
    {
        "category": "802.1X",
        "type": "cli_set_rad_parms",
        "description": "RADIUS response"
    },
    {
        "category": "802.1X",
        "type": "cli_set_rad_okc_parms",
        "description": "OKC match"
    },
    {
        "category": "802.1X",
        "type": "cli_set_rad_pmksa_parms",
        "description": "PMKSA cache match"
    },
    {
        "category": "802.1X",
        "type": "8021x_server_err_msg",
        "description": "802.1X server error message"
    },
    {
        "category": "802.1X",
        "type": "multi_auth_vlan_restriction",
        "description": "Multi-Auth VLAN Restriction"
    },
    {
        "category": "Switch port",
        "type": "stp_port_role_change",
        "description": "Port STP change"
    },
    {
        "category": "Switch port",
        "type": "stp_port_delay_monitor",
        "description": "STP BPDU delay monitor"
    },
    {
        "category": "Switch port",
        "type": "stp_bpdu_guard",
        "description": "STP BPDU guard activated"
    },
    {
        "category": "Switch port",
        "type": "stp_root_guard",
        "description": "STP root guard activated"
    },
    {
        "category": "Switch port",
        "type": "stp_loop_guard",
        "description": "STP loop guard activated"
    },
    {
        "category": "Switch port",
        "type": "cable_test_started",
        "description": "Cable test"
    },
    {
        "category": "Switch port",
        "type": "port_bounce",
        "description": "Port bounce"
    },
    {
        "category": "Switch port",
        "type": "sfp_insert",
        "description": "SFP module inserted"
    },
    {
        "category": "Switch port",
        "type": "sfp_remove",
        "description": "SFP module removed"
    },
    {
        "category": "Switch port",
        "type": "port_status",
        "description": "Port status change"
    },
    {
        "category": "Switch port",
        "type": "whitelist_error",
        "description": "Client is not on whitelist"
    },
    {
        "category": "Switch port",
        "type": "sticky_mac_limit",
        "description": "Sticky MAC whitelist limit reached"
    },
    {
        "category": "Switch port",
        "type": "stp_bpdu_conflict",
        "description": "STP BPDU sender conflict"
    },
    {
        "category": "Switch port",
        "type": "udld_alert",
        "description": "UDLD alert"
    },
    {
        "category": "Switch Health",
        "type": "loop_detected",
        "description": "Loop detected"
    },
    {
        "category": "Switch Health",
        "type": "mac_flap_detected",
        "description": "MAC address flapping"
    },
    {
        "category": "Switch Health",
        "type": "stp_elected_root",
        "description": "STP root bridge elected"
    },
    {
        "category": "Switch Health",
        "type": "stp_no_longer_root",
        "description": "STP root status released"
    },
    {
        "category": "ECMP",
        "type": "ecmp_add_failure",
        "description": "ECMP route add failed"
    },
    {
        "category": "ECMP",
        "type": "ecmp_removed",
        "description": "ECMP route removed"
    },
    {
        "category": "DFS",
        "type": "dfs_event",
        "description": "DFS event detected"
    },
    {
        "category": "802.11",
        "type": "association",
        "description": "802.11 association"
    },
    {
        "category": "802.11",
        "type": "disassociation",
        "description": "802.11 disassociation"
    },
    {
        "category": "802.11",
        "type": "aps_association_reject",
        "description": "802.11 association rejected for client balancing"
    },
    {
        "category": "802.11",
        "type": "11r_association",
        "description": "802.11r association"
    },
    {
        "category": "802.11",
        "type": "11r_fast_roam",
        "description": "802.11r roaming reassociation"
    },
    {
        "category": "WPA",
        "type": "wpa_auth",
        "description": "WPA authentication"
    },
    {
        "category": "WPA",
        "type": "wpa_deauth",
        "description": "WPA deauthentication"
    },
    {
        "category": "WPA",
        "type": "wpa_client_deauth",
        "description": "WPA client deauthentication"
    },
    {
        "category": "AutoRF",
        "type": "noise_avoid_begin",
        "description": "Auto RF interference avoidance begin"
    },
    {
        "category": "AutoRF",
        "type": "noise_avoid_end",
        "description": "Auto RF interference avoidance end"
    },
    {
        "category": "AutoRF",
        "type": "channel_scan",
        "description": "Channel scan"
    },
    {
        "category": "AutoRF",
        "type": "spectrum_scan_start",
        "description": "Spectrum analysis"
    },
    {
        "category": "AutoRF",
        "type": "auto_rf_channel_change",
        "description": "Auto RF channel change"
    },
    {
        "category": "AutoRF",
        "type": "auto_tx_power_change",
        "description": "Auto Tx power change"
    },
    {
        "category": "AutoRF",
        "type": "auto_rx_sop_change",
        "description": "Auto Rx sop change"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_start_set_anchor",
        "description": "Sent anchor request to anchor AP"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_set_anchor_done",
        "description": "Received SetAnchor reply or timed out"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_set_anchor_success",
        "description": "Received anchor reply"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_set_anchor_fail",
        "description": "Anchor reply not received"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_assign_anchor",
        "description": "Assigned anchor AP to client"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_lost_anchor",
        "description": "Working anchor AP became unresponsive"
    },
    {
        "category": "L3 roaming",
        "type": "l3roaming_assign_hosting",
        "description": "Received anchor request; sent reply"
    },
    {
        "category": "Air Marshal",
        "type": "device_packet_flood",
        "description": "Single device packet flood"
    },
    {
        "category": "Air Marshal",
        "type": "packet_flood",
        "description": "AP / client flood"
    },
    {
        "category": "Air Marshal",
        "type": "bcast_deauth",
        "description": "Broadcasted deauthorizations"
    },
    {
        "category": "Air Marshal",
        "type": "mac_spoofing_attack",
        "description": "AP spoof"
    },
    {
        "category": "Air Marshal",
        "type": "bcast_deauth_attack",
        "description": "Under containment"
    },
    {
        "category": "Air Marshal",
        "type": "bcast_disassoc_attack",
        "description": "Under containment"
    },
    {
        "category": "Air Marshal",
        "type": "bcast_disassoc",
        "description": "Broadcasted disassociations"
    },
    {
        "category": "Air Marshal",
        "type": "rogue_ap_association",
        "description": "Rogue AP association"
    }
]

[George_Viking]

Again very helpful thank you, but does not speak to the payloads in the events and security events.

[DexterLaBora]

We are working on a similar endpoint that will show all of the webhook alert types WITH examples. I suspect this is what you wanted in the other endpoints as well. 

It's not a bad idea to provide more documentation around these various events, so we'll note this for future development.

[George_Viking]

Brilliant thank you.  That is what I'm looking for.  If you wouldnt mind dropping a line here if and when they are produced I would appreciate it.

[DexterLaBora]

FYI, we just released an endpoint for  Alert Types with Examples

https://developer.cisco.com/meraki/api-v1/#!get-organization-webhooks-alert-types

Still looking into other Examples type endpoints, such as Security Events.

GET /organizations/{organizationId}/webhooks/alertTypes

{
        "alertTypeId": "failover_event",
        "alertType": "Uplink status changed",
        "example": {
            "version": "0.1",
            "sharedSecret": "secret",
            "sentAt": "2021-01-14T11:11:10.042982Z",
            "organizationId": "2930418",
            "organizationName": "My organization",
            "organizationUrl": "https://dashboard.meraki.com/o/VjjsAd/manage/organization/overview",
            "deviceSerial": "Q234-ABCD-5678",
            "deviceMac": "00:11:22:33:44:55",
            "deviceName": "My AP",
            "deviceUrl": "https://n1.meraki.com//n//manage/nodes/new_list/000000000000",
            "deviceTags": [ "tag1", "tag2" ],
            "deviceModel": "MR34",
            "alertId": "0000000000000000",
            "alertType": "Uplink status changed",
            "alertTypeId": "failover_event",
            "alertLevel": "warning",
            "occurredAt": "2018-02-11T00:00:00.123450Z",
            "alertData": { "uplink": "0" },
            "networkId": "N_24329156",
            "networkName": "Main Office",
            "networkUrl": "https://n1.meraki.com//n//manage/nodes/list"
        }
    },

[George_Viking]

Thank you.  The more we can flesh out the various alert the more rich our response to the customers will be.  Please let me know as this continues to develop.