Is the deviceMac in this response the hardware address of the Security Appliance?
https://developer.cisco.com/meraki/api/get-organization-appliance-security-events/
{
"ts": "2018-02-11T00:00:00.090210Z",
"eventType": "IDS Alert",
"deviceMac": "00:18:0a:01:02:03",
"clientMac": "A1:B2:C3:D4:E5:F6",
"srcIp": "1.2.3.4:34195",
"destIp": "10.20.30.40:80",
"protocol": "tcp/ip",
"priority": "2",
"classification": "4",
"blocked": true,
"message": "SERVER-WEBAPP JBoss JMX console access attempt",
"signature": "1:21516:9",
"sigSource": "",
"ruleId": "meraki:intrusion/snort/GID/1/SID/26267"
}