Collection Events from Meraki MX to Qradar via API

[Kenneth]

Hi guys, wanted to check if someone had encountered the same problem as we have. Collectiong Syslog from local MX devices are easy, but when you have multiple orgz and multiple physical locations you would need to transport syslog over the internet. But we have the option to use the API to collect information into the SIEM tool, does anyone have experience with using the API module within Qradar and polling events from the API in Meraki?

[CptnCrnch]

Depending on what you're trying to achieve, you'll run into the API call limit (10 calls per second). From a firewall perspective, this is not much.

[BrandonS]

It's not an appliance on site?  Usually these SIEM tools I have seen use mirrored switch ports to see everything.

[Marius]

@Kenneth did you solve this, we are having the same issue, and trying to get the relevant data to Qradar. Not sure what API endpoint to use to get the right data.