My customer is requesting the last 8 months logs regarding with security events, but In the event log page I just can download one page. Does anyone know if I can request this information to support or do I have any way to got them?
Support can't export this for you, it'll either be a CSV export of each page or use the API to fetch event logs
For API, see: https://documenter.getpostman.com/view/7928889/SVmsVg6K?version=latest#9bfa67f6-c2c6-4c59-a887-bbb21...
Make sure you use the "perPage" parameter to show more than the default 10
I'd be surprised if the logs go back that far on the dashboard, on ours we only get 3 months, that's why you would normally have a SIEM solution for this kind of forensic check.
I need to export the logs from our MX firewalls. After reading this and following the links to all the API information over the past hour it appears I need to learn programing and/or coding to get the logs. Is this correct? The only way I can get the entire contents of the Meraki MX logs (other than export 30 lines at a time to CSV) is to teach myself programming in Meraki API code?
Thank you for the response. Unfortunately I don't know what Python, Bash, curl, or nodeJS are so I'm still in the dark. I see a number of references to something called the Postman tool. Is that something that can be utilize the Meraki API? Is there any simple way for someone that doesn't have any programming background to do this?
@ctscalbers with Python you don't need to know any programming, you simply download and install python (3.8.4 is the current version) and then type commands such as python script.py and this will download the data. I think Meraki have the scripts so you are kind of just running a batch file.
Not to worry, I'm still learning Python myself so I know it's a bit of a challenge for newbies. Yes, you can use an app called Postman that allows you to execute API commands, I'll run you through how to do this for the event log now, the next steps are assuming you have Postman installed, if you don't, you can find it here.
1) Go to this link and click "Run in Postman" at the top right, this will install the Postman collection.
2) In Postman, click the three dots on the collection, then Edit. Go to the Authorization tab and paste your API key in the value field, then click "update"
3) You'll first need to get your organisation ID. To do this, open the collection then go to Organisations > getOrganisations and click "Send". Copy the ID of the organisation you wish to use.
4) Next, we need to select the network you wish to view the event log for. Go to Networks > getOrganizationNetworks. Paste the ID we copied from the previous step into the organizationId field and untick the configTemplateId field like so:
You'll get an output that looks like this, copy the 'id' from the correct network:
5) Final step, now we can use the Events > getNetworkEvents API to fetch all the events from your given network. There are a number of fields you can use to filter the date range and number of events returned. To return events just for your MX, enter 'appliance' in the productType field. In this example, I'll be returning the last 1000 events from my MX:
The networkId is the value we copied from the last step, usually starting with L_ or N_. You should get an output like this:
You can export this into whatever you'd like, it's just JSON.
The fields all have little help/descriptions to assist what data you must enter into them, for example the startingAfter and endingBefore. Hope this helps!
Excellent write up and I really appreciate it. It has gotten me much further than I would have gotten on my own.
I enabled API in my Meraki dashboard and got my API key. I got Postman installed and followed your instructions.
I'm able to get data but I'm hung up on two points.
I want to see event log entries that happened before a particular data and time so I'm trying to use the "endingBefore" parameter but it gives me an error that the "endingBefore must be a valid ISO 8601 formatted timestamp". I attempted to look up ISO 8601 formatting and came up with "2020-07-27T13:00" but that does not work either. How should this parameter be formatted?
Sorry for the many questions but I don't have much experience with this type of thing. Thanks again for your help.