Meraki MX device IDS descriptions

New here

Meraki MX device IDS descriptions

We have been looking through the Meraki documentation for IDs alerts from the Meraki MX device and the ids descriptions are not very good.  For example the description for one alert is:


1377448470.246576346 MX84 ids-alerts signature=119:15:1 priority=2 timestamp=1377448470.238064 direction=egress protocol=tcp/ip src=


I am sure there is a document which gives a better description of the alert but I can't find it.  Would someone be able to point me in the correct direction?

4 Replies 4
Kind of a big deal
Kind of a big deal

The rules are Snort IDs.  You can search for them here: 


However, I tried searching for this one already ... and it was missing.

Kind of a big deal
Kind of a big deal

You might be able to find more info in the Snort GitHub. 

Thanks I forgot to post the full post which is below and can be found at the description just says "ids signature matched".  Just trying to get a better description as opposed to just guessing the actual meaning.


event                       description                             sample

ids-alert                   ids signature matched           1377448470.246576346 MX84 ids-alerts signature=119:15:1                               


security_event ids_alertedids signature matchedsignature=1:28423:1 priority=1 timestamp=1468531589.810079
dhost=98:5A:EB:E1:81:2F direction=ingress protocol=tcp/ip src=
dst= message: EXPLOIT-KIT Multiple exploit kit single digit
exe detection

Did some more checking and I am beginning to guess that the snort id is 119:15:1 or perhaps just 119:15.

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.