Hello oubi, Unfortunately what I had provided before will likely be necessary to obtain rogue AP or spoof SSIDs information. We do not have a more targeted API call or else I would have provided that as a response instead (or you may have found it too). The getNetworkEvents API call would contain the same information as found in the Network-wide > Monitor > Event log and does record some additional Air Marshal events that are not found from the getNetworkWirelessAirMarshal API call. All available event types that a provided network can be filtered for can be found using this API call: https://developer.cisco.com/meraki/api-v1/get-network-events-event-types/. And searching the output for a wireless network for "air marshal" should show the following 9 options: {
"category": "Air Marshal",
"type": "device_packet_flood",
"description": "Single endpoint packet flood"
},
{
"category": "Air Marshal",
"type": "packet_flood",
"description": "Access point / client flood"
},
{
"category": "Air Marshal",
"type": "bcast_deauth",
"description": "Broadcasted deauthorizations"
},
{
"category": "Air Marshal",
"type": "mac_spoofing_attack",
"description": "Access point spoof"
},
{
"category": "Air Marshal",
"type": "bcast_deauth_attack",
"description": "Under containment"
},
{
"category": "Air Marshal",
"type": "bcast_disassoc_attack",
"description": "Under containment"
},
{
"category": "Air Marshal",
"type": "bcast_disassoc",
"description": "Broadcasted disassociations"
},
{
"category": "Air Marshal",
"type": "rogue_ap_association",
"description": "Rogue access point association"
},
{
"category": "Air Marshal",
"type": "device_containment",
"description": "Endpoint Containment"
} You can also enable alerting from the Network-wide > Configure > Alerts page for a given network for when "A rogue access point is detected". Additionally you can enable SSID alerting within Air Marshal too: https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal#SSID_Alerting (these are provided in reference to your comment about wanting to be alerted by occurrences seen in Air Marshal). I would also recommend using the "Give your feedback" button on the lower right corner of any Dashboard page to ask that additional Air Marshal API calls be added to target other pages viewable on Dashboard.
... View more
