Hi,   From Cisco Meraki Events via REST API:    The Cisco Meraki Events via REST API solution for Microsoft Sentinel enables you to easily ingest the following events from Cisco Meraki MX security appliance to Microsoft Sentinel using Cisco Meraki API: 1. Organization Appliance Security Events 2. Organization Api Requests 3. Organization Configuration Changes   1. Based on the information above I would expect this to use most GET organization level API calls.  - when clicking this link type "/organization" into the first search box.    2. It also specifically calls out the Organization Appliance Security Events which is probably this call: getOrganizationApplianceSecurityEvents.   3. Refers to the changelog found under Organization > Changelog. This seems to refer to this API endpoint: getOrganizationConfigurationChanges.    But as you stated, it's always good to get confirmation from Microsoft.    Feel free to reach back out should you need anything else.  ... View more