Meraki

ktc2 · ‎Apr 21 2025

I did get an answer elsewhwere. Thought I should share it here. Short version is Sentinel has no built in tool for editing parser files. You have to install one (VSC in my case) and then add Azure and Log Analytics plug ins. Here's the long version: https://learn.microsoft.com/en-us/answers/questions/2259340/ms-sentinel-cisco-meraki-(using-rest-api)-data-con?page=1#answer-2023676

ktc2 · ‎Apr 18 2025

Hello, The second link looked promising, but it seems to assume the reader knows where to do these things. It says what to do at a very, very high level, but doesn't say where to do it. I greatly appreciate your efforts.

ktc2 · ‎Apr 18 2025

Hi! Thanks for your reply. I did try that. It tells me that I'm viewing it in a read-only tool. Unfortunately, I can't find any other tool that I will show it to me.

ktc2 · ‎Apr 18 2025

Hello, I'm new MS Sentinel. I've installed the Cisco Meraki (using REST API) Data Connector and its status shows "Connected". I can see data coming in. However, I keep getting a message that I need to edit the Cisco Meraki Data Parser to replace "Server 1", "Server 2", etc. with the actual names of our devices. I can see it here: This sounds easy, but I cannot find any way to edit the data parser. Can anyone tell me where/how to edit this data parser in Sentinel or Azure?

Meraki

Community

About ktc2

ktc2

Community Record

Badges

Re: Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit ...

Re: Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit ...

Re: Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit ...

Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit Data...

Re: Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit ...

Re: Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit ...

Cisco Meraki (using REST API) Data Connector in MS Sentinel Can't Edit Data...