Has Meraki produced documentation for this yet?  We just turned on a number of alerts for our network and are tweaking them to see what works for us.  I read this thread earlier and we decided to get weekly alerts.  For this week we have 3 alerts at 3 different offices.  One is here at our HQ and I was able to find who it is and verify there was no issue.  But the other two are clear across the country, and one of them is on wifi so I can't cycle the port as suggested above.  How do we troubleshoot these alerts to determine whether it's a false positive or a legit concern, without physically going to the device and looking for vmware (which shouldn't be on it based on group policies anyway)? ... View more