Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Register or Sign in
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
About DevK
Community Record
11
Posts
2
Kudos
0
Solutions
Badges
Apr 19 2022
4:52 AM
Thank you for your response @LearningIsFun .
... View more
Apr 19 2022
4:49 AM
Hello @ww Thank you for your response. If flows and URLs are not available via APi, then this table in meraki documentation looks irrelevant. According to that device flows are supported via API as well. https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Meraki_Device_Reporting_-_Syslog%2C_SNMP%2C_and_API
... View more
Apr 19 2022
1:31 AM
Hello Folks, Earlier we were using syslog method to get logs from Meraki FW for monitoring. Few days back we moved to API method as with single API key we can monitor all meraki devices. But, we are seeing log difference in syslog and API method. In syslog we used to get all firewall logs like flows and url etc. However this is observed that we are not getting all similar logs using API. Following are the endpoints we are querying to fetch logs: /networks/{networkId}/events?productType=<productType> possible values for productType: wireless, appliance, switch, systemsManager, camera and cellularGateway /networks/{networkId}/appliance/security/events (for MX security events) Request you to confirm, above mentioned endpoints are the only endpoints where we get firewall traffic related and device flow logs for monitoring. Or is there any other endpoint which we are missing? Thank you.
... View more
Feb 24 2022
9:55 PM
Thank you for your response. The fields you are saying are actually the parameters to use while querying the API. I'm looking for event fields explanation. For example, lets check the following event for endpoint GET /organizations/{organizationId}/appliance/security/events: { "ts": "2022-02-22T13:11:34.643074Z", "eventType": "IDS Alert", "deviceMac": "xx:xx:xx:xx:xx:xx", "clientMac": "xx:xx:xx:xx:xx:xx", "srcIp": "xxx:xx:xxx:xx:1234", "destIp": "xxx:xx:xxx:xx:5678", "protocol": "udp/ip", "priority": "1", "classification": "12", "blocked": true, "message": "(spo_bo) Back Orifice Client Traffic detected", "signature": "105:2:2", "sigSource": "ips", "ruleId": "GID/105/SID/2" } What I'm looking for the is definition/explanation of each field, like what is clientMac, what is classification etc..
... View more
Feb 23 2022
8:44 PM
Hello team, I am fetching events from below two endpoint: GET /networks/{networkId}/events GET /organizations/{organizationId}/appliance/security/events I referred the API documentation and I could able to fetch events successfully. However, I'm looking for schema or log reference kind of guide which can elaborate each field and its content. I could only see sample responses in the API documentation, but could not able to find such guide which can explain the fields. Earlier posted same query in wrong forum, creating topic here again. Any help would be appreciated. Thank you.
... View more
Feb 23 2022
8:38 PM
No, I'm looking for a explanation of fields which comes in the event. For example: There is a deviceName field which comes in the event. What deviceName represents? Is it a device hostname? I'm looking for explanation of all fields in all events. The endpoint you suggested in above comment just tells you possible event types. Thank you.
... View more
Feb 23 2022
6:41 AM
Hello team, I am fetching events from below two endpoint: GET /networks/{networkId}/events GET /organizations/{organizationId}/appliance/security/events I referred the API documentation and I could able to fetch events successfully. However, I'm looking for schema or log reference kind of guide which can elaborate each field and its content. I could only see sample responses in the API documentation, but could not able to find such guide which can explain the fields. Any help would be appreciated. Thank you.
... View more
Labels:
- Labels:
-
Other
Feb 21 2022
10:00 PM
Thank you. Looking into it.
... View more
Feb 21 2022
1:13 AM
Hello Team, I'm working on API to fetch events from the endpoint: {baseURI}//networks/{networkId}/events I have multiple organization and it has multiple networks. So, my query is instead of networkID, is there any endpoint where we can query to full organization and fetch events for all networks in that organization instead of querying each network? Is it possible? For eg: For appliance(MX) security events, we can use organization ID instead od networkID to get security events. /networks/{networkId}/appliance/security/events /organizations/{organizationId}/appliance/security/events Similarly, can we use org ID for {baseURI}//networks/{networkId}/events? Thank you.
... View more
Labels:
- Labels:
-
Other
Feb 21 2022
12:54 AM
2 Kudos
Thank you!
... View more
Feb 20 2022
11:39 PM
I'm trying to fetch security events for the appliance(MX) from the Meraki API. However I can see below two endpoints for the same: {baseURI}/networks/{networkId}/appliance/security/events {baseURI}/organizations/{organizationId}/appliance/security/events I would like to know what is the difference between these two? What I understand is first endpoint will fetch events specific to the given network ID and other will fetch events for all network IDs which belong to the provided organization ID. Just would like to know if this understanding is correct. Another query: is the below endpoint with parameter appliance fetches same events as of above endpoints? {baseURI}/networks/{networkId}/events I would appreciate the clarification on this. Thank you.
... View more
Labels:
- Labels:
-
Other
My Top Kudoed Posts
| Subject | Kudos | Views |
|---|---|---|
| 2 | 786 |
© 2024 Cisco Systems, Inc.
