We are on 16.16, not sure about the license.   I checked all our devices and tried a few different snort signatures on each, and I found an egress suspicious TLD query signature that let me inspect it. Other signatures on the same device did not have the option. Why does it vary per signature?   Also the Source column in the MX Events table shows a tiny "Meraki Network OS" under the hostname for signatures that I can inspect too, if that is of any help. ... View more

Bingo. That's it! Thanks for your help tracking that down! ... View more

BrandonS, that is exactly what I was looking for, but we don't have the Inspect Packet option. My signature match options are shown below:   How do I enable the Inspect Packet option? Encouraging feedback so far.   Thanks, D   ... View more

A related function in Cisco FTD is described here: Firepower Management Center Configuration Guide, Version 6.2   From link: "When the system identifies a possible intrusion, it generates an intrusion event, which is a record of the date, time, the type of exploit, and contextual information about the source of the attack and its target. For packet-based events, a copy of the packet or packets that triggered the event is also recorded."   This what we need in Meraki MX too - the last part about a copy of matching packets. ... View more

That does not seem like the correct solution since the captured packets are not limited to IDS signature matches. We don't want all packets. We just want packets that match an IDS signature, so we can evaluate the packet content against the signature itself to see if the match is a false positive.   Can Meraki capture only packets for IDS signature matches? ... View more