Did some more checking and I am beginning to guess that the snort id is 119:15:1 or perhaps just 119:15. ... View more

Thanks I forgot to post the full post which is below and can be found at https://documentation.meraki.com/General_Administration/Monitoring_and_Reporting/Syslog_Event_Types_and_Log_Samples the description just says "ids signature matched".  Just trying to get a better description as opposed to just guessing the actual meaning.   event                       description                             sample ids-alert                   ids signature matched           1377448470.246576346 MX84 ids-alerts signature=119:15:1                                  security_event ids_alerted ids signature matched signature=1:28423:1 priority=1 timestamp=1468531589.810079 dhost=98:5A:EB:E1:81:2F direction=ingress protocol=tcp/ip src=151.101.52.238:80 dst=192.168.128.2:53023 message: EXPLOIT-KIT Multiple exploit kit single digit exe detection ... View more