Hi All; In Sumologic I setup the below app to get Meraki events    In Meraki the syslog server includes the below roles which populate the above dashboards. So far so good! I need to create a new dashboard that shows on which SSID a client connected given a specific network or AP, or even better provide network and AP information as part of the results from the query.    The use case that I have is to identify corporate client devices that are unintentionally connecting to the guest wireless ssid or non-corporate client devices connecting to the prod wireless network. To achieve this I need to know under what event type these client device connections are logged under.   Based on feedback from Sumologic support the event types that are going into Sumologic are shown below   The results came back with: 8021x_auth 8021x_client_deauth 8021x_deauth  8021x_eap_failure 8021x_eap_success  8021x_radius_timeout  association association_reject  cli_set_rad_okc_parms  cli_set_rad_parms cli_set_rad_pmksa_parms dfs_event disassociation multiple_dhcp_servers_detected radius_mac_auth route_connection_change vpn_connectivity_change wpa_auth wpa_deauth   None of those event types though have info on AP, SSID's, or hostnames.  However, running an API call against https://api.meraki.com/api/v1/organizations/{orgID}/networks/{netID}/clients/?perPage=1000&ssidNumber=2 gets me the below info which is what i need to create my dashboard. Is the below information captured in the syslog? and if it is under what event type can i find it?   Thanks in advance! ... View more

Hi everyone, I'm facing a problem that I hope someone here can help me solve or point me to a workaround for finding the information within the Meraki portal. To begin, my question is simple as stated above.   If I have an IP address of 10.10.15.4 for example, what is the easiest most simple way to find out under which Network that IP belongs and which AP/SSID the IP was connected to?   The reason for this is we have these alerts generated from our SIEM and we have rules in our SIEM that would tag a device as non-corporate device if it satisfies certain criteria. So when something like that comes up we need to dig in and identify the device so we can identify the user and follow up etc.   In Meraki we have about 100+ Networks defined and each with different numbers of APs (1 network has 40+ APs) with about 3-4 SSIDs so I'm having a very hard time trying to figure out where should I begin my investigation. Is there anything out there that can help with this? Maybe something like a master list/report that shows all clients and IP addresses along with their networks and AP's as a table or something?   Thank you in Advance! ... View more