NOTE: New data connector currently supports Files Scanned and IDS Alert Event Types that are reported as part of security events.

We have also updated the existing Meraki parser (for syslog events) to make it compatible with the new data connector (for Cisco Meraki REST API) to ensure that your current security content continues to work with the new data connector. This ensures that Meraki events are available in uniform, normalized views of Network Session schema thus making the events source agnostics and enables you to use common security content that is built using Network Session ASIM schema. In addition to ingestion time transformations, we have also added query time normalization to map the security events received from Cisco Meraki to ASIM Network Session normalization schema.

The new Cisco Meraki data connector uses the Cisco Meraki REST API to fetch security events (supported by Cisco Meraki MX security appliances) and supports DCR-based ingestion-time transformationsĪs part of the new data connector, we have out of the box ingestion time transformations that parse the received security event data into a custom column so that queries don't need to parse it again, thus resulting in better performance. Jaffar Adding to David's comments, Cisco Meraki data connector is based on Syslog and many of our customers have been asking us to build an API based data connector to help with the ease of deployment.

Meraki firewall