Forum Discussion

ktc2's avatar
ktc2
Copper Contributor
Apr 18, 2025

Sentinel: How to edit a data parser (Cisco Meraki Data Parser)

Hello,

 

I'm new MS Sentinel. I've installed the Cisco Meraki (using REST API) Data Connector and its status shows "Connected".  I can see data coming in. However, I keep getting a message that I need to edit the Cisco Meraki Data Parser to replace "Server 1", "Server 2", etc. with the actual names of our devices. 

 

I can see it here: 

This sounds easy, but I cannot find any way to edit the data parser.  Can anyone tell me where/how to edit this data parser in Sentinel or Azure? 

1 Reply

Sort By
  • Kidd_Ip's avatar
    Kidd_Ip
    MVP
    Apr 19, 2025

    Any chance to replace Placeholder Names that may involve modifying the KQL query to map the incoming data fields to the device names.

Resources