Forum Discussion

Iron Contributor

Mar 16, 2020

Sentinel & Cisco Meraki?

Has anyone had any experience with getting Cisco Meraki feeds ingesting into Sentinel? Just checking for any gotcha's...

Brass Contributor

Mar 27, 2020

can you please confirm the sentinel table in which you are getting Meraki events. It is like custom log or coming under syslog ?

Brass Contributor

Mar 31, 2020

They will show up under syslog.

Dev_Choudhary
Brass Contributor
Mar 31, 2020
Hi mperrotta
Thanks for your reply. I did the same and event getting under syslog are not complete, they are truncating the events(by : in Rawdata).

Refer below details
Actual logs 1:
Mar 27 14:00:38 1.1.1.1 987654321.123456789 MerakiXXYY urls src=yy.yy.yy.yy:40206 dst=xxx.xxx.x.xx:443 mac=AA:AA:AA:BB:BB:BB request: UNKNOWN https://aaa.vbvbvb.com/...
SyslogMessage 1:
40206 dst=xxx.xxx.x.xx:443 mac=AA:AA:AA:BB:BB:BB request: UNKNOWN https://aaa.vbvbvb.com/...

Actual logs 2:
Mar 27 14:00:56 1.1.1.1 987654321.123456789 MerakiYYXX flows allow src=yy.yy.yy.yy dst=xxx.xxx.x.xx mac=FF:FF:FF:FF:FF:FF protocol=udp sport=60000 dport=1234
SyslogMessage 2:
FF:FF:FF:FF:FF protocol=udp sport=60000 dport=1234

have you observed same issue if not can you please help the method you followed.

Thanks in advance
- mperrotta
  Brass Contributor
  Mar 31, 2020
  We are seeing the same symptom as well. We currently have a support case open to look into this. If we find the solution, I will update you.
  - Deleted
    Sep 18, 2020
    mperrottawe're seeing the same problem, did you ever find a solution for this?

Resources