Cisco Meraki
The JSA DSM for Cisco Meraki collects Syslog events from a Cisco Meraki device.
To integrate Cisco Meraki with JSA, complete the following steps:
If automatic updates are not enabled, download and install the most recent version of Cisco Meraki DSM RPM on your JSA Console.
Configure your Cisco Meraki device to send Syslog events to JSA.
-
If JSA does not automatically detect the log source, add Cisco Meraki log source on the JSA Console.
The following table describes the parameters that require specific values to collect events from Cisco Meraki:
Table 1: Cisco Meraki Syslog Log Source Parameters Parameter
Value
Log Source type
Cisco Meraki
Protocol Configuration
Syslog
Log Source Identifier
The IPv4 address or host name that identifies the log source.
If your network contains multiple devices that are attached to a single management console, specify the IP address of the individual device that created the event. A unique identifier, such as an IP address, prevents event searches from identifying the management console as the source for all of the events.
Tip:Cisco Meraki does not send events with RFC3164 or RFC5424 headers. As a result, log sources are auto discovered with the log source identifier of the packet IP of the event instead of the hostname or IP address that is in the header. Use the Syslog redirect protocol to use the value in the header instead of the value in the packet IP.
Cisco Meraki DSM Specifications
When you configure the Cisco Meraki DSM, understanding the specifications for the Cisco Meraki DSM can help ensure a successful integration. For example, knowing what protocol to use before you begin can help reduce frustration during the configuration process.
The following table describes the specifications for the Cisco Meraki DSM.
Specification |
Value |
---|---|
Manufacturer |
Cisco |
DSM name |
Cisco Meraki |
RPM file name |
DSM-CiscoMeraki-JSA_version-build_number.noarch.rpm |
Supported versions |
N/A |
Protocol |
Syslog |
Event format |
Syslog |
Recorded event types |
Events Flows security_event ids_alerted |
Automatically discovered? |
Yes |
Includes identity? |
No |
Includes custom properties? |
No |
More information |
Configure Cisco Meraki to Communicate with JSA
To collect Cisco Meraki events, configure your Cisco Meraki device to send Syslog events to JSA.
Configure Cisco Meraki to communicate with JSA by following the Syslog Server Overview and Configuration steps on (https:// Meraki.cisco.com).
Cisco Meraki Sample Event Messages
Use these sample event messages as a way of verifying a successful integration with JSA.
Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.
Cisco Meraki sample messages when you use the Syslog protocol
Sample 1: The following sample event message shows an outbound flow event that is used to initiate an IP session. It also shows the source, destination, and port number values along with the firewall rule that they matched.
<134>1 1515988859.626061236 appliance flows src=172.21.84.107 dst=10.52.193.137 mac=5C:E0:C5:22:85:E4 protocol=tcp sport=50395 dport=443 pattern: allow all
JSA field name |
Highlighted payload field name |
---|---|
Event ID |
In JSA, the value is always Outbound Flow Allow for these types of events. |
Source IP |
src |
Destination IP |
dst |
Destination MAC |
mac |
Protocol |
protocol |
Source Port |
sport |
Destination Port |
dport |
Sample 2: The following sample event message shows a security event that is generated when an array out of bounds write attempt is made. It also shows the source, destination, port numbers, destination MAC, and protocol values.
<134>1 1516050030.553653046 cisco.meraki.test security_event ids_alerted signature=1:45148:1 priority=1 timestamp=1516050030.236281 dhost=00:00:5E:00:53:BC direction=ingress protocol=tcp/ip src=10.79.70.235:80 dst=172.21.47.130:61019 message: BROWSER-IE Microsoft Internet Explorer Array out of bounds write attempt
JSA field name |
Highlighted payload field name |
---|---|
Event ID |
signature |
Source IP |
src |
Source Port |
The value that is used for the Source Port displays after the colon in the src value. For example, 80. |
Destination IP |
dst |
Destination Port |
The value that is used for the Destination Port displays after the colon in the dst value. For example, 61019. |
Destination MAC |
dhost |
Protocol |
protocol |