topic Re: Trigger Meraki alerts in Cloud Networking Platform

Trigger Meraki alerts

fakrulalam — Wed, 20 Nov 2019 05:04:15 GMT

Hi,

I am working on integrating Mearki alerts (using webhook) with ITSM. To test the functionality I like to test each alerts and see how it reflect in ITSM. Is there any scripts/tool I can use to trigger the alerts specially udldError, malwareDetected, malwareBlocked, portCableError and rougueDHCPServer. I am able to trigger them manually it's really time consuming and I can't do it remotely.

Thanks

Fakrul.

Re: Trigger Meraki alerts

BrechtSchamp — Wed, 20 Nov 2019 06:59:16 GMT

I suppose you already know that you can trigger AMP using the EICAR samples (eicar.org).

For rogue DHCP you could just run an open source DHCP server. Tftpd comes to mind.

But you can't do that remotely indeed. Unless you can access a client remotely. And I wouldn't do the DHCP test on a production network.

Re: Trigger Meraki alerts

fakrulalam — Wed, 20 Nov 2019 09:40:09 GMT

Yes i was able to use EICAR to check malwereBlocked alert. Regarding DHCP I am alwaya getting newDHCPDetected not the rogueDHCP one. Not sure for which scenario rogueDHCP alerts trigger.

Re: Trigger Meraki alerts

BrechtSchamp — Wed, 20 Nov 2019 09:45:27 GMT

I haven't tested with it, but is the DHCP server you added handing out addresses in the same range as the MX is?

Re: Trigger Meraki alerts

Philip D'Ath — Wed, 20 Nov 2019 18:33:03 GMT

>Is there any scripts/tool I can use to trigger the alerts

No.

Re: Trigger Meraki alerts

BlakeRichardson — Wed, 20 Nov 2019 20:28:25 GMT

@fakrulalam I would imagine a rogue DHCP alert would come when a subnet has a second DHCP server added onto it.

Re: Trigger Meraki alerts

fakrulalam — Wed, 20 Nov 2019 23:04:46 GMT

I have tried putting a new DHCP server (advertising the same prefixes) but still getting NewDHCPservcerdetected alert.