topic Security Events timeframe in Network Platform API

Security Events timeframe

CBurkhead — Thu, 12 Mar 2020 16:42:35 GMT

I am trying to pull security events for the past 6 months for a customer. I am using GET /networks/{networkId}/securityEvents and am specifying the timespan to be 183*86400 seconds. The documentation says that the default timespan is 31 days and you can go back as far as 365 days.

However, I am only getting data as far back as 2/5/20. If I remove the timespan parameter, I get the same time period. Has anyone tried to get data more than about a month old for security events? Based on my data today, it looks like the maximum you can get is about 35 days.

Re: Security Events timeframe

BrechtSchamp — Thu, 12 Mar 2020 17:09:17 GMT

I'm not sure if the information in those docs is correct. Aaron Willette once wrote a blog post about the retention times and it reported the retention for security events to be about 1 month.

Source: https://www.willette.works/meraki-event-logs/

Maybe @cammoody can comment on that, I don't think I've seen an official doc about the retentions.

Also, you may want to check out the Network-Wide > General page to make sure that you don't have a limit set there either (you may not have that setting if you're not in Europe):

Re: Security Events timeframe

CBurkhead — Thu, 12 Mar 2020 17:16:45 GMT

Checked for the privacy setting and I don't have it. Since I am in the US, it does not sound like I should.

Thanks for the link regarding the security log retention. I will check that out. Based on my own testing, it looks like the maximum number of days I can go back is about 36.

Thanks for the quick response, @BrechtSchamp!

Re: Security Events timeframe

BrechtSchamp — Thu, 12 Mar 2020 17:27:26 GMT

With pleasure.