topic Re: getOrganizationApplianceSecurityEvents - deviceMac in Network Platform API

getOrganizationApplianceSecurityEvents - deviceMac

Prodrick — Sun, 28 Jan 2024 15:22:55 GMT

Is the deviceMac in this response the hardware address of the Security Appliance?

https://developer.cisco.com/meraki/api/get-organization-appliance-security-events/

  {
    "ts": "2018-02-11T00:00:00.090210Z",
    "eventType": "IDS Alert",
    "deviceMac": "00:18:0a:01:02:03",
    "clientMac": "A1:B2:C3:D4:E5:F6",
    "srcIp": "1.2.3.4:34195",
    "destIp": "10.20.30.40:80",
    "protocol": "tcp/ip",
    "priority": "2",
    "classification": "4",
    "blocked": true,
    "message": "SERVER-WEBAPP JBoss JMX console access attempt",
    "signature": "1:21516:9",
    "sigSource": "",
    "ruleId": "meraki:intrusion/snort/GID/1/SID/26267"
  }

Re: getOrganizationApplianceSecurityEvents - deviceMac

amitpalsingh — Sun, 28 Jan 2024 15:27:42 GMT

Yes that's Mac of the meraki appliance

Re: getOrganizationApplianceSecurityEvents - deviceMac

Prodrick — Sun, 28 Jan 2024 16:06:49 GMT

Thanks so much! I was surprised that deviceSerial was not included like it is for network events.

https://api.meraki.com/api/v1/networks/:networkId/events