TL;DR
| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
|---|---|---|---|---|---|---|---|
| Cisco Meraki Wireless Event Log | ✅ | ✅ | ✅ | cisco_meraki_wireless_event_log |
CSV with header | API |
Overview
Cisco Meraki is a cloud-managed networking platform that provides wireless access points, switches, security appliances, and systems management for enterprise and campus networks. The Meraki Dashboard API exposes an Event Log for each network that records granular operational events generated by access points and wireless clients, including 802.11 association/disassociation, 802.1X authentication exchanges, L3 roaming/anchor assignment, RADIUS interactions, and dropped-event notifications. This integration collects those events via the Meraki Dashboard API as a quoted CSV with a header row. For security operations, this data is valuable for tracking client connectivity and roaming behavior across access points, detecting authentication failures or repeated de-authentications that may indicate credential issues or rogue client activity, and correlating wireless client MAC addresses, usernames, access point locations, and anchor IP addresses during incident investigations.
Supported data types
Cisco Meraki Wireless Event Log
Table name: cisco_meraki_wireless_event_log
This data type contains per-network wireless event log entries generated by Meraki access points and wireless clients, covering 802.11 association/disassociation, 802.1X authentication and RADIUS exchanges, L3 roaming/anchor assignment, and dropped-event notifications. It provides visibility into client connectivity, roaming behavior, and authentication activity across the wireless network, which is useful for detecting repeated authentication failures, rogue client behavior, and connectivity anomalies.
Expected format
Logs are expected in CSV with header format.
"Feb 4 14:54:07","AP-NYC-02","CORP","a1b2c3d4-5e6f-4789-9abc-def012345678","802.1X","Failed authentication (EAP failure)","""radio: 0, vap: 0, client_mac: 3C:5A:B4:7E:21:9F"""
Send data to Hunters
Hunters supports the collection of Cisco Meraki logs using API.
To connect Cisco Meraki logs:
- Create API credentials in the Cisco Meraki console with read access to the relevant data, following the vendor documentation.
- Connect the data source in the Hunters portal with those credentials, as described in this section. Hunters pulls the data from the vendor API on a schedule.