---
title: "Cisco Meraki Integration"
slug: "meraki"
updated: 2026-11-03T23:32:47Z
published: 2026-11-03T23:32:47Z
canonical: "docs.hunters.ai/meraki"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cisco Meraki Integration

## TL;DR

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Cisco Meraki Wireless Event Log |  | ✅ | ✅ | ✅ | `cisco_meraki_wireless_event_log` | CSV with header | API |

## Overview

Cisco Meraki is a cloud-managed networking platform that provides wireless access points, switches, security appliances, and systems management for enterprise and campus networks. The Meraki Dashboard API exposes an Event Log for each network that records granular operational events generated by access points and wireless clients, including 802.11 association/disassociation, 802.1X authentication exchanges, L3 roaming/anchor assignment, RADIUS interactions, and dropped-event notifications. This integration collects those events via the Meraki Dashboard API as a quoted CSV with a header row. For security operations, this data is valuable for tracking client connectivity and roaming behavior across access points, detecting authentication failures or repeated de-authentications that may indicate credential issues or rogue client activity, and correlating wireless client MAC addresses, usernames, access point locations, and anchor IP addresses during incident investigations.

## Supported data types

### Cisco Meraki Wireless Event Log

**Table name:** `cisco_meraki_wireless_event_log`

This data type contains per-network wireless event log entries generated by Meraki access points and wireless clients, covering 802.11 association/disassociation, 802.1X authentication and RADIUS exchanges, L3 roaming/anchor assignment, and dropped-event notifications. It provides visibility into client connectivity, roaming behavior, and authentication activity across the wireless network, which is useful for detecting repeated authentication failures, rogue client behavior, and connectivity anomalies.

**Expected format**

Logs are expected in CSV with header format.

`"Feb 4 14:54:07","AP-NYC-02","CORP","a1b2c3d4-5e6f-4789-9abc-def012345678","802.1X","Failed authentication (EAP failure)","""radio: 0, vap: 0, client_mac: 3C:5A:B4:7E:21:9F"""`

## Send data to Hunters

Hunters supports the collection of Cisco Meraki logs using API.

**To connect Cisco Meraki logs:**

1. Create API credentials in the Cisco Meraki console with read access to the relevant data, following the [vendor documentation](https://documentation.meraki.com/Platform_Management/Dashboard_Administration/Operate_and_Maintain/Monitoring_and_Reporting/Meraki_Event_Log).
2. Connect the data source in the Hunters portal with those credentials, as described in [this section](https://docs.hunters.ai/docs/connect-a-data-source-using-apiwebhook). Hunters pulls the data from the vendor API on a schedule.