What Changed
The Cisco Meraki CCF connector has been updated from v3.0.2 to v3.1.0. The connector definition and poller configuration files have been replaced with new versions (CiscoMeraki_ConnectorDefinition.json and CiscoMeraki_PollerConfig.json), and the DCR (CiscoMeraki_dcr.json) has been updated. Four new custom log table definitions are added:
- table_CiscoMerakiOrganizations.json populates CiscoMerakiOrganizations_CL
- table_CiscoMerakiOrganizationNetworks.json populates CiscoMerakiOrganizationNetworks_CL
- table_CiscoMerakiNetworkClients.json populates CiscoMerakiNetworkClients_CL
- table_CiscoMerakiAirMarshalEvents.json populates CiscoMerakiAirMarshalEvents_CL
The original three ASIM-normalised streams (Security Events to ASimNetworkSessionLogs, API Requests to ASimWebSessionLogs, Configuration Changes to ASimAuditEventLogs) are retained and continue to be populated.
Security Impact (Visibility and Fidelity)
Wireless Air Marshal Events (CiscoMerakiAirMarshalEvents_CL) is the most operationally significant addition. Meraki Air Marshal continuously scans for rogue access points, SSID spoofing, and unauthorised wireless clients. Prior to this update, that telemetry was not ingested into Sentinel - deployments had no visibility into wireless-layer threats from this data source despite the Meraki connector being installed.
Network Clients (CiscoMerakiNetworkClients_CL) surfaces MAC address, IP address, operating system, SSID association, and online/offline status for all clients connected to Meraki-managed networks. This enables asset inventory queries and supports lateral movement investigations by correlating client presence with security events.
Organizations (CiscoMerakiOrganizations_CL) and Organization Networks (CiscoMerakiOrganizationNetworks_CL) provide Meraki Dashboard inventory context - cloud region, licensing model, and network product types - useful for scoping detections and enriching alerts with topology context.
The connector now uses a multi-tenant connection model, supporting one CCF polling connection per Meraki organization with parallel ingestion.
New Tables and Sample Queries
| Table | Primary Use |
|---|---|
| CiscoMerakiAirMarshalEvents_CL | Rogue AP / SSID spoofing detection; Ssid, Channels, FirstSeen, LastSeen, WiredMacs fields |
| CiscoMerakiNetworkClients_CL | Client inventory; MacAddress, IpAddress, OperatingSystem, Ssid, Status fields |
| CiscoMerakiOrganizations_CL | Org inventory; Cloud, Licensing fields (JSON-encoded, use parse_json()) |
| CiscoMerakiOrganizationNetworks_CL | Network topology; ProductTypes field (JSON array, use mvexpand) |
Rogue AP hunting query (7-day lookback):
CiscoMerakiAirMarshalEvents_CL
| where TimeGenerated > ago(7d)
| project TimeGenerated, Ssid, Channels, FirstSeen, LastSeen, WiredMacs
| order by TimeGenerated desc
Online client enumeration (24-hour window):
CiscoMerakiNetworkClients_CL
| where TimeGenerated > ago(24h) and Status == "Online"
| project TimeGenerated, MacAddress, IpAddress, Description, OperatingSystem, Ssid
| order by TimeGenerated desc
Affected Files
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_ConnectorDefinition.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_PollerConfig.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_dcr.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/dataConnectorDefinition.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/dataConnectorPoller.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/dcr.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiAirMarshalEvents.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiNetworkClients.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiOrganizationNetworks.json
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiOrganizations.json
(packaging artefacts: 3.1.0.zip, ReleaseNotes.md, Solution_Cisco Meraki Events via REST API.json, createUiDefinition.json, mainTemplate.json)