TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM Syslog
ENVIRONMENT: Meraki MX Security Appliance
SUMMARY: Configuration Guide for Meraki MX Security Appliance

• Vendor Information
• Device Configuration Checklist
• Example Log Messages
  • Firewall Allow
  • Content Filter Block

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Syslog Guide to complete the Huntress Managed SIEM setup as well as opening a port in Microsoft Defender Firewall.

Vendor Information

Please note that Huntress provides third party vendor instructions as a best effort to expedite onboarding. Vendor documentation and versions frequently change and so it may be necessary to find the appropriate documentation for syslog logging for your version of the vendor software or service.

Please note the link in the Vendor Links above to the latest documentation at the time of this writing.

Device Configuration Checklist

1. Log into the Meraki dashboard
2. Navigate to Network-Wide > Configure > General
3. Scroll down to the Reporting section
4. Click on Add a syslog server
5. Set the IP Address to the Internal IP of the Huntress agent collecting syslog
6. Set the Port to 514
7. Add to roles: Security events and Appliance event log (if roles are missing ensure licensing for device is set as "Advanced Security")

Example Log Messages

Firewall Allow

<134>1 1740758786.326960869 hostname firewall src=192.168.100.10 dst=1.2.3.4 mac=00:15:5D:64:B8:01 protocol=udp sport=58232 dport=53 pattern: allow all

Content Filter Block

<134>1 1740759085.123643628 hostname events content_filtering_block url='https://oneclient.sfx.ms/...' category0='Online Storage and Backup' server='23.40.69.79:443' client_mac='0C:37:96:9E:7B:01'