TEAM: Huntress Managed Security Information and Event Management (SIEM)
PRODUCT: SIEM Syslog
ENVIRONMENT: Meraki MX Security Appliance
SUMMARY: Configuration Guide for Meraki MX Security Appliance

• Vendor Information
• Device Configuration Checklist
• Example Log Messages
  • Firewall Allow
  • Content Filter Block

This page only covers the device-specific configuration, you'll still need to read Huntress Managed SIEM Syslog Guide to complete the Huntress Managed SIEM setup as well as opening a port in Microsoft Defender Firewall.

Vendor Information

Device Configuration Checklist

1. Log into the Meraki dashboard
2. Navigate to Network-Wide > Configure > General
3. Scroll down to the Reporting section
4. Click on Add a syslog server
5. <image>
6. Set the IP Address to the IP of the Huntress agent collecting syslog
7. Set the Port to 514
8. Add to roles: Security events and Appliance event log

Example Log Messages

Firewall Allow

<134>1 1740758786.326960869 hostname firewall src=192.168.100.10 dst=1.2.3.4 mac=00:15:5D:64:B8:01 protocol=udp sport=58232 dport=53 pattern: allow all

Content Filter Block

<134>1 1740759085.123643628 hostname events content_filtering_block url='https://oneclient.sfx.ms/...' category0='Online Storage and Backup' server='23.40.69.79:443' client_mac='0C:37:96:9E:7B:01'