Cisco Meraki Integration Guide🔗
Cisco Meraki must be configured to send logs via syslog to the Taegis™ XDR Collector. Logs are filtered and correlated in real-time for various security event observations.
You will need to configure the options based on the type of appliance you have. This document applies to:
- Meraki MX: Next-generation Firewall
Follow the instructions below to configure logging and enable monitoring by Secureworks.
Connectivity Requirements🔗
| Source | Destination | Port/Protocol |
|---|---|---|
| Cisco Meraki Appliance (MX) | XDR (mgmt IP) | UDP/514 |
Taegis IP Address Ranges🔗
If you have an existing firewall or API gateway IP allow list configured for this integration, or are planning to configure one, add the following XDR IP address ranges for your Taegis region.
| Taegis Region | IP Address Range |
|---|---|
| Charlie | 216.9.204.0/24 |
| Delta | 216.9.204.0/24 |
| Echo | 216.9.205.0/24 |
| Foxtrot | 216.9.206.0/24 |
| Golf | 216.9.207.0/24 |
| Hotel | 208.89.40.0/24 |
| India | 208.89.42.0/24 |
| Juliet | 208.89.41.0/24 |
| Kilo | 208.89.43.0/24 |
| Quebec | 208.89.44.0/24 |
Note
These would be the only IP ranges required for XDR integrations. If you previously configured older IP addresses, we recommend removing them after 30 days.
Prerequisites🔗
You must be licensed for each feature you are attempting to report on. You also must have admin access to the Meraki dashboard.
Data Provided from Integration🔗
| Normalized Data | Out-of-the-Box Detections | Vendor-Specific Detections | |
|---|---|---|---|
| Cisco Meraki Firewall | File | Auth, HTTP, Netflow | NIDS |
Note
XDR detectors are not guaranteed to be triggered, even if a data source's logs are normalized to a schema associated with a given detector. However, you can create Custom Detection Rules to generate detections based on normalized data from a data source.
Configuration Instructions🔗
Define syslog servers by following the instructions in the Configure Dashboard section of the Cisco Meraki Syslog Server Overview and Configuration documentation.
Consider the following requirements when completing the configuration steps:
- Server IP — The IP address of the Taegis™ XDR Collector
- Port — UDP port 514
- Roles — Specify all roles available for your appliance and license; options may include Wireless event log, Switch event log, Flows, URLs, Security event log, and more.
- If the Flows role is enabled on an MX security appliance, logging for individual firewall rules can be enabled and disabled on the Security appliance > Configure > Firewall page, under the Logging column.