[Cisco Meraki] Updating Cisco Meraki CCF Connector

[dhanunjaya1054]

Change(s):

• Added 4 new data types to the Cisco Meraki CCP connector: Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events

Reason for Change(s):

• Expands log coverage beyond the original 3 ASIM event types (Security Events, API Requests, Configuration Changes) to include Meraki Dashboard inventory and wireless security data, giving richer visibility for monitoring, alerting, and investigation.

Version Updated:

• 3.1.0

Testing Completed:

• Yes

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the Cisco Meraki CCF/CCP connector to expand ingestion beyond the original ASIM event types by adding inventory and wireless security data types, with corresponding solution metadata and connector definitions updated to version 3.1.0.

Changes:

• Added 4 new custom-table data types: Organizations, Organization Networks, Network Clients, and Wireless Air Marshal Events.
• Reworked connector assets by replacing the legacy poller/DCR/definition JSONs with new CiscoMeraki_* DCR + poller config + connector definition.
• Updated solution metadata/UI text and release notes to reflect the expanded coverage and new version.

Reviewed changes

Copilot reviewed 13 out of 15 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
Solutions/Cisco Meraki Events via REST API/ReleaseNotes.md	Adds 3.1.0 entry describing the 4 new data types.
Solutions/Cisco Meraki Events via REST API/Package/createUiDefinition.json	Updates solution description text and connector labeling.
Solutions/Cisco Meraki Events via REST API/Data/Solution_Cisco Meraki Events via REST API.json	Bumps version to 3.1.0, updates description and connector definition path.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiOrganizations.json	New custom table schema for Organizations.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiOrganizationNetworks.json	New custom table schema for Organization Networks.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiNetworkClients.json	New custom table schema for Network Clients.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/table_CiscoMerakiAirMarshalEvents.json	New custom table schema for Air Marshal Events.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/dcr.json	Removes legacy DCR.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/dataConnectorPoller.json	Removes legacy poller definitions.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/dataConnectorDefinition.json	Removes legacy connector definition.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_dcr.json	Adds new consolidated DCR for ASIM + custom tables.
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_PollerConfig.json	Adds new poller config for all 7 data types (4 custom + 3 ASIM).
Solutions/Cisco Meraki Events via REST API/Data Connectors/CiscoMerakiMultiRule_ccp/CiscoMeraki_ConnectorDefinition.json	Adds new connector UI definition, queries, and instruction steps.

[v-maheshbh]

Hi @dhanunjaya1054

Kindly review the comments provided above. Please address them as needed and resolve the conversations once completed.

Thanks!

[dhanunjaya1054]

Hi @dhanunjaya1054

Kindly review the comments provided above. Please address them as needed and resolve the conversations once completed.

Thanks!

@v-maheshbh - I have addressed all the comments. please review it. Thanks!

[v-maheshbh]

Hi @dhanunjaya1054

Kindly review and remove the blank properties reported at the below locations and Kindly attach a screenshot of the CCF data connector in a connected state for reference.

Thanks!

[jlheard]

@dhanunjaya1054, how do these new tables fit into existing parser https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoMeraki/Parsers/CiscoMeraki.yaml?

[dhanunjaya1054]

@dhanunjaya1054, how do these new tables fit into existing parser https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/CiscoMeraki/Parsers/CiscoMeraki.yaml?

The existing CiscoMeraki.yaml parser is built exclusively for the legacy syslog path, it unions meraki_CL, filtered Syslog, and CiscoMerakiNativePoller_CL, then regex-parses an unstructured LogMessage string. The new REST API tables have no LogMessage to parse, so they intentionally sit outside it.

[dhanunjaya1054]

Hi @dhanunjaya1054

Kindly review and remove the blank properties reported at the below locations and Kindly attach a screenshot of the CCF data connector in a connected state for reference.

Thanks!

Removed the blank properties. Also please find the below screenshot that shows the data has been ingested.