Meraki Firewall Integration

Meraki Firewall

Version: Meraki Firewalls MX Series.

Meraki Firewalls are cloud-managed network security appliances designed to make distributed networks fast, secure, manageable by employing stateful inspection and auto-configuring VPN options. Netsurion's Open XDR platform amasses and examine logs generated by Meraki Firewall to help an administrator to monitor IDS alerts, VPN sessions, web traffic, user behavior and system activity.

Netsurion Data Source Integration for Meraki Firewall allows you to monitor the following:-

Operations - Web traffic and VPN sessions
Security - IDS alerts and blocked web content
Compliance - User behavior and system activity

Netsurion's Open XDR platform supports McAfee Firewall Enterprise (Sidewinder) and it can be configured to send syslog to Netsurion Enterprise.

Netsurion Data Source Integration for McAfee Sidewinder allows you to monitor following:-

Operations - Syslog messages for different services, account operations (addition, deletion and modification of user and group) and shutdown/restarting of system.
Security - Suspicious network activities, if there is any changes in privileges on user logon/authentication activities (logon, logoff).
Compliance - Changes in policy configuration (addition and deletion).

Once Meraki Firewall is configured to deliver events to Netsurion's Open XDR platform; alerts, dashboards and reports can be configured into Netsurion's Open XDR platform.

Some of the Data Source Integrations available in Netsurion are listed below.

Alerts

Type	Name	Description
Security	Meraki Firewall - IDS alert detected	This alert is generated when unusual traffic is detected by IDS.
Security	Meraki Firewall - Suspicious content blocked	This alert is generated when suspicious web content is blocked by content filter.

Reports

Type	Name	Description
Security	Meraki Firewall - IDS alert details	This report provides information related to threats detected by IDS which includes Source MAC, Source IP, Source Port, Destination MAC, Destination IP, Destination Port, Protocol Type and Alert Details fields.
Security	Meraki Firewall - Blocked web content details	This report provides information related to web content blocked by content filter which includes Host Address, Host Port, Blocked URL Category and Blocked URL fields.
Operations	Meraki Firewall - Traffic flow details	This report provides information related to traffic flow which includes Source MAC, Source IP, Source Port, Destination MAC, Destination IP, Destination Port, Protocol Type and Rule Name fields.
Operations	Meraki Firewall - Web traffic details	This report provides information related to web traffic which includes Source MAC, Source IP, Source Port, Destination MAC, Destination IP, Destination Port, Request Type and Requested URI fields.
Operations	Meraki Firewall - VPN session details	This report provides information related to VPN sessions establishment, connection or disconnection which includes VPN Type, VPN Status, User Name, Source IP, Source Port, Destination IP and Destination Port fields.
Compliance	Meraki Firewall - User authentication details	This report provides information related to local user authentication attempt which includes Host MAC, User Name, User Details and Group Details fields.
Compliance	Meraki Firewall - Device activity details	This report provides information related to configuration changes and system events which includes Device Name, Event Time and Activity fields.

Documentation

The configuration details are consistent with Netsurion's Open XDR platform version 7.x or later, and McAfee Firewall Enterprise (Sidewinder) 7.X and later.

Download Integration Guide and How-to Guide for more information and to configuration instructions.