MS Sentinel Cisco Meraki (using REST API) Data Connector Can't Edit Data Parser

Question

MS Sentinel Cisco Meraki (using REST API) Data Connector Can't Edit Data Parser

KTC2 20

Hello,

I'm new MS Sentinel. I've installed the Cisco Meraki (using REST API) Data Connector and its status shows "Connected". I can see data coming in. However, I keep getting a message that I need to edit the Cisco Meraki Data Parser to replace "Server 1", "Server 2", etc. with the actual names of our devices.

I can see it here:

Meraki Data Parser

This sounds easy, but I cannot find any way to edit the data parser. Can anyone tell me where/how to edit this data parser in Sentinel or Azure?

Accepted answer

0 additional answers

Your answer

Answer 1

Clive Watson 7,711 MVP Moderator

Hello, thanks for using my Workbook to troubleshoot this...you need to look at the Logs blade in your workspace and Functions (Fx) to find the parser (they are also know in Azure Monitor as "functions"):

User's image

When you find the one you want, hover over it (don't click on it) and select the "load code to editor" to enable you to EDIT the syntax, before saving.

I hope this helps

KTC2 20 Reputation points

2025-04-18T18:00:41.5766667+00:00

Hi,

I think this puts me on the right path; however, when I hover over the function I only see the following options:

Am I missing something?
KTC2 20 Reputation points

2025-04-18T18:04:03.9666667+00:00

On checking the Microsoft Sentinel functions it appears a bit different, but I still do not have an option to load code to editor. My only option is to run or use function.
KTC2 20 Reputation points

2025-04-18T19:22:52.37+00:00

Thank you, Mr. Watson! After a merry chase to figure out how to use Visual Studio Code and get it to work with Sentinel this solved my problem!
mpls 135 Reputation points

2025-04-21T22:03:15.0233333+00:00

Hello Mr Watson, Thank you for sharing your function. I cannot find any good documentation on what to use for the device ids when I edit the function. I have tried the "common names of the devices" e.g.

Or maybe the device ids are the serial numbers?

let MerakiSyslogDevices = pack_array("MyCompany- Happy Town OR", "MyCompany- SleepyTown NY", "MyCompany- Big Town"); // replace server1 and server2 with your actual Cisco Meraki device(s) and add more with comma separated

union isfuzzy=true
Clive Watson 7,711 Reputation points MVP Moderator

2025-04-25T15:55:49.0066667+00:00

Hi, I'd assume you can use the IPaddress of the device you installed the Agent on, or its DNS name?
The docs don't seem to say
https://azuremarketplace.microsoft.com/en-us/marketplace/apps/azuresentinel.azure-sentinel-solution-ciscomerakinativepoller?tab=overview
mpls 135 Reputation points

2025-04-25T16:02:43.24+00:00

I ended up trying the serial number of the Meraki devices and that seemed to work.

Share via

MS Sentinel Cisco Meraki (using REST API) Data Connector Can't Edit Data Parser

0 additional answers

Your answer