> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Meraki Firewall

> Connect ThreatAware to Cisco Meraki Firewall to monitor network security and device communications

## Overview

The Meraki Firewall integration enables ThreatAware to collect data from your Meraki dashboard, providing visibility into network security events and device communications.

<Info>
  **Connection Method**: API
  **Setup Time**: 10 minutes
  **Access Required**: Meraki Administrator account
</Info>

## Data collected

The Meraki Firewall integration provides:

* Network security events
* Device communications
* Network health indicators
* Firewall rule enforcement

## Use cases

<CardGroup cols={2}>
  <Card title="Network Security Monitoring" icon="shield">
    Monitor firewall events and network security across your organisation
  </Card>

  <Card title="Device Communication Tracking" icon="network-wired">
    Track device communications and network patterns
  </Card>

  <Card title="Security Event Detection" icon="triangle-exclamation">
    Identify anomalies and potential security threats
  </Card>

  <Card title="Compliance Reporting" icon="clipboard-check">
    Generate reports for security compliance requirements
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Enable API Access in Meraki">
    Log in to your [Meraki Dashboard](https://account.meraki.com/login/dashboard_login) with administrator credentials.

    Navigate to your organisation settings:

    * Select the appropriate **Organisation**
    * Go to **Organisation Settings**
    * Ensure that **Dashboard API access** is enabled
  </Step>

  <Step title="Generate an API Key">
    Create an administrator account specifically for ThreatAware API access (recommended):

    * Navigate to the **Admin profile** for an administrator account
    * Scroll to the **API Access** section
    * Click **Generate new API key**
    * Copy the API key and save it securely for use in ThreatAware

    <Warning>
      Store this API key securely. Anyone with this key can access your Meraki dashboard data.
    </Warning>
  </Step>

  <Step title="Retrieve Organisation ID">
    The Organisation ID identifies which Meraki organisation to monitor:

    * Ensure you are logged in as the API admin
    * Visit the [Meraki API Organisations endpoint](https://n270.meraki.com/api/v1/organisations)
    * The page displays JSON with all accessible organisations
    * Find and copy the **ID** field for the organisation to monitor
    * Save this ID for the next step
  </Step>

  <Step title="Enable Hostname Visibility">
    Ensure hostname visibility is enabled for accurate device identification:

    * For each Meraki network to monitor, verify **Hostname Visibility** is enabled
    * Refer to [Meraki Hostname Visibility Documentation](https://documentation.meraki.com/MR/Monitoring_and_Reporting/Hostname_Visibility) for detailed instructions
  </Step>

  <Step title="Configure in ThreatAware">
    Add the Meraki Firewall integration to ThreatAware:

    * Log in to ThreatAware and navigate to **Settings → Integrations**
    * Search for **Meraki Firewall** and click **Connect**
    * In the pop-up window, enter:
      * **Organisation ID**: The ID copied in Step 3
      * **API Key**: The key generated in Step 2
    * Click **Authorize** to complete the setup
  </Step>

  <Step title="Verify Connection">
    Confirm the integration is working:

    * Check the integration status in ThreatAware shows **Active**
    * Wait 5-10 minutes for initial data synchronization
    * Verify firewall events and device data appear in ThreatAware
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="API Key" icon="key">
    **Field Name**: Meraki API Key
    **Type**: Password (encrypted)
    **Description**: The API key generated from your Meraki administrator account

    This key provides read-only access to your Meraki dashboard data. Generate it through:

    * Your Meraki admin profile > **API Access** section
    * Or create a dedicated admin account for ThreatAware

    <Tip>
      Use a dedicated administrator account for ThreatAware API access to maintain security audit trails.
    </Tip>
  </Accordion>

  <Accordion title="Organisation ID" icon="building">
    **Field Name**: Meraki Organisation ID
    **Type**: String
    **Description**: The unique identifier for your Meraki organisation

    Found by:

    * Visiting the [Meraki API Organisations endpoint](https://n270.meraki.com/api/v1/organisations)
    * Copying the **ID** value from the JSON response
    * Example format: `123456`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings → Integrations** in ThreatAware
   * Confirm Meraki Firewall shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 5-10 minutes for initial data sync
   * Check for Meraki firewall events in the dashboard
   * Verify device network information is populated

3. **Test Queries**
   * Create a test query to filter devices with Meraki data
   * Verify network security events appear as expected

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid API Key Error" icon="triangle-exclamation">
    **Symptoms**: Integration fails with authentication error

    **Solutions**:

    * Verify the API key is copied correctly without extra spaces
    * Ensure the API key has not expired or been revoked
    * Check that Dashboard API access is enabled in Organisation Settings
    * Regenerate the API key if needed and update ThreatAware
  </Accordion>

  <Accordion title="Organisation ID Not Found" icon="ban">
    **Symptoms**: Integration fails to find the organisation

    **Solutions**:

    * Verify the Organisation ID is correct from the API endpoint
    * Ensure the API admin has access to this organisation
    * Check that the ID format is correct (numeric string)
    * Visit the [Meraki API Organisations endpoint](https://n270.meraki.com/api/v1/organisations) again to confirm the ID
  </Accordion>

  <Accordion title="No Firewall Events Appearing" icon="database">
    **Symptoms**: Integration is active but no firewall data appears

    **Solutions**:

    * Verify Hostname Visibility is enabled on Meraki networks
    * Check that firewall events are occurring in your Meraki dashboard
    * Ensure the organisation ID contains devices with firewall data
    * Wait up to 10 minutes for initial data synchronization
    * Review network rules to confirm events are being generated
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or frequently disconnects

    **Solutions**:

    * Verify your network allows HTTPS (443) outbound to Meraki APIs
    * Check that api.meraki.com is accessible from your ThreatAware instance
    * Temporarily disable any VPN or proxy and test the connection
    * Contact Meraki support if api.meraki.com is blocked
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Meraki Dashboard" icon="browser" href="https://account.meraki.com/login/dashboard_login">
    Access your Meraki dashboard to manage your account and API settings
  </Card>

  <Card title="Meraki API Documentation" icon="book" href="https://developer.meraki.com/">
    Official Meraki API documentation for authentication and endpoints
  </Card>

  <Card title="Hostname Visibility Guide" icon="network-wired" href="https://documentation.meraki.com/MR/Monitoring_and_Reporting/Hostname_Visibility">
    Instructions for enabling hostname visibility on your Meraki networks
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Dedicated Service Account**

  * Create a dedicated administrator account specifically for ThreatAware
  * This improves security audit trails and makes it easy to revoke access
  * Document the account in your security policy
</Tip>

<Tip>
  **API Key Rotation**

  * Rotate the API key annually or per your security policy
  * Keep previous keys for a short period during transitions
  * Update ThreatAware immediately with the new key
</Tip>

<Tip>
  **Monitor API Usage**

  * Review Meraki dashboard logs periodically for ThreatAware API calls
  * Set up alerts for failed API authentication attempts
  * Monitor data synchronization to ensure integration health
</Tip>