Does anyone know if there is a list of API endpoints that the Meraki API event source uses?
I am looking to see if Rapid7 IDR specifically pulls the Air Marshall events so we can alert on Rogue AP events from Meraki. It looks like the syslog would include it, but I would much prefer an API since its cleaner and “easier” to handle.
Air Marshal Documentation
https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal
Air Marshal Syslog event per documentation
event type of device_alerting
API Call for AirMarshal Events for Cisco Meraki
https://developer.cisco.com/meraki/api-v1/get-network-wireless-air-marshal/