Cisco Meraki Blocked Packet Pattern Indicating Scanning

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects a source generating blocked packets across many ports at a Meraki site. Scanning between branch sites never traverses the core firewall, so without the branch appliance's own logs this activity is invisible from the centre. Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=firewall where sourcename='CISCO-MERAKI' and action='PACKET_BLOCKED' | duration 10m | groupby srcip | select srcip, distinct_count(dstport) | having distinct_count_col1 > 25