Cisco Meraki Access to Suspicious Domain

Siddhant Mishra@Siddhant

•updated yesterday•0•0•0

Detects web access through Meraki content filtering. Branch users frequently work without the endpoint controls applied at headquarters, so the network appliance is often the only layer observing where they go. Onboarding: CISCO-MERAKI is ingested via Syslog (Bloo extractor 300). Integration guide: https://bloo.io/docs/hypercloud/syslog-connector BQL (Bloo Query Language): stream=webfilter where sourcename='CISCO-MERAKI' and action='URL_ACCESSED' | duration 1h | groupby srcip, domain, url, useragent, user