Cisco Meraki Out-of-the-Box Response Integration

Cisco Meraki Out-of-the-Box Response Integration

This article describes the required procedure to integrate Cisco Meraki with Lumu for automated response procedures. This is one of our featured Out-of-the-Box Response Integrations.

Requirements

  • Cisco Meraki
    • A Cisco deployment with MX devices is needed to work with Firewall rules. To get more information about licensing options, you can consult the documentation on Meraki MX Security and SD-WAN Licensing.
    • An active Lumu Defender Subscription or a Lumu for MSP account.

Preliminary Setup - Cisco Meraki

In order to set up the integration, you will need to prepare Cisco Meraki to communicate with the Lumu integration. To do this, you will need the following:
  • API Key
In the following steps, you will find how to obtain this requirement.

Generate an API Key

1. Log into the Cisco Meraki page. On the Dashboard, click on Organization.

2. In the Organization sub-menu, click on API & webhooks.

3. The following window will open. Click on API keys and access.

4. Click on Generate API Key and store the value shown in a safe place.
Notes
You won’t be able to recover the API key once you close this window. If you lose your API key, you will need to repeat the steps from the start.
Notes
Lumu encrypts this information both in transit and at rest to ensure token confidentiality. This will remove token updating concerns from the integration maintenance process.

Integration Setup - Lumu Portal

This section of the article describes the steps that must be completed on the Lumu Portal to properly set up the Cisco Meraki Integration. To start, log into your Lumu account through the Lumu Portal.
Notes
Integrations are also available for Lumu MSP accounts. To access them, log into the Lumu MSP Portal.
1. In the Lumu Portal, head to the panel on the left and open the Integrations drop-down menu. Then,click on Apps. Click on the Response tab on the right to filter the available integrations accordingly.

2. Locate the Cisco Meraki integration and click on Add.

3. Familiarize yourself with the integration details and click the Activate button to start the integration set up process.

4. Provide a meaningful Name(1). Under Threat Types(2), choose the specific threat mappings you want to push to Cisco Meraki. Select the option Include IP Indicators(3) to include IP addresses in the information sent to your feed list. When done, click on the orange Next button.
Notes
If you leave the Include IP Indicators option unselected, you won’t be able to change it later. You will need to remove the integration and repeat all the steps again.
Notes
Please note that you cannot modify the information on this screen. Exercise caution when selecting Threat Types, as changes cannot be made later.

5. For this step, you will need to provide the API Key created in Step 4 of the Generate an API Key section. Then, click on the orange Next button.

6. Next, you will need to designate the Organization(1) for which you intend to implement the integration. Once selected, you will also need to align the organization's specifications with the appropriate Templates and Networks(2) where you wish to apply the feed.

Notes
All templates are visible. However, the list will also display networks unbound to templates. If you need more information about templates and how to manage them, please refer to the document on Managing Multiple Networks with Configuration Templates

7. The integration is now created and active. The Lumu Portal will display the details of the created integration:
Notes
Once the integration is activated, the Security & SD-WAN/Firewall section will be updated with confirmed compromises found by Lumu within the preceding 3 days.

Final Steps - Validate the Cisco Meraki Dashboard

To validate the rules managed by Lumu integration, go to your Meraki Dashboard console and follow these steps:

1. Select one of the networks configured in the integration.

2. Under Security & SD-WAN(1), click on the Firewall(2) menu under the Configure section.

3. The new rules are labeled as Detected by Lumu under the Outbound rules section.


    Still can’t find an answer?
    Send a message to our experts.
    Contact Us

        • Related Articles

        • Lumu Out-of-the-box Integrations

          For getting started with Lumu integrations with third-party solutions, consult our Integrations guide. Lumu's Out-of-the-box (OOTB) integrations are a seamless and convenient way to integrate Lumu with other solutions in your cyberdefense stack to ...

        • Cisco Secure Endpoint Out-of-the-Box Response Integration

          This article describes the required procedure to integrate Cisco Secure Endpoint with Lumu for automated response procedures. This is one of our featured Out-of-the-Box Response Integrations. Requirements A Cisco Secure Endpoint Essentials or above ...

        • Cisco Firepower Out-of-the-box Response Integration

          To learn more about Out-of-the-box Integrations and their benefits, please refer to this article. The Lumu Defender API offers a framework to help you leverage Lumu’s integrations with your existing cybersecurity stack, including Security Information ...

        • Infoblox Threat Defense Out-of-the-Box Response Integration

          This article describes the required procedure to integrate Infoblox Threat Defense with Lumu for automated response procedures. This is one of our featured Out-of-the-Box Response Integrations. Requirements Below you will find the technical ...

        • FortiGate Out-of-the-Box Address Group response integration

          This article guides you through the integration process of FortiGate Firewall with Lumu for automated response procedures. This is one of our featured Out-of-the-Box Response Integrations. Requirements FortiGate Firewall version 6.2 or higher A ...