Cisco Meraki parsers are not working in different ways

[elimovar]

Title

Cisco Meraki ASIM NetworkSession parsers: LogType detection is unreliable and incompatible with documented Custom Logs via AMA ingestion

Summary

The Cisco Meraki NetworkSession normalization parsers (built-in _Im_NetworkSession_CiscoMerakiV11/V12, and the published ASimNetworkSessionCiscoMeraki / vimNetworkSessionCiscoMeraki) have multiple issues that prevent correct normalization of Meraki syslog data ingested via the officially documented "Custom Logs via AMA" method into a meraki_CL-style table. Some of these cause silent data loss (worst kind of bug — no error, just missing events), others cause hard runtime failures.

Environment

• Ingestion method: Custom Logs via AMA, per https://learn.microsoft.com/en-us/azure/sentinel/unified-connector-custom-device (table name meraki_CL)
• AMA version: latest
• Workspace region: Italynorth
• Meraki firmware version(s) in the fleet:[multiple]

Issues found

1. LogType matching uses raw-text substring search instead of the parsed field

ASimNetworkSessionCiscoMerakiSyslog (and the community-facing filter guidance) matches log categories using LogMessage has_any("flows", "firewall", "ids-alerts") — i.e. a substring check against the entire raw message, not the parsed LogType token. This produces false positives whenever any other part of the message (most commonly the device hostname) happens to contain one of these substrings. Example: a device named MX-Firewall-01 will match has_any("firewall") on every single message it sends, regardless of actual LogType.

Impact: categorization is unreliable and firmware/hostname-dependent; results can't be trusted without manual per-device verification.

2. Missing LogType coverage for firmware ≥ MX18.101

Since MX firmware 18.101, what used to be logged uniformly as flows is now logged as one of firewall, vpn_firewall, cellular_firewall, or bridge_anyconnect_client_vpn_firewall depending on which rule matched (documented in Meraki community threads, e.g. https://community.meraki.com/t5/Security-SD-WAN/MX-Syslog-Flows-Took-out-all-the-bandwitdh/m-p/253626). The parser's has_any list only covers flows and firewall explicitly; vpn_firewall, cellular_firewall, and bridge_anyconnect_client_vpn_firewall are not matched at all.

Impact: on newer firmware, entire categories of firewall-rule-match events are silently dropped.

3. ids-alerts string does not match observed LogType values

Already partially tracked in #12491. The parser checks for "ids-alerts", but observed real-world LogType values are ids-alerted (hyphen) per sample data, and Meraki's own docs say ids_alerted (underscore). None of these exactly match "ids-alerts" as a substring in a way that reliably fires. This causes IDS/IPS alert events to be dropped depending on which variant a given firmware actually emits.

4. _Im_NetworkSession_CiscoMerakiV12 throws a hard runtime error against AMA-ingested tables

project-away operator: Failed to resolve attribute as column entity: SourceSystem

SourceSystem (along with Computer, MG, ManagementGroupName) is a legacy column automatically added by the old MMA/OMS-agent custom-log ingestion path. Tables created via the currently-documented Custom Logs via AMA connector do not include these columns unless manually added via a DCR transform. The parser's unconditional project-away reference to SourceSystem therefore fails outright against any table ingested the way Microsoft's own docs instruct.

This is the same class of bug already reported and reproduced for _Im_WebSession_SquidProxyV06 in #11268, which hits the identical Computer/SourceSystem/MG/ManagementGroupName problem against AMA-ingested data.

5. _Im_NetworkSession_CiscoMerakiV11 returns zero rows against a table with confirmed data

Running _Im_NetworkSession_CiscoMerakiV11(starttime=ago(30m)) returns 0 rows, while the same time range on the raw meraki_CL table (and on our own custom temp parser built against it) returns data. No error is thrown, suggesting the function is filtering on a table, column name, or LogType casing that doesn't match what's actually present in an AMA-ingested meraki_CL table — likely assumptions inherited from the older, deprecated OMS-agent-based ingestion schema.

6. Published ASimNetworkSessionCiscoMeraki targets an unrelated table

The current parser queries CiscoMerakiNativePoller_CL filtered to EventOriginalType == "IDS Alert" — i.e., it's scoped to the Cisco Meraki (REST API) connector's security-events feed only. It does not read from meraki_CL at all, so it produces zero rows for anyone using the documented syslog-based Custom Logs via AMA ingestion path, and even if it did read the right table, it would only ever surface IDS alerts, not flow/firewall/URL/session data. There is currently no published ASIM NetworkSession parser covering meraki_CL, even though ASimWebSessionCiscoMeraki (WebSession schema) does support that table — an inconsistency between the two schemas for the same source.

Steps to reproduce

1. Set up Cisco Meraki log collection via Custom Logs via AMA into meraki_CL, per https://learn.microsoft.com/en-us/azure/sentinel/unified-connector-custom-device
2. Confirm data is landing: meraki_CL | take 20
3. Run _Im_NetworkSession_CiscoMerakiV12(starttime=ago(30m)) → observe project-away error re: SourceSystem
4. Run _Im_NetworkSession_CiscoMerakiV11(starttime=ago(30m)) → observe 0 rows despite confirmed data in step 2
5. (Optional) Rename a Meraki device to include "firewall" in its hostname and observe has_any("firewall") matching unrelated LogTypes from that device

Expected behavior

• Parsers execute without error against tables ingested via the documented Custom Logs via AMA method.
• LogType categorization is based on the parsed LogType field (fixed token position in the raw message), not substring search across the entire raw message.
• All current firmware LogType variants for firewall-rule-match events are recognized.
• A NetworkSession parser exists that actually targets meraki_CL, analogous to the existing ASimWebSessionCiscoMeraki WebSession parser.

Suggested fixes

• Replace LogMessage has_any(...) categorization with matching against the parsed LogType field.
• Extend the firewall LogType list to include vpn_firewall, cellular_firewall, bridge_anyconnect_client_vpn_firewall.
• Match IDS alert LogType with a pattern covering ids-alerted, ids_alerted, and ids-alerts.
• Replace unconditional references to SourceSystem/Computer/MG/ManagementGroupName with column_ifexists(...) guards, consistent with how other AMA-compatible ASIM parsers handle optional legacy columns.
• Publish (or update) a NetworkSession parser that targets meraki_CL directly for flow/firewall/URL/session data, mirroring the existing WebSession coverage of that table.

Additional context

Related existing issues:

• Cisco Meraki ASimNetworkSession Parser Missing Detection of Security Events (ids_alerted) #12491 (ids_alerted vs ids-alerted mismatch)
• ASimWebSessionSquidProxy issue with data from AMA #11268 (identical SourceSystem/Computer/MG/ManagementGroupName failure pattern on _Im_WebSession_SquidProxyV06 against AMA-ingested data — same underlying cause)
• Cisco Meraki ASIM network session parser issue #7863 (CiscoMerakiNativePoller_CL no longer reflects current ingestion architecture)

[elimovar]

hello, i built a custom version here https://github.com/elimo-000/MicrosoftSentinel/tree/main/Meraki based on a limited set of logs from Cisco Meraki MX95 ver. 26.1.5 and a MX64 ver. 18.107.13, if it helps.
EDIT: i didn't forked this repo because it is my first experimentation with ASIM parsers at this level.

Because i need some customizations i am using the imNetworkSession workspace-level asim parser and excluding what is unused with the AsiMDisabledParsers watchlist.