{"type":"api","title":"Get Network Appliance Client Security Events","meta":{"id":"/apps/pubhub/media/Meraki-Dashboard-API-v1-Documentation/4723762d29b3380de018ae8c0d8a59499a6523e0/5c63a5d4-9452-397a-85eb-8b6fec45147e","info":{"title":"Meraki Dashboard API","description":"A RESTful API to programmatically manage and monitor Cisco Meraki networks at scale.\n\n> Date: 03 July, 2024\n>\n> [Recent Updates](https://meraki.io/whats-new/)\n\n---\n\n[API Documentation](https://meraki.io/api)\n\n[Community Support](https://meraki.io/community)\n\n[Meraki Homepage](https://www.meraki.com)\n","contact":{"name":"Meraki Developer Community","url":"https://meraki.io/community"},"version":"1.48.0"},"security":[{"meraki_api_key":[]},{"bearerAuth":[]}],"tags":[{"name":"organizations"},{"name":"networks"},{"name":"devices"},{"name":"insight"},{"name":"wireless"},{"name":"camera"},{"name":"appliance"},{"name":"switch"},{"name":"cellularGateway"},{"name":"sm"},{"name":"sensor"},{"name":"administered"},{"name":"accessControlLists"},{"name":"accessPolicies"},{"name":"acls"},{"name":"actionBatches"},{"name":"adaptivePolicy"},{"name":"addresses"},{"name":"admins"},{"name":"airMarshal"},{"name":"alertTypes"},{"name":"alerts"},{"name":"alternateManagementInterface"},{"name":"analytics"},{"name":"apiRequests"},{"name":"apnsCert"},{"name":"appliances"},{"name":"applicationCategories"},{"name":"applicationUsage"},{"name":"applications"},{"name":"areas"},{"name":"arpInspection"},{"name":"arpTable"},{"name":"artifacts"},{"name":"assets"},{"name":"assignments"},{"name":"authenticationToken"},{"name":"availabilities"},{"name":"bandwidthUsageHistory"},{"name":"bgp"},{"name":"billing"},{"name":"bluetooth"},{"name":"bluetoothClients"},{"name":"bonjourForwarding"},{"name":"boundaries"},{"name":"brandingPolicies"},{"name":"bulk"},{"name":"bulkUpdate"},{"name":"byBoundary"},{"name":"byClient"},{"name":"byDevice"},{"name":"byEnergyUsage"},{"name":"byInterval"},{"name":"byMetric"},{"name":"byModel"},{"name":"byNetwork"},{"name":"byStatus"},{"name":"bySwitch"},{"name":"byType"},{"name":"byUsage"},{"name":"byUtilization"},{"name":"bypassActivationLockAttempts"},{"name":"cableTest"},{"name":"callbacks"},{"name":"categories"},{"name":"cellular"},{"name":"cellularFirewallRules"},{"name":"cellularUsageHistory"},{"name":"certs"},{"name":"changeHistory"},{"name":"channelUtilization"},{"name":"channelUtilizationHistory"},{"name":"claim"},{"name":"claimKey"},{"name":"clientCountHistory"},{"name":"clients"},{"name":"cloudMonitoring"},{"name":"commands"},{"name":"compliance"},{"name":"configTemplates"},{"name":"configurationChanges"},{"name":"configure"},{"name":"configuredDevices"},{"name":"connectionStats"},{"name":"connectivity"},{"name":"connectivityEvents"},{"name":"connectivityMonitoringDestinations"},{"name":"contentFiltering"},{"name":"coterm"},{"name":"current"},{"name":"customAnalytics"},{"name":"customPerformanceClasses"},{"name":"dataRateHistory"},{"name":"delegated"},{"name":"desktopLogs"},{"name":"details"},{"name":"detections"},{"name":"deviceCommandLogs"},{"name":"deviceProfiles"},{"name":"deviceTypeGroupPolicies"},{"name":"dhcp"},{"name":"dhcpServerPolicy"},{"name":"dscpTaggingOptions"},{"name":"dscpToCosMappings"},{"name":"eapOverride"},{"name":"earlyAccess"},{"name":"electronicShelfLabel"},{"name":"entitlements"},{"name":"ethernet"},{"name":"eventTypes"},{"name":"events"},{"name":"exportEvents"},{"name":"failedConnections"},{"name":"features"},{"name":"fields"},{"name":"firewall"},{"name":"firewalledServices"},{"name":"firmware"},{"name":"firmwareUpgrades"},{"name":"floorPlans"},{"name":"groupPolicies"},{"name":"groups"},{"name":"health"},{"name":"healthByTime"},{"name":"historical"},{"name":"history"},{"name":"hotspot20"},{"name":"httpServers"},{"name":"identities"},{"name":"identityPsks"},{"name":"idps"},{"name":"imports"},{"name":"inboundCellularFirewallRules"},{"name":"inboundFirewallRules"},{"name":"interfaces"},{"name":"internetPolicies"},{"name":"intrusion"},{"name":"inventory"},{"name":"ipv6"},{"name":"l3FirewallRules"},{"name":"l7FirewallRules"},{"name":"lan"},{"name":"latencyHistory"},{"name":"latencyStats"},{"name":"latest"},{"name":"licenses"},{"name":"licensing"},{"name":"lines"},{"name":"linkAggregations"},{"name":"linkLayer"},{"name":"live"},{"name":"liveTools"},{"name":"lldpCdp"},{"name":"loginSecurity"},{"name":"logs"},{"name":"lossAndLatencyHistory"},{"name":"malware"},{"name":"managementInterface"},{"name":"manufacturers"},{"name":"me"},{"name":"merakiAuthUsers"},{"name":"meshStatuses"},{"name":"models"},{"name":"monitor"},{"name":"monitoredMediaServers"},{"name":"mqttBrokers"},{"name":"mtu"},{"name":"multicast"},{"name":"netflow"},{"name":"networkAdapters"},{"name":"networkHealth"},{"name":"objectDetectionModels"},{"name":"onboarding"},{"name":"oneToManyNatRules"},{"name":"oneToOneNatRules"},{"name":"openapiSpec"},{"name":"optIns"},{"name":"order"},{"name":"ospf"},{"name":"overview"},{"name":"packetLoss"},{"name":"packets"},{"name":"payloadTemplates"},{"name":"performance"},{"name":"performanceHistory"},{"name":"permissions"},{"name":"pii"},{"name":"piiKeys"},{"name":"ping"},{"name":"pingDevice"},{"name":"policies"},{"name":"policy"},{"name":"policyObjects"},{"name":"portForwardingRules"},{"name":"portSchedules"},{"name":"ports"},{"name":"power"},{"name":"powerModules"},{"name":"prefixes"},{"name":"prepare"},{"name":"priorities"},{"name":"profiles"},{"name":"provisioning"},{"name":"qosRules"},{"name":"qualityAndRetention"},{"name":"qualityRetentionProfiles"},{"name":"radio"},{"name":"readings"},{"name":"recent"},{"name":"relationships"},{"name":"rendezvousPoints"},{"name":"requests"},{"name":"responseCodes"},{"name":"restrictions"},{"name":"rfProfiles"},{"name":"roles"},{"name":"rollbacks"},{"name":"routing"},{"name":"rules"},{"name":"saml"},{"name":"samlRoles"},{"name":"schedules"},{"name":"sdwan"},{"name":"search"},{"name":"security"},{"name":"securityCenters"},{"name":"seen"},{"name":"sense"},{"name":"sentry"},{"name":"servers"},{"name":"settings"},{"name":"signalQualityHistory"},{"name":"sims"},{"name":"singleLan"},{"name":"siteToSiteVpn"},{"name":"smDevicesForKey"},{"name":"smOwnersForKey"},{"name":"snmp"},{"name":"softwares"},{"name":"splash"},{"name":"splashAuthorizationStatus"},{"name":"splashLoginAttempts"},{"name":"ssids"},{"name":"stacks"},{"name":"staged"},{"name":"stages"},{"name":"staticRoutes"},{"name":"statics"},{"name":"stats"},{"name":"status"},{"name":"statuses"},{"name":"stormControl"},{"name":"stp"},{"name":"subnetPool"},{"name":"subnets"},{"name":"subscription"},{"name":"subscriptions"},{"name":"summary"},{"name":"swaps"},{"name":"switches"},{"name":"syslogServers"},{"name":"targetGroups"},{"name":"themes"},{"name":"thirdPartyVPNPeers"},{"name":"throughputTest"},{"name":"top"},{"name":"topology"},{"name":"traffic"},{"name":"trafficAnalysis"},{"name":"trafficHistory"},{"name":"trafficShaping"},{"name":"trustedAccessConfigs"},{"name":"trustedServers"},{"name":"upgrades"},{"name":"uplink"},{"name":"uplinkBandwidth"},{"name":"uplinkSelection"},{"name":"uplinks"},{"name":"uplinksLossAndLatency"},{"name":"usage"},{"name":"usageHistories"},{"name":"usageHistory"},{"name":"userAccessDevices"},{"name":"users"},{"name":"v4"},{"name":"video"},{"name":"videoLink"},{"name":"vlanAssignments"},{"name":"vlanProfiles"},{"name":"vlans"},{"name":"vmx"},{"name":"vpn"},{"name":"vpnExclusions"},{"name":"vpnFirewallRules"},{"name":"vppAccounts"},{"name":"wakeOnLan"},{"name":"warmSpare"},{"name":"warnings"},{"name":"webhookTests"},{"name":"webhooks"},{"name":"wirelessProfiles"},{"name":"wlanLists"},{"name":"zones"}],"x-parser-conf":{"overview":{"markdownPath":"docs/overview.md"},"theme":"meraki","serverConfig":true,"meta":{"useProxy":true},"httpBearer":{"bearerToken":"75dd5334bef4d2bc96f26138c163c0a3fa0b5ca6"},"labelConfig":{"endpoint":{"field":"operationId","format":"startCase"}},"groupBy":{"$remoteModule":"config/group_platform.js"},"sortBy":{"$remoteModule":"config/sort_by.js"},"exampleAsDefault":true,"expand":3,"sampleCode":{"python":{"folder":"meraki/sdk/python","name":"Meraki Python Library","highlight":"python"}},"variables":{"organizationId":"1215707","networkId":"N_784752235069315754","serial":"QBSB-VQ3J-XZ54"}},"openapi":"3.0.1","servers":[{"url":"https://api.meraki.com/{basePath}","variables":{"basePath":{"default":"api/v1"}}}],"securitySchemes":{"meraki_api_key":{"type":"apiKey","name":"X-Cisco-Meraki-API-Key","in":"header"},"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}}},"spec":{"description":"List the security events for a client. Clients can be identified by a client key or either the MAC or IP depending on whether the network uses Track-by-IP.","operationId":"getNetworkApplianceClientSecurityEvents","parameters":[{"name":"networkId","in":"path","description":"Network ID","schema":{"type":"string"},"required":true},{"name":"clientId","in":"path","description":"Client ID","schema":{"type":"string"},"required":true},{"name":"t0","in":"query","description":"The beginning of the timespan for the data. Data is gathered after the specified t0 value. The maximum lookback period is 791 days from today.","schema":{"type":"string"}},{"name":"t1","in":"query","description":"The end of the timespan for the data. t1 can be a maximum of 791 days after t0.","schema":{"type":"string"}},{"name":"timespan","in":"query","description":"The timespan for which the information will be fetched. If specifying timespan, do not specify parameters t0 and t1. The value must be in seconds and be less than or equal to 791 days. The default is 31 days.","schema":{"type":"number","format":"float","maximum":68342400}},{"name":"perPage","in":"query","description":"The number of entries per page returned. Acceptable range is 3 - 1000. Default is 100.","schema":{"type":"integer"}},{"name":"startingAfter","in":"query","description":"A token used by the server to indicate the start of the page. Often this is a timestamp or an ID but it is not limited to those. This parameter should not be defined by client applications. The link for the first, last, prev, or next page in the HTTP Link header should define it.","schema":{"type":"string"}},{"name":"endingBefore","in":"query","description":"A token used by the server to indicate the end of the page. Often this is a timestamp or an ID but it is not limited to those. This parameter should not be defined by client applications. The link for the first, last, prev, or next page in the HTTP Link header should define it.","schema":{"type":"string"}},{"name":"sortOrder","in":"query","description":"Sorted order of security events based on event detection time. Order options are 'ascending' or 'descending'. Default is ascending order.","schema":{"type":"string","enum":["ascending","descending"]}}],"responses":{"200":{"description":"Successful operation","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","additionalProperties":true}},"example":[{"ts":"2018-02-11T00:00:00.090210Z","eventType":"File Scanned","clientName":"COMPUTER-M-V78J","clientMac":"10:dd:b1:eb:88:f8","clientIp":"192.168.128.2","srcIp":"192.168.128.2","destIp":"119.192.233.48","protocol":"http","uri":"http://www.favorite-icons.com/program/FavoriteIconsUninstall.exe","canonicalName":"PUA.Win.Dropper.Kraddare::1201","destinationPort":80,"fileHash":"3ec1b9a95fe62aa25fc959643a0f227b76d253094681934daaf628d3574b3463","fileType":"MS_EXE","fileSizeBytes":193688,"disposition":"Malicious","action":"Blocked"},{"ts":"2018-02-11T00:00:00.090210Z","eventType":"IDS Alert","deviceMac":"00:18:0a:01:02:03","clientMac":"A1:B2:C3:D4:E5:F6","srcIp":"1.2.3.4:34195","destIp":"10.20.30.40:80","protocol":"tcp/ip","priority":"2","classification":"4","blocked":true,"message":"SERVER-WEBAPP JBoss JMX console access attempt","signature":"1:21516:9","sigSource":"","ruleId":"meraki:intrusion/snort/GID/1/SID/26267"}]}},"headers":{"Link":{"schema":{"type":"string"},"description":"A comma-separated list of first, last, prev, and next relative links used for subsequent paginated requests."}}}},"summary":"List the security events for a client","tags":["appliance","monitor","clients","security","events"],"__originalOperationId":"getNetworkApplianceClientSecurityEvents","security":[{"meraki_api_key":[]},{"bearerAuth":[]}],"method":"get","path":"/networks/{networkId}/appliance/clients/{clientId}/security/events","sampleCode":{"Meraki Python Library":{"code":"import meraki\n\n# Defining your API key as a variable in source code is discouraged.\n# This API key is for a read-only docs-specific environment.\n# In your own code, use an environment variable as shown under the Usage section\n# @ https://github.com/meraki/dashboard-api-python/\n\nAPI_KEY = '75dd5334bef4d2bc96f26138c163c0a3fa0b5ca6'\n\ndashboard = meraki.DashboardAPI(API_KEY)\n\nnetwork_id = 'L_646829496481105433'\nclient_id = ''\n\nresponse = dashboard.appliance.getNetworkApplianceClientSecurityEvents(\n network_id, client_id, total_pages='all'\n)\n\nprint(response)","highlight":"python"}}}}