{"type":"api","title":"Get Organization Appliance Security Events","meta":{"id":"/apps/pubhub/media/Meraki-Dashboard-API-v1-Documentation/4a73587b50c21afbda73cffb32f23c0279bf8383/5c63a5d4-9452-397a-85eb-8b6fec45147e","info":{"title":"Meraki Dashboard API","description":"A RESTful API to programmatically manage and monitor Cisco Meraki networks at scale.\n\n\u003e Date: 04 December, 2024\n\u003e\n\u003e [Recent Updates](https://meraki.io/whats-new/)\n\n---\n\n[API Documentation](https://meraki.io/api)\n\n[Community Support](https://meraki.io/community)\n\n[Meraki Homepage](https://www.meraki.com)\n","contact":{"name":"Meraki Developer Community","url":"https://meraki.io/community"},"version":"1.53.0"},"security":[{"meraki_api_key":[]},{"bearerAuth":[]}],"tags":[{"name":"organizations"},{"name":"networks"},{"name":"devices"},{"name":"insight"},{"name":"wireless"},{"name":"camera"},{"name":"appliance"},{"name":"switch"},{"name":"cellularGateway"},{"name":"sm"},{"name":"sensor"},{"name":"administered"},{"name":"wirelessController"},{"name":"accessControlLists"},{"name":"accessPolicies"},{"name":"accounts"},{"name":"acls"},{"name":"actionBatches"},{"name":"adaptivePolicy"},{"name":"addresses"},{"name":"admins"},{"name":"airMarshal"},{"name":"alertTypes"},{"name":"alerts"},{"name":"alternateManagementInterface"},{"name":"analytics"},{"name":"api"},{"name":"apiRequests"},{"name":"apnsCert"},{"name":"appliances"},{"name":"applicationCategories"},{"name":"applicationUsage"},{"name":"applications"},{"name":"areas"},{"name":"arpInspection"},{"name":"arpTable"},{"name":"artifacts"},{"name":"assets"},{"name":"assignments"},{"name":"authenticationToken"},{"name":"autoLocate"},{"name":"autoRf"},{"name":"availabilities"},{"name":"bandwidthUsageHistory"},{"name":"bgp"},{"name":"billing"},{"name":"blink"},{"name":"bluetooth"},{"name":"bluetoothClients"},{"name":"bonjourForwarding"},{"name":"boundaries"},{"name":"brandingPolicies"},{"name":"bulk"},{"name":"bulkUpdate"},{"name":"byBoundary"},{"name":"byClient"},{"name":"byDevice"},{"name":"byEnergyUsage"},{"name":"byInterval"},{"name":"byMetric"},{"name":"byModel"},{"name":"byNetwork"},{"name":"byStatus"},{"name":"bySwitch"},{"name":"byType"},{"name":"byUsage"},{"name":"byUtilization"},{"name":"bypassActivationLockAttempts"},{"name":"cableTest"},{"name":"callbacks"},{"name":"categories"},{"name":"cellular"},{"name":"cellularFirewallRules"},{"name":"cellularUsageHistory"},{"name":"certs"},{"name":"changeHistory"},{"name":"channelUtilization"},{"name":"channelUtilizationHistory"},{"name":"channels"},{"name":"claim"},{"name":"claimKey"},{"name":"clientCountHistory"},{"name":"clients"},{"name":"cloudMonitoring"},{"name":"commands"},{"name":"communicationPlans"},{"name":"compliance"},{"name":"configTemplates"},{"name":"configurationChanges"},{"name":"configure"},{"name":"configuredDevices"},{"name":"connectionStats"},{"name":"connections"},{"name":"connectivity"},{"name":"connectivityEvents"},{"name":"connectivityMonitoringDestinations"},{"name":"contentFiltering"},{"name":"coterm"},{"name":"current"},{"name":"customAnalytics"},{"name":"customPerformanceClasses"},{"name":"dataRateHistory"},{"name":"delegated"},{"name":"desktopLogs"},{"name":"details"},{"name":"detections"},{"name":"deviceCommandLogs"},{"name":"deviceProfiles"},{"name":"deviceTypeGroupPolicies"},{"name":"dhcp"},{"name":"dhcpServerPolicy"},{"name":"discovery"},{"name":"dscpTaggingOptions"},{"name":"dscpToCosMappings"},{"name":"eapOverride"},{"name":"earlyAccess"},{"name":"electronicShelfLabel"},{"name":"entitlements"},{"name":"esims"},{"name":"ethernet"},{"name":"eventTypes"},{"name":"events"},{"name":"exportEvents"},{"name":"failedConnections"},{"name":"failover"},{"name":"features"},{"name":"fields"},{"name":"firewall"},{"name":"firewalledServices"},{"name":"firmware"},{"name":"firmwareUpgrades"},{"name":"floorPlans"},{"name":"groupPolicies"},{"name":"groups"},{"name":"health"},{"name":"healthByTime"},{"name":"historical"},{"name":"history"},{"name":"hotspot20"},{"name":"httpServers"},{"name":"identities"},{"name":"identityPsks"},{"name":"idps"},{"name":"imports"},{"name":"inboundCellularFirewallRules"},{"name":"inboundFirewallRules"},{"name":"interfaces"},{"name":"internetPolicies"},{"name":"intrusion"},{"name":"inventory"},{"name":"ipv6"},{"name":"jobs"},{"name":"keys"},{"name":"l2"},{"name":"l3"},{"name":"l3FirewallRules"},{"name":"l7FirewallRules"},{"name":"lan"},{"name":"latencyHistory"},{"name":"latencyStats"},{"name":"latest"},{"name":"leds"},{"name":"licenses"},{"name":"licensing"},{"name":"lines"},{"name":"linkAggregations"},{"name":"linkLayer"},{"name":"live"},{"name":"liveTools"},{"name":"lldpCdp"},{"name":"loginSecurity"},{"name":"logs"},{"name":"lossAndLatencyHistory"},{"name":"malware"},{"name":"managementInterface"},{"name":"manufacturers"},{"name":"me"},{"name":"merakiAuthUsers"},{"name":"meshStatuses"},{"name":"models"},{"name":"monitor"},{"name":"monitoredMediaServers"},{"name":"mqttBrokers"},{"name":"mtu"},{"name":"multicast"},{"name":"netflow"},{"name":"networkAdapters"},{"name":"networkHealth"},{"name":"objectDetectionModels"},{"name":"onboarding"},{"name":"oneToManyNatRules"},{"name":"oneToOneNatRules"},{"name":"openapiSpec"},{"name":"optIns"},{"name":"order"},{"name":"ospf"},{"name":"overview"},{"name":"packetLoss"},{"name":"packets"},{"name":"payloadTemplates"},{"name":"performance"},{"name":"performanceHistory"},{"name":"permissions"},{"name":"pii"},{"name":"piiKeys"},{"name":"ping"},{"name":"pingDevice"},{"name":"policies"},{"name":"policy"},{"name":"policyObjects"},{"name":"portForwardingRules"},{"name":"portSchedules"},{"name":"ports"},{"name":"power"},{"name":"powerModules"},{"name":"prefixes"},{"name":"prepare"},{"name":"priorities"},{"name":"profiles"},{"name":"provisioning"},{"name":"qosRules"},{"name":"qualityAndRetention"},{"name":"qualityRetentionProfiles"},{"name":"radio"},{"name":"ratePlans"},{"name":"readings"},{"name":"recent"},{"name":"redundancy"},{"name":"relationships"},{"name":"rendezvousPoints"},{"name":"requests"},{"name":"responseCodes"},{"name":"restrictions"},{"name":"rfProfiles"},{"name":"roles"},{"name":"rollbacks"},{"name":"routing"},{"name":"rules"},{"name":"saml"},{"name":"samlRoles"},{"name":"schedules"},{"name":"sdwan"},{"name":"search"},{"name":"security"},{"name":"securityCenters"},{"name":"seen"},{"name":"sense"},{"name":"sentry"},{"name":"servers"},{"name":"serviceProviders"},{"name":"settings"},{"name":"signalQualityHistory"},{"name":"sims"},{"name":"singleLan"},{"name":"siteToSiteVpn"},{"name":"smDevicesForKey"},{"name":"smOwnersForKey"},{"name":"snmp"},{"name":"softwares"},{"name":"splash"},{"name":"splashAuthorizationStatus"},{"name":"splashLoginAttempts"},{"name":"ssids"},{"name":"stacks"},{"name":"staged"},{"name":"stages"},{"name":"staticRoutes"},{"name":"statics"},{"name":"stats"},{"name":"status"},{"name":"statuses"},{"name":"stormControl"},{"name":"stp"},{"name":"subnetPool"},{"name":"subnets"},{"name":"subscription"},{"name":"subscriptions"},{"name":"summary"},{"name":"swap"},{"name":"swaps"},{"name":"switches"},{"name":"syslogServers"},{"name":"system"},{"name":"targetGroups"},{"name":"themes"},{"name":"thirdPartyVPNPeers"},{"name":"throughputTest"},{"name":"top"},{"name":"topology"},{"name":"traffic"},{"name":"trafficAnalysis"},{"name":"trafficHistory"},{"name":"trafficShaping"},{"name":"trustedAccessConfigs"},{"name":"trustedServers"},{"name":"upgrades"},{"name":"uplink"},{"name":"uplinkBandwidth"},{"name":"uplinkSelection"},{"name":"uplinks"},{"name":"uplinksLossAndLatency"},{"name":"usage"},{"name":"usageHistories"},{"name":"usageHistory"},{"name":"userAccessDevices"},{"name":"utilization"},{"name":"v4"},{"name":"video"},{"name":"videoLink"},{"name":"vlanAssignments"},{"name":"vlanProfiles"},{"name":"vlans"},{"name":"vmx"},{"name":"vpn"},{"name":"vpnExclusions"},{"name":"vpnFirewallRules"},{"name":"vppAccounts"},{"name":"wakeOnLan"},{"name":"warmSpare"},{"name":"warnings"},{"name":"webhookTests"},{"name":"webhooks"},{"name":"wirelessControllers"},{"name":"wirelessProfiles"},{"name":"wlanLists"},{"name":"zones"}],"x-parser-conf":{"overview":{"markdownPath":"docs/overview.md"},"theme":"meraki","serverConfig":true,"meta":{"useProxy":true},"httpBearer":{"bearerToken":"75dd5334bef4d2bc96f26138c163c0a3fa0b5ca6"},"labelConfig":{"endpoint":{"field":"operationId","format":"startCase"}},"groupBy":{"$remoteModule":"config/group_platform.js"},"sortBy":{"$remoteModule":"config/sort_by.js"},"exampleAsDefault":true,"expand":3,"sampleCode":{"python":{"folder":"meraki/sdk/python","name":"Meraki Python Library","highlight":"python"}},"variables":{"organizationId":"1215707","networkId":"N_784752235069315754","serial":"QBSB-VQ3J-XZ54"}},"openapi":"3.0.1","servers":[{"url":"https://api.meraki.com/{basePath}","variables":{"basePath":{"default":"api/v1"}}}],"securitySchemes":{"meraki_api_key":{"type":"apiKey","name":"X-Cisco-Meraki-API-Key","in":"header"},"bearerAuth":{"type":"http","scheme":"bearer","bearerFormat":"API Key"}}},"spec":{"description":"List the security events for an organization","operationId":"getOrganizationApplianceSecurityEvents","parameters":[{"name":"organizationId","in":"path","description":"Organization ID","schema":{"type":"string"},"required":true},{"name":"t0","in":"query","description":"The beginning of the timespan for the data. Data is gathered after the specified t0 value. The maximum lookback period is 365 days from today.","schema":{"type":"string"}},{"name":"t1","in":"query","description":"The end of the timespan for the data. t1 can be a maximum of 365 days after t0.","schema":{"type":"string"}},{"name":"timespan","in":"query","description":"The timespan for which the information will be fetched. If specifying timespan, do not specify parameters t0 and t1. The value must be in seconds and be less than or equal to 365 days. The default is 31 days.","schema":{"type":"number","format":"float","maximum":31536000}},{"name":"perPage","in":"query","description":"The number of entries per page returned. Acceptable range is 3 - 1000. Default is 100.","schema":{"type":"integer"}},{"name":"startingAfter","in":"query","description":"A token used by the server to indicate the start of the page. Often this is a timestamp or an ID but it is not limited to those. This parameter should not be defined by client applications. The link for the first, last, prev, or next page in the HTTP Link header should define it.","schema":{"type":"string"}},{"name":"endingBefore","in":"query","description":"A token used by the server to indicate the end of the page. Often this is a timestamp or an ID but it is not limited to those. This parameter should not be defined by client applications. The link for the first, last, prev, or next page in the HTTP Link header should define it.","schema":{"type":"string"}},{"name":"sortOrder","in":"query","description":"Sorted order of security events based on event detection time. Order options are 'ascending' or 'descending'. Default is ascending order.","schema":{"type":"string","enum":["ascending","descending"]}}],"responses":{"200":{"description":"Successful operation","content":{"application/json":{"schema":{"type":"array","items":{"type":"object","additionalProperties":true}},"example":[{"ts":"2018-02-11T00:00:00.090210Z","eventType":"File Scanned","clientName":"COMPUTER-M-V78J","clientMac":"10:dd:b1:eb:88:f8","clientIp":"192.168.128.2","srcIp":"192.168.128.2","destIp":"119.192.233.48","protocol":"http","uri":"http://www.favorite-icons.com/program/FavoriteIconsUninstall.exe","canonicalName":"PUA.Win.Dropper.Kraddare::1201","destinationPort":80,"fileHash":"3ec1b9a95fe62aa25fc959643a0f227b76d253094681934daaf628d3574b3463","fileType":"MS_EXE","fileSizeBytes":193688,"disposition":"Malicious","action":"Blocked"},{"ts":"2018-02-11T00:00:00.090210Z","eventType":"IDS Alert","deviceMac":"00:18:0a:01:02:03","clientMac":"A1:B2:C3:D4:E5:F6","srcIp":"1.2.3.4:34195","destIp":"10.20.30.40:80","protocol":"tcp/ip","priority":"2","classification":"4","blocked":true,"message":"SERVER-WEBAPP JBoss JMX console access attempt","signature":"1:21516:9","sigSource":"","ruleId":"meraki:intrusion/snort/GID/1/SID/26267"}]}},"headers":{"Link":{"schema":{"type":"string"},"description":"A comma-separated list of first, last, prev, and next relative links used for subsequent paginated requests."}}}},"summary":"List the security events for an organization","tags":["appliance","monitor","security","events"],"__originalOperationId":"getOrganizationApplianceSecurityEvents","security":[{"meraki_api_key":[]},{"bearerAuth":[]}],"method":"get","path":"/organizations/{organizationId}/appliance/security/events","sampleCode":{"Meraki Python Library":{"code":"import meraki\n\n# Defining your API key as a variable in source code is discouraged.\n# This API key is for a read-only docs-specific environment.\n# In your own code, use an environment variable as shown under the Usage section\n# @ https://github.com/meraki/dashboard-api-python/\n\nAPI_KEY = '75dd5334bef4d2bc96f26138c163c0a3fa0b5ca6'\n\ndashboard = meraki.DashboardAPI(API_KEY)\n\norganization_id = '549236'\n\nresponse = dashboard.appliance.getOrganizationApplianceSecurityEvents(\n organization_id, total_pages='all'\n)\n\nprint(response)","highlight":"python"}}}}