Realm.Security Documentation

Appearance

Cisco Meraki Webhook ​

Realm Security integrates with Cisco Meraki to collect Dashboard alerts (device status changes, security events, and other network alerts) via Meraki's webhook feature. The Meraki Dashboard posts each alert directly to Realm Cloud over HTTPS — no Realm Collector is required.

Data Flow:

text
Meraki Dashboard > Webhook (HTTPS POST) > Realm Cloud

Note: This page covers Meraki's webhook-delivered Dashboard alerts. To forward MX/MR/MS device logs (event log, flow, URL, firewall, IDS) over syslog instead, see Cisco Meraki Syslog.

Prerequisites ​

  • Organization or network admin access to the Meraki Dashboard, with permission to edit Network-wide > Configure > Alerts.
  • No Realm Collector is required — Meraki posts directly to a Realm Cloud endpoint.

Setup Cisco Meraki Webhook Source in Realm ​

  1. Login to Realm console.
  2. Go to Sources > Add and add a new Source.

    Name: Cisco Meraki Webhook
    Description: Cisco Meraki webhook alerts
    Format: Cisco Meraki Webhook

  3. From the source page, click Add Input Feed.
  4. Select Cloud HTTP and give it a name. Leave the shared secret field empty to have Realm generate one for you, or enter your own value.
  5. Click Save.
  6. Click ... > Edit on the newly created input feed.
  7. Click the eye icon in the shared secret field to reveal its value.
  8. Copy the Webhook URL and the shared secret — you will need both when configuring Meraki below.

Note: By default the webhook endpoint uses a public CA. You can switch to a Realm private CA from the input feed form if required.

Configure Meraki Webhook Alerts ​

For full background, see Meraki's Webhooks overview documentation.

Add an HTTP Server ​

  1. In the Meraki Dashboard, go to Network-wide > Alerts.
  2. Find the webhooks / HTTP servers section and add a new HTTP server.
  3. Configure the server:

    Name: e.g. Realm Security
    URL: the Webhook URL copied above (must be a public HTTPS endpoint with a valid certificate)
    Shared secret: the value you copied from Realm in step 7 above
    Payload template: leave as the default Meraki template

  4. Save the server.

Select Alerts to Send ​

Adding an HTTP server does not, by itself, send anything — you also need to select it as a recipient for the alerts you want forwarded.

  1. On the same Network-wide > Alerts page, go to each alert type you want to monitor (for example, device-down alerts, security alerts, or configuration changes).
  2. Under that alert's notification settings, select the HTTP server you just created as a recipient.
  3. Repeat for each alert type you want forwarded, and for each network — webhook recipients are configured per network, not per organization.

Note: Meraki can send the webhook's shared secret as plaintext in the request body only; there is no signature-based alternative for this delivery path. Treat the Webhook URL as sensitive, since anyone who has it (and the shared secret) can submit events to this source.

Verifying Delivery ​

  1. In the Realm console, go to Sources, select your Cisco Meraki Webhook source, and check the input feed for incoming events.
  2. Trigger a test alert from Meraki — many HTTP server configurations include a test-webhook option — and confirm it arrives in Realm.

Support ​

For additional details, refer to Meraki's Webhooks overview and Webhook Sample Alerts documentation.

If you encounter any issues or require assistance, contact Realm Security support.