Meraki

Network context is what turns an unfamiliar source IP into a known site.

What Hal reads

Network topology, WAN IP addresses and site-to-site VPN peers.

What it enables

Recognizing a client’s own sites and tunnels, so an unfamiliar IP is only flagged when it genuinely is one.

How it connects

The API key of a Meraki identity you give the read-only Observer role. Hal never changes a network setting. Read-only by architecture →

Setup

Scopes, steps and troubleshooting: in the docs →

A chat exchange in the Hal portal: whether the address a sign-in came from is one of a client's own offices, answered against that client's Meraki sites and their static WAN addresses — **Is that address one of theirs?** Three sites, their static egress addresses, and the site-to-site peers, checked before the finding is written. It was not one of theirs.

A chat exchange in the Hal portal: asked whether he can see Meraki event logs, Hal lists the appliance event feed, the configuration change audit log and the IDS/IPS security events, with the lookback window for each — **And what he can read, asked directly.** Appliance events, the configuration change audit log with old and new values, and IDS/IPS detections, each with its own lookback.

See what Hal surfaces on your own clients.

No deck. Ask us anything first. When you want to see Hal on your own tenants, we sign a short evaluation agreement and stand up your instance; you connect one tenant, Hal watches it for 14 days, and we walk you through what he found.

Book a walkthrough Pricing

01You ask us your questions. No deck, no demo dataset.
02You sign a short evaluation agreement, and we stand up your own instance.
03You connect one tenant from your own admin console. Hal watches it for 14 days.
04We walk through what he found. Keep going month to month, or revoke the scopes yourself and stop.