Meraki App 1.6
It doesn't look like any of the current fields supplied nor returned have any "contains" values. In Phantom a contains value is used to "chain" actions together. A very common example is an ip address. If one App has a field that contains an ip address, all the other Apps and Actions that also contains an ip address can take that as input.
In the case of this App, an obvious candidate is any mac addresses returned. You do this by adding a line in the JSON like this:
"contains": ["mac address"]
So this:
"output": [
{
"data_path": "action_result.data.*.client.mac",
"data_type": "string",
"column_name": "Client MAC",
"column_order": 0
},
would become:
"output": [
{
"data_path": "action_result.data.*.client.mac",
"contains": ["mac address"],
"data_type": "string",
"column_name": "Client MAC",
"column_order": 0
},
Similarly, the Action parameters should have a "primary" designation for the primary field. In your case, that's this:
"search_string": {
"description": "Characters to match in the client MAC address or description. Use asterisk * to return all clients.",
"data_type": "string",
"required": true
}
It should probably be:
"search_string": {
"description": "Characters to match in the client MAC address or description. Use asterisk * to return all clients.",
"primary": true,
"data_type": "string",
"required": true
}
That tells Phantom that this is the main field that this action needs. So other results will have a contextual action on their mac address output (if they have "contains" on them), and then your located device Action will show up on the context menu, and take those MACs as input.