Logsign SIEM API Documentation

1. Test API

Tests the API connection and validates the API key.

Parameters

Example Request

GET /test_api?api_key=YOUR_API_KEY

Example Response

{
  "success": true
}

2. Get Version

Returns the current Logsign SIEM version.

Parameters

Example Request

GET /get_version?api_key=YOUR_API_KEY

Example Response

{
  "success": true,
  "version": "6.4.1"
}

3. Feed List (GET)

Returns all entries from the specified feed list.

Parameters

Example Request

GET /feed_list?api_key=YOUR_API_KEY&list_name=blocked_ips

4. Feed List (POST)

Adds a new entry to the specified feed list.

Query Parameters

Body Parameters

Example Request

POST /feed_list?api_key=YOUR_API_KEY&list_name=blocked_ips
Content-Type: application/json

{
  "value": "192.168.1.100",
  "expire_time": 3600
}

5. Get Count

Returns the event count for a given query, grouped by a specified column.

Parameters

Example Request

GET /get_count?api_key=YOUR_API_KEY&query=*&grouped_column=SourceIP&criteria=count&time_frame=last_1_hour

6. Get Events

Returns events matching the given query with pagination support.

Parameters

Example Request

GET /get_events?api_key=YOUR_API_KEY&query=SourceIP:10.0.0.1&time_frame=last_1_hour&page=1&size=50

7. Get Columns

Returns grouped column values for a given query.

Parameters

Example Request

GET /get_columns?api_key=YOUR_API_KEY&query=*&grouped_column=SourceIP&time_frame=last_24_hours

8. Get Incidents

Returns incidents created after the specified timestamp.

Parameters

Example Request

GET /get_incidents?api_key=YOUR_API_KEY&last_run=2026-04-17T00:00:00&query=severity:high

9. Set Incident Status

Updates the status of an incident.

Query Parameters

Body

JSON object containing the status update data.

Example Request

POST /set_incident_status?api_key=YOUR_API_KEY&incident_id=INC-001
Content-Type: application/json

{
  "status": "closed"
}

10. Incident Comment

Adds a comment to an incident.

Query Parameters

Body Parameters

Example Request

POST /incident_comment?api_key=YOUR_API_KEY
Content-Type: application/json

{
  "incident_id": "INC-001",
  "message": "Incident reviewed and closed as false positive."
}

11. Get Alert Configs

Returns all alert configurations grouped by alert blocks.

Parameters

Example Request

GET /get_alert_configs?api_key=YOUR_API_KEY

Example Response

[
  {
    "uid": "block-001",
    "name": "Network Alerts",
    "alerts": [
      {
        "uid": "alert-001",
        "name": "High Traffic Alert",
        "disabled": false,
        "block_uid": "block-001"
      }
    ]
  }
]