Logsign SIEM API Documentation

1. Test API

Tests the API connection and validates the API key.

Parameters

Example Request

GET /test_api?api_key=YOUR_API_KEY

Example Response

{
  "success": true
}

2. Get Version

Returns the current Logsign SIEM version.

Parameters

Example Request

GET /get_version?api_key=YOUR_API_KEY

Example Response

{
  "success": true,
  "version": "6.4.1"
}

3. Feed List (GET)

Returns all entries from the specified feed list.

Parameters

Example Request

GET /feed_list?api_key=YOUR_API_KEY&list_name=blocked_ips

4. Feed List (POST)

Adds a new entry to the specified feed list.

Query Parameters

Body Parameters

Example Request

POST /feed_list?api_key=YOUR_API_KEY&list_name=blocked_ips
Content-Type: application/json

{
  "value": "192.168.1.100",
  "expire_time": 3600
}

5. Get Count

Returns a single number calculated on the grouped_column field of the events that match the query in the given time frame. The criteria parameter selects how that number is calculated.

Parameters

time_frame format

A number and a unit separated by a space, for example 10 min, 24 hour or 7 day. Encode the space as %20 in the URL. Values such as last_1_hour are not accepted. Since version 6.4.115 an invalid time_frame is rejected with HTTP 403 and an explanatory message; older versions return HTTP 500. The same format applies to Get Events and Get Columns.

The maximum window is 7 days. A larger value is not rejected; it is reduced to the upper bound of its unit (for example 30 day is treated as 7 day).

Example Request

GET /get_count?api_key=YOUR_API_KEY&query=*&grouped_column=Source.IP&criteria=unique&time_frame=1%20hour

Example Response

{
  "success": true,
  "count": 42
}

success is false when the calculated number is 0.

6. Get Events

Returns events matching the given query with pagination support. Results are sorted by Time.Generated, newest first.

Parameters

Example Request

GET /get_events?api_key=YOUR_API_KEY&query=Source.IP:10.0.0.1&time_frame=1%20hour&page=1&size=50

Example Response

{
  "success": true,
  "events": [
    {
      "Time": { "Generated": "..." },
      "Source": { "IP": "10.0.0.1" },
      "...": "..."
    }
  ],
  "total_count": 1342,
  "size": 50
}

Use total_count to calculate the number of pages: ceil(total_count / size).

7. Get Columns

Returns the distinct values of grouped_column across the events that match the query in the given time frame. Up to 1000 values are returned.

Parameters

Example Request

GET /get_columns?api_key=YOUR_API_KEY&query=*&grouped_column=Source.IP&time_frame=24%20hour

Example Response

{
  "success": true,
  "columns": ["10.0.0.1", "10.0.0.2"]
}

8. Get Incidents

Returns incidents created after the specified timestamp.

Parameters

Example Request

GET /get_incidents?api_key=YOUR_API_KEY&last_run=2026-04-17T00:00:00&query=severity:high

9. Set Incident Status

Updates the status of an incident.

Query Parameters

Body

JSON object containing the status update data.

Example Request

POST /set_incident_status?api_key=YOUR_API_KEY&incident_id=INC-001
Content-Type: application/json

{
  "status": "closed"
}

10. Incident Comment

Adds a comment to an incident.

Query Parameters

Body Parameters

Example Request

POST /incident_comment?api_key=YOUR_API_KEY
Content-Type: application/json

{
  "incident_id": "INC-001",
  "message": "Incident reviewed and closed as false positive."
}

11. Get Alert Configs

Returns all alert configurations grouped by alert blocks.

Parameters

Example Request

GET /get_alert_configs?api_key=YOUR_API_KEY

Example Response

[
  {
    "uid": "block-001",
    "name": "Network Alerts",
    "alerts": [
      {
        "uid": "alert-001",
        "name": "High Traffic Alert",
        "disabled": false,
        "block_uid": "block-001"
      }
    ]
  }
]