You can follow the steps below to make Rest API integration.
First of all, we log in to Logsign USO and click Responses under Settings.
When we type Rest in the search field, Rest API will appear. Then we do configure > add device and come to the screen below.
The URL for API requests should be written by adding http or https.
If there is any header in the API where the request will be made, it should be written as json at the bottom.
Example is below;
{
"Key": "4a494a75862c2c34905a4*********11c8b9c98528946d7bbd4e53",
"Accept": "application/json"
}
Then we can click the magic button from the incident, select the rest api and apply the method we want.
The request you make here is directly proportional to your api capabilities. If the method you send requires a header, you need to write it as json.
Apart from that, the field you need to write is the payload json field. You can enter the equivalent of the action you want to take in the Payload JSON field.
You can think of the payload part as the body field.
In the expressions you start with $ in the header or payload section, the fields in Logsign come automatically. By completing this section, you can directly pull the data written in the incident and use it with the method you specify.
When you select the field you want, it will automatically bring its own continuation.
After doing these operations, you can send the request.
Do not forget to select the Content Type* value according to your API structure.
If it does not start as TriggeredAlert when you try to pull a field with $, the version of Logsign USO you are using may be outdated, you will need to discuss this issue with technical support.
The Destination.Port in incident has been added to the ports in the list.
This is also how you can see that the request was successful.