Logsign USO Threat Intelligence Guide

Purpose and Overview

The Logsign Threat Intelligence area collects Indicators of Compromise (IOCs) (IP, domain, URL, hash) from internal and external sources and makes them usable within Logsign.

To open this screen, go to Settings › Enrichment › Threat Intelligence. The menu item is visible only when the Threat Intelligence module is included in your license and your role has access to it.

From this screen, you can:

• Enable/disable TI globally,
• Add, edit, and remove TI sources,
• Change priority order (processing order),
• Enable/disable sources individually or in bulk.

What Changed Compared to the Old Approach?

Before: Users clicked a single button and Logsign used predefined TI lists.

Now: Users can add and manage their own IOC sources, enabling full control over which feeds are used (via TAXII/STIX or API). The predefined Logsign TI lists (Threat Intelligence IPs, Threat Intelligence Hashes, Threat Intelligence Domains) still appear in the list as system sources with the Source Type Logsign TI. System sources can be enabled, disabled, and reordered, but they cannot be edited or deleted.

Top Bar Controls

The top area includes:

• Enable/Disable Threat Intelligence: Turns the TI feature on/off globally. While it is off, the page shows the Reputation Service is Disabled warning and TI sources are not used for log enrichment.
• Search: Searches by source name or source ID.
• Add Source: Adds a new TI source.
• Check All: Selects all sources currently shown in the list.
• Enable / Disable: Enables/disables selected sources in bulk.
• Filter by Status: Filters sources by state (All, Enabled, Disabled).

Source List (Table) and Key Logic

Each row represents a TI source. Key columns include:

• Priority: Processing / lookup order.
• Name: Source name.
• Source Type: Source method (TAXII/STIX, API, or Logsign TI).
• Indicator Type: IOC type (ip, domain, url, hash, or Mixed (All Types)).
• Count: Number of ingested IOCs. The info icon next to the column title shows the per-source hard limit.
• URL: Source endpoint.
• Last Update: Date and time of the last successful refresh of the source.
• Status: Enabled/disabled state.
• Actions: Show List, Edit, Delete. Edit and Delete are disabled for system (Logsign TI) sources.

Priority Order Behavior

• You can change priority order.
• The system starts checking/processing from the top of the list.
• Priority can be adjusted via drag-and-drop (using the handle on the left).

Record Limit per Source

• Each added source can contain up to 300,000 (300k) IOC records. The Count value turns orange at 90% of the limit and red when the limit is reached. The limit does not apply to system (Logsign TI) sources.
• For larger feeds, it is recommended to filter or split them at the source side.

Whitelist Takes Precedence (Conflict Rule)

The White List (Settings › Alerts & Incidents › White List) is evaluated when alerts are generated, not during TI enrichment. If an IOC exists in a TI source and is also whitelisted:

• The log can still be enriched with the matching Intelligence.* fields,
• Alert rules that use the White List do not raise an alert for the whitelisted value.

Enable / Disable Sources

• You can enable/disable each source using its Status toggle.
• You can also use Check All + Enable/Disable to manage multiple sources at once.

Supported Source Types

When adding sources, Logsign supports two ingestion methods. The Source Type cannot be changed after the source is saved.

A) TAXII/STIX Source

Used for consuming standard threat intelligence services via TAXII/STIX. Logsign refreshes TAXII/STIX sources every hour.

Typical fields (Edit Source):

• Name
• Source Type: TAXII/STIX
• Indicator Type: Fixed to Mixed (All Types) for TAXII/STIX sources and cannot be changed
• Feed URL: TAXII collection URL
• TAXII Version: 2.0 or 2.1 (default: 2.1)
• Use Authentication (optional):
  • Username
  • Password (when editing, leave blank to keep the current password)
• Test Connection: Validates connectivity and credentials
• Description

Recommended flow:

1. Fill URL and credentials (if required)
2. Click Test Connection
3. Click Save

B) API Source

Used to ingest IOCs from HTTP endpoints returning text or JSON. Logsign refreshes API sources every 300 seconds.

Typical fields (Edit Source):

• Name
• Source Type: API
• Indicator Type:
  • Mixed (All Types) (if multiple IOC types are included, default)
  • or a specific type (IP/Hash/Domain/URL) if the feed is single-type
• Method: GET or POST (default: GET). When POST is selected, a Body field appears for the request body.
• Content Type: application/json or text/plain (default: application/json)
• API URL
• Headers: Use Add Header to add a Header Key and Header Value if needed (API key, auth headers, etc.). When editing, leave a value blank to keep the stored value.
• Response Format: JSON or Text (default: JSON)
• JSON Response Key: Shown when Response Format is JSON. The path to the indicator list in the response (e.g., data.indicators). Required.
• Text Delimiter: Shown when Response Format is Text, e.g., \n (for line-by-line IOC lists)
• Enable Pagination (optional): Collects multi-page responses. When selected, set the Pagination Style (Page-based (page + size), Page only (single param), Offset-based (offset + limit), Range (from + to)), First Param Name, Second Param Name, Start Value, Page Size (1 to 10,000, default 100), Max Pages (1 to 100,000, default 1,000), and Delay Between Pages (ms) (0 to 60,000, default 0).
• Test Connection: Validates the API request with the values entered in the form
• Description

Note about Mixed sources:

If Mixed is selected, the system determines the IOC type from the content/format rules, and entries may appear as Type: mixed in the list view.

Viewing Ingested IOCs (Source Details)

Using the Show List action on a source row, you can display the ingested IOC entries. The list can be searched and paged.

The detail window shows:

• Indicator (IOC value: IP, domain, etc.)
• Type (mixed/ip/domain/url/hash)
• For system (Logsign TI) sources, also List ID, Category, and Info

How TI Enrichment Works

When a log event is processed and a match is found in an active TI source, Logsign automatically enriches the log with threat intelligence data. This section explains which fields are used for matching, which fields are populated, and how multiple matches are handled.

Matched and Enriched Fields

The enrichment fields are set by Logsign for each source type and cannot be changed from the Threat Intelligence screen. The following fields can be populated on a match:

The following table shows which log column is used for matching per source, and which fields are populated upon a successful match:

External.IP is derived from Source.IP or Destination.IP, depending on which one is identified as the external address.

Handling Multiple Simultaneous Matches

TI sources are evaluated in priority order. Once a source enriches the log, all lower-priority TI sources are skipped for that log, even if they would match a different field.

A single TAXII/STIX or API source checks all of its lookup columns (External.IP, URL.Domain, URL.URI, Object.Hash). If the log matches that source on more than one column, for example on both IP and domain, all matching Intelligence.* fields are populated by that source.

Note: Priority order (set in the Source List) determines which TI source enriches the log when more than one source matches. See the Priority Order Behavior section above.

Supported Indicator Types and Custom Values

TI sources match the four standard IOC types. Supported values vary by source type: