Logsign SIEM API Documentation

Authentication

We recommend the X-API-KEY header. The header name is not case sensitive. A key in the URL is written in clear text to web server access logs and proxy logs, and a key in a header is not.

curl --location 'https://YOUR_HOST/test_api' --header 'X-API-KEY: YOUR_API_KEY'

The api_key query parameter still works, so existing integrations do not need any change. The examples in this article use the query parameter. You can move the key from any of them into the X-API-KEY header.

When a request contains the header, Logsign uses only the header. If the header value is wrong or empty, the request is refused with HTTP 403, even if the query parameter holds a valid key.

Header authentication is available only in Logsign versions that include this change. Older versions accept only the api_key query parameter and return HTTP 403 for a key sent in a header.

If your Logsign instance collects its own nginx logs, the nginx parser masks the key as api_key=*** in the URL.Path field of newly parsed events. Events stored before the update and the raw message (when raw message storage is enabled for the source) still contain the key. If a key appeared in your logs, rotate it.

Table of Contents

• 1. Test API
• 2. Get Version
• 3. Feed List (GET)
• 4. Feed List (POST)
• 5. Get Count
• 6. Get Events
• 7. Get Columns
• 8. Get Incidents
• 9. Set Incident Status
• 10. Incident Comment
• 11. Get Alert Configs
• 12. Get System Events
• 13. Data Collection List

1. Test API

Tests the API connection and validates the API key.

Parameters

Example Request

GET /test_api?api_key=YOUR_API_KEY

Example Response

{
  "success": true
}

2. Get Version

Returns the current Logsign SIEM version.

Parameters

Example Request

GET /get_version?api_key=YOUR_API_KEY

Example Response

{
  "success": true,
  "version": "6.4.1"
}

3. Feed List (GET)

Returns all entries from the specified feed list.

Parameters

Example Request

GET /feed_list?api_key=YOUR_API_KEY&list_name=blocked_ips

4. Feed List (POST)

Adds a new entry to the specified feed list.

Query Parameters

Body Parameters

Example Request

POST /feed_list?api_key=YOUR_API_KEY&list_name=blocked_ips
Content-Type: application/json

{
  "value": "192.168.1.100",
  "expire_time": 3600
}

5. Get Count

Returns a single number calculated on the grouped_column field of the events that match the query in the given time frame. The criteria parameter selects how that number is calculated.

Parameters

time_frame format: a number and a unit separated by a space. The unit is min, hour or day (for example 10 min, 24 hour, 7 day), and the window is capped at 1440 min, 168 hour or 7 day. Encode the space as %20 in the URL. Values such as last_1_hour are not accepted. Since version 6.4.115 an invalid time_frame is rejected with HTTP 403 and an explanatory message; older versions return HTTP 500. The same format applies to Get Events, Get Columns, Get Incidents and Get System Events.

Example Request

GET /get_count?api_key=YOUR_API_KEY&query=*&grouped_column=Source.IP&criteria=unique&time_frame=1%20hour

Example Response

{
  "success": true,
  "count": 42
}

success is false when the calculated number is 0.

6. Get Events

Returns events matching the given query with pagination support. Results are sorted by Time.Generated, newest first.

Parameters

Example Request

GET /get_events?api_key=YOUR_API_KEY&query=Source.IP:10.0.0.1&time_frame=1%20hour&page=1&size=50

Example Response

{
  "success": true,
  "events": [
    {
      "Time": { "Generated": "..." },
      "Source": { "IP": "10.0.0.1" },
      "...": "..."
    }
  ],
  "total_count": 1342,
  "size": 50
}

Use total_count to calculate the number of pages: ceil(total_count / size).

7. Get Columns

Returns the distinct values of grouped_column across the events that match the query in the given time frame. Up to 1000 values are returned.

Parameters

Example Request

GET /get_columns?api_key=YOUR_API_KEY&query=*&grouped_column=Source.IP&time_frame=24%20hour

Example Response

{
  "success": true,
  "columns": ["10.0.0.1", "10.0.0.2"]
}

8. Get Incidents

By default this endpoint returns alert data (DataType:Alert) for backward compatibility. Since version 6.4.112, sending source=incident returns actual incident data instead, including incident status. This makes it possible to distinguish open and closed incidents.

Returns incidents created after the specified timestamp.

Parameters

Example Request

GET /get_incidents?api_key=YOUR_API_KEY&last_run=2026-04-17T00:00:00Z&query=severity:high

GET /get_incidents?api_key=YOUR_API_KEY&last_run=2026-04-17T00:00:00Z&source=incident

time_frame

curl --location 'https://YOUR_HOST/get_incidents?api_key=YOUR_API_KEY&time_frame=10%20min&query=*&source=incident'

curl --location 'https://YOUR_HOST/get_incidents?api_key=YOUR_API_KEY&time_frame=1%20hour&query=*&source=incident'

9. Set Incident Status

Closes an incident with the given reason and comment.

Query Parameters

Body Parameters

reason_id values

Example Request

POST /set_incident_status?api_key=YOUR_API_KEY&incident_id=123
Content-Type: application/json

{
    "reason_id": 4,
    "comment": "close comment str"
}

For example, sending reason_id 4 closes the incident as Resolved.

10. Incident Comment

Adds a comment to an incident.

Query Parameters

Body Parameters

Example Request

POST /incident_comment?api_key=YOUR_API_KEY
Content-Type: application/json

{
  "incident_id": "INC-001",
  "message": "Incident reviewed and closed as false positive."
}

11. Get Alert Configs

Returns all alert configurations grouped by alert blocks.

Parameters

Example Request

GET /get_alert_configs?api_key=YOUR_API_KEY

Example Response

[
  {
    "uid": "block-001",
    "name": "Network Alerts",
    "alerts": [
      {
        "uid": "alert-001",
        "name": "High Traffic Alert",
        "disabled": false,
        "block_uid": "block-001"
      }
    ]
  }
]

Error Responses

12. Get System Events

Returns system events (DataType:system) matching the given query with pagination support.

GET/get_system_events 30/min

Parameters

time_frame units

Example Request

GET /get_system_events?api_key=YOUR_API_KEY&time_frame=1 hour

Example Response

{
  "success": true,
  "events": [
    {
      "Time": { "Generated": "..." },
      "DataType": "system",
      "...": "..."
    }
  ],
  "total_count": 1342
}

Notes

• Results are sorted by Time.Generated descending (newest first).
• Use total_count to calculate total pages: ceil(total_count / size).
• Unlike /get_events, the query parameter is optional; omitting it returns all system events.

13. Data Collection List

Returns the list of data sources defined in the system: type, host, vendor/product (if set), logging state, enabled/disabled status and tags.

GET/data_collection_list 10/min

Parameters

Example Request

GET /data_collection_list?api_key=YOUR_API_KEY

Example Response

{
  "success": true,
  "data_collection": [
    {
      "type": "Windows",
      "description": "DC01 Windows Event Log",
      "host": "10.0.0.15",
      "vendor": "Microsoft",
      "product": "Windows",
      "logging_state": "Active",
      "status": "Enabled",
      "tags": "Domain Controller, Critical"
    },
    {
      "type": "Syslog",
      "description": "Legacy Firewall",
      "host": "10.0.0.20",
      "logging_state": "Passive",
      "status": "Enabled",
      "tags": "-"
    }
  ],
  "total_count": 2
}

Notes

• The response does not include a raw last-log timestamp. Instead, logging_state reports whether the source is currently Active (received logs within its expected health-check period) or Passive.
• status reflects the source's admin configuration (Enabled/Disabled), not its logging activity.
• vendor and product are only present when both are set on the source configuration.
• tags is a comma-separated list of tag descriptions attached to the source, or - if none.