Varonis API Integration Guide

Purpose

This guide explains how to generate an API Key in the Varonis SaaS console and how to use it in Logsign USO to ingest Varonis threat detection alerts, along with their underlying events, for security analytics and forensic purposes.

Varonis SaaS (the cloud-hosted Data Security Platform, formerly DatAdvantage Cloud) exposes alerts through a REST Search API rather than syslog. This API poller is the supported way to bring alert data into Logsign USO. If you run Varonis on-premises instead (classic DatAlert), use CEF-over-syslog forwarding from the DatAlert console. The on-prem product has no equivalent REST API for alerts.

Prerequisites

The account you use to generate the API Key must be an administrator in the Varonis console with access to the Configuration menu. The API Keys screen is not visible to standard analyst accounts.

The key itself must be created with the Threat Detection Integrator role. This role grants the key read access to the Alerts Search API that Logsign polls. A key created without it will authenticate successfully, but every search request will fail authorization.

Step 1: Identify Your Varonis Tenant URL

Sign in to your Varonis workspace at https://loginx.varonis.com/ using your normal console credentials. Varonis will redirect you to your tenant's own address, which looks like https://<tenant>.varonis.io (for example https://acme.varonis.io). Copy this address from the browser bar. It is the Base URL you will enter in Logsign in Step 3.

Unlike some vendors, Varonis SaaS does not use a different domain suffix per region. US, EU, UK, Australia, and Canada tenants are all provisioned under the shared varonis.io domain. Only the tenant subdomain differs, and it is fixed for your account at onboarding.

Step 2: Create an API Key in the Varonis Console

1. In the Varonis console, go to Configuration > API Keys.
2. Click Create API Key. The "Add New API Key" panel opens on the right.
3. Enter a Name and a Description (for example, "Logsign USO integration") so the key is identifiable later.
4. Assign the Threat Detection Integrator role to the key.
5. Click Generate Key.
6. Copy the generated API key secret immediately and store it somewhere safe. It starts with vkey1_. Varonis will not show it to you again once you close the panel, so if you lose it you must generate a new key.

Step 3: Configure the Integration in Logsign USO

After obtaining the tenant URL and API Key, log in to Logsign USO and add a new Varonis data source. You will be asked for:

Logsign exchanges the API Key for a short-lived Bearer access token automatically on the first poll, and re-exchanges it whenever it expires or is rejected. You do not need to generate or refresh a token yourself. Logsign then periodically queries the Varonis Search API for new alerts, using Alert.IngestTime as the sync cursor so late-ingested alerts are never skipped, and normalizes each alert into a Logsign event, along with its severity, threat model category, status, affected user, and asset.

Notes and Limits

• The Bearer access token obtained by the integration is valid for about 10 minutes (600 seconds). Logsign requests a new one automatically before it expires or immediately after a 401 response, so no manual action is needed under normal operation.
• If polling stops and the source logs repeated authorization errors, check two things first: whether the API Key was deleted or rotated in the Varonis console, and whether the key's role was changed away from Threat Detection Integrator. Generate a fresh key with the correct role and update the data source in Logsign USO.
• This poller only covers alert data from the Threat Detection module (the Search API's Alert entity). Other Varonis SaaS surfaces, such as DataPrivilege access-request workflows, DatAdvantage classification and permissions data, and the alert status write-back endpoint, are not part of this integration and would require a separate connector.
• Make sure the Base URL you enter is your own tenant address (https://<tenant>.varonis.io), not the shared login page https://loginx.varonis.com. The login page only redirects you to your tenant. It is not an API host.