Coro Cybersecurity Integration via API

Purpose

This guide explains how to generate API credentials in the Coro Cybersecurity console and how to use them in Logsign USO to ingest Coro ticket (alert) data for security analytics and forensic purposes.

Coro Cybersecurity is a cloud-native SMB security platform (endpoint protection, email security, EDR, cloud application security, and data governance modules) that exposes its alerts through a REST API rather than syslog. This API poller is the supported way to bring Coro ticket data into Logsign USO.

Prerequisites

The account you use to generate API credentials must be an administrator in the Coro console. The API Credentials screen is not available to standard user accounts.

You will need three values from the Coro console before configuring the integration in Logsign: a Client ID, a Client Secret, and your Workspace ID.

Step 1: Create an API Credential in the Coro Console

1. Sign in to the Coro console as an administrator.
2. Go to Control Panel > Connectors > API Credentials.
3. Create a new API credential. Coro generates a Client ID and Client Secret pair for it. These are separate from your console username and password.
4. Copy the Client ID and Client Secret and store them somewhere safe. The Secret is typically only shown in full at creation time.

Step 2: Find Your Workspace ID

In the Coro console, open your user profile and select My Workspaces, or open Manage Workspaces and copy the ID shown under your workspace's name. This is the Workspace ID you will enter in Logsign.

Step 3: Configure the Integration in Logsign USO

After obtaining the Client ID, Client Secret, and Workspace ID, log in to Logsign USO and add a new Coro Cybersecurity data source. You will be asked for:

Logsign exchanges the Client ID and Client Secret for a Bearer access token automatically (OAuth2 client-credentials grant against https://api.secure.coro.net/oauth/token) and refreshes it before it expires. You do not need to generate or refresh a token yourself. Logsign then periodically queries the Coro Tickets API for new tickets, using each ticket's lastEventTime as the sync cursor, and normalizes each ticket into a Logsign event along with device, email, and malware metadata where present.

Known Limitations of the Current Integration

A review of this integration found the following limitations. These are not configuration mistakes on the customer's side — they are constraints in the current implementation, listed here so expectations are set correctly during onboarding.

• Only one ticket category is currently collected. Coro tickets span multiple modules — Cloud Security, Email Security, Endpoint Security, EDR, User/Endpoint Data Governance, and Network — with dozens of distinct trigger types (phishing, DLP, spoofing, EDR detections such as lateral movement or credential access, malware on endpoint or in email attachments, and more). The current integration only requests tickets whose trigger type is malwareInCloudDrive (cloud-drive malware detections). All other ticket types are not fetched by this integration today. If your organization expects to see phishing, EDR, DLP, or endpoint-security tickets from Coro in Logsign, they will not appear until this is addressed.
• Only already-processed tickets are collected. The integration also filters to tickets Coro has already marked as processed. Tickets that are still open/in-progress in Coro are not retrieved until Coro itself marks them processed.
• Single-region support only. Coro operates separate regional API environments for the US (api.secure.coro.net), Canada (api.secure-ca.coro.net), and Germany/EU (api.secure-eu.coro.net) data centers. This integration currently only supports the US API endpoint. If your Coro workspace is hosted in the Canadian or German/EU data center, this integration cannot be used as-is.

Notes and Limits

• The Bearer access token is valid for approximately 24 hours per Coro's documentation. Logsign requests a new one automatically before it expires or immediately after a 401 response, so no manual action is needed under normal operation.
• If polling stops and the source logs repeated authorization errors, check whether the API credential was deleted or rotated in the Coro console, and whether the Workspace ID is still correct. Generate a fresh credential and update the data source in Logsign USO if needed.
• This poller covers ticket data from Coro's Tickets API only (and, at present, only the malwareInCloudDrive trigger type; see Known Limitations above). No separate Coro response/action-write-back module exists in the current implementation.
• The default lookback window on first run is 1 hour; the page size per request is 500 tickets, with no pagination beyond the first page in the current implementation.