Purpose
This guide explains how to obtain an API Key from the CYFIRMA DeTCT portal and how to use it in Logsign USO to ingest DeTCT alerts — attack surface, impersonation & infringement, data breach & web monitoring, and social & public exposure findings — for security analytics and forensic purposes.
CYFIRMA DeTCT is CYFIRMA's external attack surface / digital risk protection module. It is a separate product from DeCYFIR (CYFIRMA's threat intelligence module), with its own portal (detct.cyfirma.com), its own API key, and its own alert categories. DeCYFIR already has its own Logsign integration article; this guide covers DeTCT only. DeTCT exposes alerts through a REST API rather than syslog, so this API poller is the supported way to bring DeTCT alert data into Logsign USO.
Prerequisites
You need an active CYFIRMA DeTCT subscription and a user account with access to the DeTCT portal's On-Boarding section. The exact role required to view or generate the API key was not verified against a live DeTCT tenant for this guide; if the API key is not visible to your account, contact your organization's CYFIRMA DeTCT administrator or CYFIRMA support.
Logsign 6.3.+ versions are required to add API-type data sources (confirmed against Logsign's existing CYFIRMA DeCYFIR article, which uses the same minimum version and the same "Settings > Data Collection > +Device" flow).
Step 1: Generate the API Key in the CYFIRMA DeTCT Portal
- Sign in to the CYFIRMA DeTCT portal at
https://detct.cyfirma.com/. - Go to On-Boarding > API.
- Copy the API key value shown in the API section.
Note: these navigation steps mirror the pattern already published and verified for CYFIRMA's sibling product DeCYFIR ("Log in to the Cyfirma portal > Click On-Boarding > API > copy the value"), and are consistent with the generic CYFIRMA V2 public API described in third-party integration documentation (Swimlane's Cyfirma V2 connector docs). CYFIRMA appears to use the same On-Boarding > API pattern across its products. However, this has not been verified against a live DeTCT tenant screenshot for this guide; if your portal layout differs, use whichever screen exposes the API key value.
Unlike Varonis, CYFIRMA does not use a separate bearer-token exchange step. The API key you copy here is sent as-is on every request; there is no token refresh flow to configure.
Step 2: Configure the Integration in Logsign USO
After obtaining the API key, log in to Logsign USO and add a new data source:
- Go to Settings > Data Collection > +Device.
- Select API > Cyfirma Detct as the source type.
| Field | Required | Value / Notes |
|---|---|---|
| API Key | Yes | The key copied in Step 1. Sent as a query-string parameter (?key=...) on every request to the DeTCT API, not as an Authorization header. |
| Log Start Date | Yes | How far back to pull alerts on first poll (options range from 15 minutes to 30 days). This is a generic Logsign field, not specific to CYFIRMA. |
| Device Name | Yes | A descriptive name for this data source. |
| EPS | No (default 1000) | Throttles how fast Logsign writes ingested alerts internally. It does not throttle the request rate to the CYFIRMA DeTCT API itself. |
| Offset, Data Policy, Tags, Group, Failover Group, Roles, Health Check | No | Generic Logsign fields, not CYFIRMA-specific. |
Once saved, Logsign polls four DeTCT alert endpoints under https://detct.cyfirma.com/core/api-ua/v2/alerts, covering 17 alert categories in total:
| Endpoint path | Categories (type parameter) |
|---|---|
/attack-surface | open-ports, ip-vulnerability, configuration, cloud-weakness, ip-reputation, certificates |
/impersonation-and-infringement | domain-it-asset, executive-people, product-solution, social-handlers |
/data-breach-and-web-monitoring | phishing, ransomware, dark-web |
/social-and-public-exposure | source-code, malicious-mobile-apps, confidential-files, dumps-pii-cii |
Each category is requested with the same API key, sorted ascending by creation date (order-by-created-date=asc), and paginated one page at a time (page=1, 2, 3, ...) until an empty response is returned. Alerts are normalized into Logsign events with fields such as Source.LogUID, Time.Generated, Risk.Level, Event.Category/Event.SubCategory, and category-specific fields (for example Source.IP for open-ports/IP-vulnerability alerts, or Source.UserCertificate for certificate alerts).
Notes and Limits
- The DeTCT API does not support a server-side "since last poll" time filter. On every poll cycle, Logsign re-fetches all pages of all 17 categories from CYFIRMA. To avoid duplicate documents from re-fetching the same alerts within a day, Logsign deletes that day's previously stored DeTCT documents (matched on vendor = Cyfirma and product = Detct, so DeCYFIR data is never touched) immediately before re-ingesting. This means an alert that keeps appearing across multiple different calendar days is not deduplicated across days; it can appear once per day it is returned by the API. Whether CYFIRMA's API itself expires/rotates alerts out of the response after some number of days was not verified.
- There is no built-in delay or backoff between paginated requests to the CYFIRMA API. The EPS setting only paces how fast Logsign writes ingested alerts, not the request rate to CYFIRMA. Whether CYFIRMA enforces a server-side rate limit on the DeTCT API was not found in public documentation and was not verified live.
- Authentication is a static API key passed as a URL query parameter on every request, not a header-based bearer token. There is no key rotation or expiry handling in the poller; if the key is revoked or regenerated in the CYFIRMA portal, you must update it in the Logsign data source manually.
- This poller only covers the DeTCT Alerts API (the four endpoints listed above). It does not cover CYFIRMA DeCYFIR (threat intelligence), which is a separate Logsign integration with its own API key, its own portal (
decyfir.cyfirma.com), and its own EventSource identifiers. - An industry scan (Elastic integrations, Microsoft Sentinel solutions, Splunk SOAR connectors, generic security playbooks and detection-content repositories) found no existing pull-based DeTCT collector elsewhere; the only CYFIRMA-related Sentinel solution found ("Cyfirma Vulnerabilities Intel") integrates with DeCYFIR, not DeTCT. Logsign's DeTCT poller appears to be one of the few, if not the only, dedicated DeTCT log collectors publicly documented anywhere.