CatchProbe Integration via API

Purpose

This guide explains how to obtain a CatchProbe Organization ID and API Key, and how to enter them in Logsign USO to ingest CatchProbe deception-platform alarms (SmartDeceptive module) for security analytics and forensic purposes.

CatchProbe is a cloud-hosted (SaaS) deception and threat-intelligence platform. It exposes its alarm data through a REST API (core-api.catchprobe.io/backoffice/alarms) rather than syslog. This API poller is the only supported way to bring CatchProbe alarm data into Logsign USO; CatchProbe does not offer a syslog or CEF forwarding option for this data.

Prerequisites

You need a CatchProbe Organization ID and an API Key issued for that organization. CatchProbe's public documentation does not describe the exact administrative role required to generate an API key, or the exact console menu path to do so (their public site has marketing pages only, no developer/API portal was found). In practice this means: use whichever CatchProbe account has administrative access to your organization's console, or request the Organization ID and API Key directly from your CatchProbe account manager/support contact. This point is not verified against CatchProbe's own documentation.

Step 1: Identify Your CatchProbe Organization ID

Your Organization ID is a tenant identifier assigned to your CatchProbe account. It is sent by Logsign as the organizationid HTTP header on every API request. CatchProbe support or your account manager can confirm this value for your tenant; the exact console screen that displays it is not verified, since no public CatchProbe documentation describing it was found at the time this guide was written.

Step 2: Generate an API Key in the CatchProbe Console

Request or generate an API Key scoped to your organization. The key is sent by Logsign as the x-api-key HTTP header on every API request. As with the Organization ID, CatchProbe does not publish the console steps to generate this key; contact CatchProbe support or your account manager to obtain or rotate it. Copy the key value as soon as it is issued and store it somewhere safe, since CatchProbe may not display it again afterward.

Step 3: Configure the Integration in Logsign USO

In Logsign USO, add a new CatchProbe API data source. You will be asked for:

Once saved, Logsign polls CatchProbe's alarm list endpoint (GET /backoffice/alarms/list, 100 alarms per page) on each cycle, compares each alarm's created_date against the last processed timestamp, and for every new alarm fetches its full detail (GET /backoffice/alarms/{alarm_id}) before sending it to Logsign as an event. No token exchange is involved: the Organization ID and API Key are sent as static headers on every call, they do not expire on a schedule, and there is no separate login or refresh step.

Notes and Limits

• The alarm list endpoint is currently called with a fixed server-side date filter that covers only the current week, and this is not affected by the "Log Start Date" field in the Logsign UI. In practice this means CatchProbe's API itself will not return alarms older than the current week, no matter what lookback window is configured. If the poller is stopped for longer than about a week, alarms older than "this week" at the time polling resumes may be permanently missed. This is a known limitation in the current implementation, not a customer configuration issue.
• Deduplication is based on comparing each alarm's created_date field against the last saved position; only alarms newer than that position are re-fetched and forwarded. This is a client-side, timestamp-based cursor, not a true opaque pagination cursor from CatchProbe.
• Pagination is 100 alarms per page. CatchProbe's documented rate limits, if any, are not verified; if a page request is rate-limited, that poll cycle stops early and is retried (with full dedup safety) on the next cycle.
• This poller only covers the SmartDeceptive alarms API. Other CatchProbe modules mentioned on their public site (DarkMap, LeakMap, RiskRoute, ThreatWay, Venspect) are not part of this integration and are not known to expose a comparable API; this was not investigated further since it was out of scope.
• Authentication is a static API Key plus Organization ID sent as request headers (x-api-key, organizationid) — there is no OAuth2 flow, no bearer token exchange, and no token expiry to manage for this integration.
• The exact CatchProbe console steps to locate the Organization ID and generate/rotate an API Key are not verified against official CatchProbe documentation — no public developer/API portal was found for CatchProbe at the time of writing. Confirm the current steps with CatchProbe support before onboarding a customer.