Purpose
This guide explains how to provide ExtremeCloud IQ credentials to Logsign USO so that Logsign can poll ExtremeCloud IQ's Alerts API and ingest network alert events for security analytics and forensic purposes.
ExtremeCloud IQ (Extreme Networks' cloud network management platform for switches, wireless APs, and SD-WAN) exposes alert data through a REST API rather than syslog. This API poller is the supported way to bring alert data into Logsign USO.
This is not the same as "Adding Extreme Network Switch via Syslog." That is a separate, already-documented integration for receiving switch syslog directly. This document covers the ExtremeCloud IQ cloud management platform's Alerts API only.
Prerequisites
ExtremeCloud IQ's API authenticates with a username and password (not OAuth2 client-credentials, and not the separate "Client ID + API Token" flow available in ExtremeCloud IQ's Global Settings). Any account with at least read access can be used. Extreme Networks' own documentation notes that an Observer role (read-only access to most of the console) or a custom Authorization Group with API read permissions is sufficient; a Full Admin account is not required, since this integration only performs GET /alerts calls and never writes configuration.
Logsign recommends creating a dedicated, non-personal service account for this integration rather than using an individual administrator's personal login, so that password rotations or staff departures do not interrupt the integration.
Step 1: Create (or Identify) a Service Account in ExtremeCloud IQ
- Sign in to your ExtremeCloud IQ console.
- Under account/user administration, create a dedicated account for the Logsign integration, or identify an existing account you want to dedicate to this purpose.
- Assign it the Observer role, or a custom Authorization Group scoped to read-only alert access.
- Note the account's login username (email) and password. These are the two values Logsign needs; there is no API key or token to generate manually.
Step 2: Configure the Integration in Logsign USO
Log in to Logsign USO and add a new ExtremeCloud IQ data source. You will be asked for:
| Field | Value |
|---|---|
| Username | The ExtremeCloud IQ account login (email) from Step 1 |
| Password | The ExtremeCloud IQ account password from Step 1 |
| Protocol | https (ExtremeCloud IQ's cloud API is only reachable over HTTPS) |
| Request Verify (TLS certificate validation) | Recommended: enabled. Note: the poller's internal default is disabled if left unset, see Notes and Limits below. |
Logsign exchanges the username and password for a short-lived JWT Bearer access token automatically by calling ExtremeCloud IQ's POST /login endpoint, and re-exchanges it automatically as it approaches expiry (ExtremeCloud IQ issues tokens valid for roughly one day / 86400 seconds). You do not need to generate or refresh a token yourself. Logsign then periodically queries ExtremeCloud IQ's GET /alerts endpoint for new alert events, using the alert timestamp field as the sync cursor, and normalizes each alert into a Logsign event.
API Reference Summary
| Item | Value |
|---|---|
| Base URL | https://api.extremecloudiq.com (single global endpoint; ExtremeCloud IQ routes to the correct regional data center automatically, no separate region setting is needed) |
| Auth endpoint | POST /login, JSON body {"username": "...", "password": "..."}, returns a JWT access_token |
| Data endpoint | GET /alerts, used with page, limit, startTime, endTime, sortField=timestamp, order=ASC |
| Time filter units | Epoch milliseconds (confirmed in Extreme Networks' own official sample code, which comments "epoch time in milliseconds") |
| Pagination | limit=100 per page, up to 10 pages per poll cycle (up to 1000 records/cycle); response includes data array and total_count |
| Rate limiting | ExtremeCloud IQ returns HTTP 429 when a client's API quota is exceeded (confirmed in Extreme's developer documentation); the exact requests-per-minute limit is not published, unverified |
| EventSource mapping | Vendor: ExtremeCloud IQ, Product: ExtremeCloud API, Type: Security System, Category: Security Manager |
Notes and Limits
- This integration currently covers alert events only (the
/alertsendpoint). ExtremeCloud IQ's device inventory, wireless client session, and configuration-change APIs are not part of this integration and would require a separate connector. - Field-level normalization (source field to Logsign canonical field mapping) is not yet formally defined in the poller's configuration; the poller currently flattens and forwards the raw alert JSON with generic mandatory-field handling. A dedicated normalization pass against Logsign's canonical field list is recommended as follow-up work.
- The TLS certificate verification setting defaults to disabled in the poller if the field is not explicitly set by the customer. Since ExtremeCloud IQ is a public cloud service with a valid certificate, Logsign recommends the customer explicitly set this to enabled during onboarding.
- If polling stops or repeatedly logs authorization failures, check first whether the service account's password was changed or the account was disabled/deleted in the ExtremeCloud IQ console, and update the credentials in the Logsign USO data source accordingly.
- If the integration appears to stop delivering new alerts after an extended quiet period on your network (a long stretch with little or no alert activity), contact Logsign support: this is a known limitation in the current polling logic and is being addressed. It does not require any customer-side configuration change.