Purpose
This guide explains how to obtain an API Key and API Host from Group-IB and how to use them in Logsign USO to ingest Group-IB XDR alerts, incidents, mailing/phishing detections, and Eclipse events for security analytics and forensic purposes.
Group-IB XDR is a cloud-hosted platform and exposes its detection data through a REST API rather than syslog. This API poller is the supported way to bring Group-IB XDR data into Logsign USO. There is no on-premises syslog equivalent for this data in the current integration; if you need a different Group-IB product (for example the separate Threat Intelligence & Attribution feed), that is a different API and is out of scope for this guide.
Prerequisites
You need an active Group-IB Managed XDR subscription and API access enabled on your account. Group-IB provisions the API Key and the API Host (the base URL for your XDR tenant) directly; contact your Group-IB Managed XDR account representative or customer success contact to request them if you do not already have them.
Note: Group-IB's general Threat Intelligence & Attribution (TI&A) self-service portal (tap.group-ib.com, Profile > Security and Access > Generate new token) is a different product with a different authentication scheme (HTTP Basic Auth with email + key) and different endpoints. It is not confirmed to issue the credentials this integration uses. Obtaining the API Key/Host for this integration from your Group-IB account team, rather than that self-service portal, is the safer path until this is confirmed with Group-IB support.
Step 1: Obtain Your API Host and API Key from Group-IB
Contact your Group-IB Managed XDR account representative and request:
- The API Host for your XDR tenant (the base URL Logsign will call, for example
https://<your-tenant>.example; the exact format is not publicly documented and should be confirmed with Group-IB). - An API Key scoped for reading alerts, incidents, mailing, and Eclipse event data.
Store the API Key securely once received; treat it like a password.
Step 2: Configure the Integration in Logsign USO
Log in to Logsign USO and add a new Group-IB XDR data source (Settings > Add Device > API). You will be asked for:
| Field | Value |
|---|---|
| API Key | The API Key obtained in Step 1 (entered as a masked/password field) |
| Host | The API Host obtained in Step 1, for example https://<your-tenant>.example |
All other fields on the form (Device Name, EPS, Log Start Date, Group, Tags, Roles) are standard fields shared by every Logsign API data source and are not specific to Group-IB.
Step 3: Verify the Connection
After saving, Logsign polls four Group-IB XDR endpoints in sequence: alerts, incidents, mailing, and Eclipse events, each in pages of 500 records. Every request sends your API Key in an X-Api-Key header. Check the source's health status in Logsign after a few minutes; if it shows repeated request failures, confirm the API Host value and API Key with Group-IB support before trying again.
Notes and Limits
- Authentication is a single static API Key sent in the
X-Api-Keyheader on every request. There is no token exchange or expiry to manage on the Logsign side; if the key is rotated or revoked in Group-IB, update it in the Logsign data source configuration. - This integration covers four endpoints as observed in the poller: alerts, incidents, mailing, and Eclipse events. What the "mailing" and "Eclipse events" endpoints specifically represent within Group-IB's product line is not confirmed from public documentation; confirm scope with Group-IB if you need to know exactly what these contain before relying on them.
- Field-level normalization for this source is not yet implemented: incoming records are currently stored as a single flattened raw field rather than mapped to individual Logsign fields, and event categorization always falls back to a generic classification (no differentiation between alert types). Treat this source as raw/forensic data until normalization is added.
- Rate limiting is not confirmed. The integration is built to page through data in batches of 500 records per request; no documented rate limit ceiling from Group-IB was found. If you see repeated failures, check with Group-IB support whether your account has a request-rate ceiling.
- IP allowlisting requirements are not confirmed. If your Group-IB XDR tenant restricts API access by source IP (common for threat-intel APIs), you may need to allowlist the IP address of your Logsign poller with Group-IB before the connection will succeed.
- This integration does not use server-side time-range filtering; it pages through results using an offset/page-size scheme rather than a timestamp cursor. If you are troubleshooting missed or duplicated records, this is a known area to check with your Logsign engineering contact.
- The connection to your Group-IB API Host is made without TLS certificate verification on the Logsign side. This is a deliberate accommodation for some customer environments, but confirm with your security team whether this is acceptable for your deployment.