Purpose
This guide explains how to generate a static API Key in the ManageEngine DLP Plus admin console and use it in Logsign USO to ingest endpoint DLP policy events (allowed, blocked, self-override, and reported-false-positive file activity) for security analytics and forensic purposes.
Note on verification: ManageEngine has not published a standalone public API reference for DLP Plus. This integration was built against the documented API of the same product family (ManageEngine Endpoint Central's /api/1.4 DLP report endpoint, which DLP Plus shares its platform with) and has not yet been live-tested against a customer's own DLP Plus instance. Treat the exact console navigation below as a strong starting point rather than a guarantee; confirm the API Key screen's exact location and the response format with your engineering contact during onboarding.
Prerequisites
The account used to generate the API Key must have Administrator privileges in the DLP Plus console. You will also need the console's base address, including its port; DLP Plus is typically reached over HTTPS on a non-standard port (for example :8383) rather than the default 443.
Step 1: Confirm Your Console Address
Open your DLP Plus console URL in a browser, for example https://<your-server>:8383/, and confirm it loads the login screen. Note the exact host and port; this becomes the Base URL field in Logsign.
Step 2: Generate an API Key
- Sign in to the DLP Plus console as an Administrator.
- Go to Admin > Global Settings/Integrations > API Key Generation (this menu path matches the wider ManageEngine Endpoint Central family; confirm the exact label in your DLP Plus version, as it can vary slightly by release).
- Generate a new API Key. It is issued as a static GUID-style value (for example
B42550F3-006D-48EB-8011-F6C7D6323EE7) and does not expire on its own. - Copy the key value; treat it as a password and share it over a secure channel.
Step 3: Configure the Integration in Logsign USO
Add a new ManageEngine DLP Plus data source in Logsign USO and provide:
| Field | Value |
|---|---|
| Base URL | Your console address from Step 1, for example https://172.33.20.201:8383 |
| API Key | The key value from Step 2 |
Logsign sends the key as-is in the Authorization header (no Bearer prefix, per the Endpoint Central family's documented convention) and periodically queries the endpoint activity report for new DLP events, tracking its own position by event time so nothing is re-delivered on the next poll.
Notes and Limits
- The upstream API does not document a server-side date/time filter for this report. Logsign requests pages and filters client-side by event time against its saved position; this means every poll re-reads recent pages from the server rather than requesting only new data, which is a platform limitation rather than a Logsign one.
- Rate limits, exact HTTP status codes, and the authentication header's real behavior on a live DLP Plus instance are not yet confirmed; the current implementation follows the sibling Endpoint Central product's published documentation. If you see authentication or parsing errors during onboarding, this is the first place to check with engineering.
- This integration covers only the endpoint activity/DLP policy report (file access, block/allow/override decisions, classification, and rule details). Other DLP Plus modules (if any exist in your license) are not covered.
- If your console uses a different port than 8383 or terminates TLS with a self-signed certificate, confirm both with your team before onboarding; the current implementation does not assume certificate validation can be skipped without an explicit setting.