Progress Flowmon Integration via API

Purpose

This guide explains how to connect your on-premises Progress Flowmon Collector / Anomaly Detection System (ADS) appliance to Logsign USO so that ADS-generated anomaly and threat events are pulled into Logsign for security analytics and forensic purposes.

Progress Flowmon (formerly Flowmon Networks / INVEA-TECH) is a network traffic monitoring and NDR platform deployed as an appliance on the customer's own network. It exposes an OAuth2-protected REST API on the appliance itself; there is no Progress-hosted cloud endpoint for this integration. Logsign polls the Flowmon ADS module's events endpoint directly against your appliance's own address. If your organization instead forwards Flowmon data over syslog, that is a separate configuration and is not covered by this guide.

Prerequisites

You need network reachability from the Logsign poller to your Flowmon Collector/ADS appliance (the same address you use to reach the Flowmon web console), and a Flowmon user account with REST API access to the ADS events endpoint. Flowmon's REST API uses the same username/password you use to sign in to the Flowmon console, exchanged for a short-lived Bearer token via OAuth2 password grant; there is no separate "API key" object to generate on the appliance.

Not verified: whether Flowmon requires a distinct administrative or "API" role beyond a standard console login for the ADS events endpoint could not be confirmed against the official Flowmon REST API reference. Confirm with your Flowmon administrator that the account you plan to use can read ADS events before configuring Logsign.

Step 1: Identify Your Flowmon Appliance Address

Use the same protocol (HTTP or HTTPS; HTTPS recommended) and host/IP address you normally use to reach your Flowmon Collector/ADS web console, for example https://flowmon.yourcompany.local. This is an address on your own network, not a shared Progress domain. You will enter the protocol and host separately in Logsign in Step 3.

Step 2: Determine the Client ID

Flowmon's OAuth2 token endpoint requires a client_id value in addition to your username and password. Across Progress/Flowmon's own published integration examples (the WhatsUp Gold "Configuring a REST API credential for monitoring Flowmon appliances" documentation, and the Progress engineering blog post "Integration Baby Steps with Flowmon REST API and Python"), the value used is:

invea-tech

Not verified: this value is consistently documented by Progress/Flowmon in third-party integration guides, but was not confirmed against your specific appliance with a live test call during this review. If authentication fails with this value, verify the expected client_id with your Flowmon administrator; it may differ by appliance version or deployment.

Step 3: Configure the Integration in Logsign USO

In Logsign USO, add a new data source and select Progress Flowmon. You will be asked for:

Logsign exchanges these credentials for a Bearer access token automatically against {protocol}://{host}/resources/oauth/token using OAuth2 password grant, and refreshes it automatically as needed (the token is cached and treated as valid for up to 30 minutes if the appliance response does not specify its own expiry). Logsign then periodically queries the Flowmon ADS events endpoint (/rest/ads/events), using the event's time field as the sync cursor: each poll requests events from the last processed timestamp up to a 72-hour window ahead, ordered oldest-first, up to 500 events per request. On first run, with no prior position saved, Logsign starts 12 hours back from the current time.

For each event, if the raw record contains multiple perspectives (Flowmon's analysis viewpoints on the same anomaly), Logsign keeps only the one with the highest priority value and maps it into the event; other perspectives on the same anomaly are not retained individually.

Notes and Limits

• This integration covers Flowmon ADS anomaly/threat events only (the /rest/ads/events endpoint). Raw NetFlow/IPFIX flow-level traffic data is not collected by this poller and would require a separate integration.
• The Base URL/Host you enter must be your own Flowmon Collector/ADS appliance address on your network. This is an on-premises endpoint; Logsign does not connect to any Progress-hosted cloud service for this integration.
• No explicit rate-limit handling (HTTP 429) or automatic token invalidation on a 401/403 response is implemented in the current poller logic; if the appliance rejects a request due to rate limiting or an invalidated token, the error is logged and normal retry happens on the next scheduled poll cycle. Official Flowmon documentation did not specify a numeric API rate limit that could be confirmed during this review.
• If a raw event has no perspectives at all, Logsign does not populate the Object/Event-ID/Severity fields derived from perspectives for that event, but the event itself is still ingested with its EventSource metadata intact.
• If polling stops or repeatedly fails authorization, first confirm with your Flowmon administrator that: the console username/password used are still valid, the account still has access to the ADS events endpoint, and the client_id value configured in Logsign still matches what your appliance expects.