Syxsense Integration via API

Purpose

This guide explains how to generate an API Access Token in the Syxsense console and how to use it in Logsign USO to ingest Syxsense audit log records and detected security vulnerability (patch) records for security analytics and forensic purposes.

Syxsense is a cloud-hosted unified endpoint management and vulnerability/patch management platform. It exposes audit and vulnerability data through a REST API rather than syslog. This API poller is the supported way to bring Syxsense data into Logsign USO. Syxsense has no syslog forwarding option for these record types, so the API is the only collection path.

Prerequisites

The account you use to generate the API Access Token must have the full administrator role in the Syxsense console. Standard analyst accounts cannot see the API Keys screen.

When creating the token, you must assign it a Console Access level broad enough to read Audit Log and Patch/Vulnerability data. A token created with an insufficient access level will authenticate successfully but requests to these endpoints may be rejected.

Step 1: Generate an API Access Token in the Syxsense Console

1. Sign in to your Syxsense console with a full administrator account.
2. Click the Settings (gear) icon in the lower-right corner.
3. Select API Keys.
4. Click New Token.
5. In the New API Token window, enter a Name for the token (for example, "Logsign Integration"), optionally set an Expiration Date, optionally lock the token to a specific IP Address, and select the Console Access level.
6. Click Save.
7. Copy the generated token immediately and store it somewhere safe. Syxsense will not display it again once the window is closed; if it is lost, a new token must be generated.

Step 2: Configure the Integration in Logsign USO

After obtaining the API Access Token, log in to Logsign USO and add a new Syxsense data source. You will be asked for:

The API base URL (https://api.syxsense.io) is fixed in the integration and is not requested from the customer; Syxsense's REST API is served from a single shared host regardless of console tenant subdomain.

Logsign sends the token on every request as a standard Bearer token: Authorization: Bearer <token>. It then periodically polls two endpoints:

• GET /api/AuditLog/All: audit/operation records (user actions, configuration changes).
• GET /api/Patches/DetectedSecurityVulnerabilitiesByVulnerability: detected security vulnerabilities and patch status per device.

Both endpoints are paged with pageSize (500 records) and pageNumber query parameters. Logsign follows the nextPage link returned in each response until no further page is available, then stores the last page number and total record count as its resume position for the next poll cycle.

Notes and Limits

• This is a static API Access Token, not an OAuth2 flow; there is no token refresh step. The token remains valid until it expires (if an expiration date was set), is revoked, or is regenerated in the Syxsense console.
• If polling stops and the source logs repeated authorization errors (HTTP 401), check whether the token was revoked or regenerated in the Syxsense console, whether its expiration date has passed, or whether it is IP-locked to an address that no longer matches the Logsign collector.
• This poller only covers the Audit Log and Detected Security Vulnerabilities (Patches) endpoints. Other Syxsense surfaces, such as device inventory or asset management data, are not part of this integration and would require a separate connector.
• Pagination and rate-limit behavior described above were derived from Syxsense's publicly available API key documentation and were not verified against a live Syxsense tenant during this review because no test credentials were available. If you observe different pagination or rate-limit behavior in production, please report the discrepancy to Logsign support.
• Two source fields related to device status and solution page links are mapped to Logsign's Event.Status and URL.Path fields respectively; if these two fields appear unpopulated in Logsign, contact Logsign support so the mapping can be reviewed against a live API response.