ThreatMon Integration via API

Purpose

This guide explains how to obtain a ThreatMon Company API Key and starting alarm code, and how to use them in Logsign USO to ingest ThreatMon alarm/vulnerability intelligence data for security analytics and forensic purposes.

ThreatMon (threatmonit.io) is a cloud-hosted cyber threat intelligence and digital risk protection platform. It exposes its alarm data through a REST API rather than syslog. This API poller is the supported way to bring ThreatMon data into Logsign USO; no equivalent syslog/on-prem forwarding path exists for this data.

Prerequisites

You need administrative access to your ThreatMon dashboard (https://dashboard.threatmonit.io) to generate a Company API Key. Exact menu steps for key generation are not covered in ThreatMon's public documentation (see Notes and Limits); if the key generation screen is not visible to your account, contact ThreatMon support.

You also need to decide a starting Alarm Code; the poller uses this as the initial cursor position on the very first poll. After the first successful poll, Logsign automatically tracks and advances this position itself.

Step 1: Generate a Company API Key

1. Sign in to your ThreatMon dashboard at https://dashboard.threatmonit.io/login.
2. Locate the API / integrations section of the console and generate a Company API Key. (ThreatMon does not publish a detailed, step-by-step public API reference for this screen; contact integration@threatmonit.io if you cannot locate it.)
3. Copy the generated key and store it somewhere safe. This is the value Logsign sends on every request in the X-COMPANY-API-KEY header.

Step 2: Choose a Starting Alarm Code

ThreatMon assigns each alarm/vulnerability record an incrementing alarmCode. Decide where you want Logsign to start reading from:

• Enter 0 to pull the full available backlog on the first poll.
• Enter a specific alarm code if you only want records after a known point.

This value is only used once, on the very first poll for a new data source. Logsign then persists the last processed alarm code internally and uses it as the cursor for every subsequent poll, so you do not need to update this field again.

Step 3: Configure the Integration in Logsign USO

After obtaining the API Key and starting alarm code, log in to Logsign USO and add a new ThreatMon data source. You will be asked for:

Logsign sends the API Key on every request as the X-COMPANY-API-KEY header value and periodically queries the ThreatMon API's vulnerabilities resource for records after the current alarm code cursor, paging through results (up to 100 pages per poll cycle) until no further data is returned. Each returned record is normalized into a Logsign event and forwarded to the parser.

Notes and Limits

• Endpoint naming discrepancy (flagged for engineering follow-up): although this integration is named and categorized in Logsign as ThreatMon's "Incident API", the underlying HTTP request actually targets ThreatMon's vulnerabilities resource (GET /api/threatmon/external/v1/vulnerabilities/{page}), not a resource named "incidents". Whether ThreatMon's "Incident" data is in fact served through this vulnerabilities endpoint, or whether this integration is pulling from a different resource than intended, could not be confirmed from public documentation and should be verified with ThreatMon before relying on this integration as a complete incident feed.
• Field normalization is currently minimal. As shipped, this integration does not map ThreatMon's response fields into Logsign's canonical fields (for example Vulnerability.Score, Vulnerability.PluginName); incoming data is retained only in the raw provider-data block. Search, correlation rules, and dashboards that depend on canonical fields will not currently see ThreatMon data populate them. A draft field mapping proposal is available on request pending a sample API response.
• No official public ThreatMon API reference was found. ThreatMon does not appear to publish a public Swagger/OpenAPI specification or detailed REST API reference. Details in this document about header names and request/response shape are derived from testing and third-party references, not vendor documentation, and have not been confirmed with ThreatMon.
• The integration pages through up to 100 pages per poll cycle and stops early once a page returns no data. There is no explicit handling for HTTP 429 (rate limit) or 403 (unauthorized) responses beyond a generic request-failure log; if polling silently stops producing new events, check that the API Key is still valid and that your account has not been rate-limited.
• Required configuration fields for this data source are the API Key and Alarm Code. Both must be present or the integration will not run for that data source.