Purpose
This guide explains how to obtain the credentials BeamSec PhishPro requires and how to configure them in Logsign USO to ingest phishing-simulation campaign data (active campaign lists and per-campaign result details such as clicks, reports, and data-entry outcomes) for security awareness reporting and analytics.
BeamSec PhishPro is a cloud-hosted phishing simulation / security-awareness platform. Logsign collects its data through a REST API poller (no syslog or agent option exists for this product).
Prerequisites
You need administrator access to your BeamSec PhishPro console to generate an API key. Public, technical BeamSec API documentation could not be located for this guide (see "Documentation Availability" below); the exact menu path below is a best-effort description based on typical SaaS console patterns and a documented flow for BeamSec's separate PhishTrace product, not a verified PhishPro screenshot. Confirm the exact steps with BeamSec support if your console differs.
Documentation Availability
BeamSec's public knowledge base blocks automated access and general web search returned no technical reference for PhishPro's REST API: no documented authentication scheme, endpoint list, or API-key generation walkthrough. The only related material found is a third-party integration document describing an API-token flow for BeamSec PhishTrace, a different BeamSec product, which is not confirmed to apply to PhishPro's own console. Everything below about endpoints and authentication is therefore derived from the shipped integration's behavior, not from official BeamSec documentation. If you have access to BeamSec's own API reference, use it to correct the details below.
Step 1: Generate an API Key in the BeamSec PhishPro Console
- Sign in to your BeamSec PhishPro console with an administrator account.
- Go to Settings (or a similarly named Integrations / API Access menu; unverified, see above).
- Enable API access and generate a new API Key. Copy it immediately and store it somewhere safe, as many SaaS consoles do not display it again.
- Note the API host your console uses for API requests (for example
api.beamsec.comor a tenant-specific subdomain). This is the value you will enter as the Host in Logsign.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Add Device and select Beamsec Phishpro API. You will be asked for:
| Field | Value |
|---|---|
| Host | The API host from Step 1, for example api.beamsec.com |
| Protocol | HTTP or HTTPS; use whichever your console's API endpoint requires (production PhishPro deployments should use HTTPS) |
| API Key | The key generated in Step 1 |
All three fields are required. Logsign sends this key directly as a static Bearer token on every request (Authorization: Bearer <API Key>); there is no token exchange or refresh step, unlike some OAuth2-based integrations.
Step 3: What Logsign Collects
Once configured, Logsign periodically calls the PhishPro active-campaigns endpoint to retrieve the list of currently active campaigns, then calls the campaign-detail endpoint once per campaign (in parallel, up to 10 concurrent requests) to retrieve each campaign's detailed results. Each campaign's launch timestamp is used as the position/cursor for incremental collection, and the first run looks back 12 hours by default.
Only the "active campaigns" endpoint is used. Campaigns that have finished and dropped out of the "active" list may not receive one final detail pull to capture their completed/final results; this could not be confirmed either way without a live test tenant.
Notes and Limits
- Duplicate records in small tenants: the incremental filter that skips already-processed campaigns currently only takes effect once the active-campaign list returned by the API exceeds 100 items. If your tenant has 100 or fewer active campaigns at a time, the saved cursor has no effect on what gets re-sent, and every currently active campaign is re-fetched and re-ingested on each poll cycle. This is a known implementation limitation, not a configuration issue on your side; contact Logsign support if the duplicate volume is a problem for your reporting.
- Completed campaigns may not get a final pull: only the active-campaigns endpoint is currently queried. Combined with the point above, still-active campaigns risk duplicate ingestion while campaigns that finish and leave the active list risk not having a final results pull captured; this is unverified against a live tenant and flagged for follow-up.
- Rate-limit and auth-failure handling: a 429 (rate limit) or 403 (authorization) response from BeamSec is currently treated as a generic request failure, with no distinct backoff/retry behavior.
- Authorization scheme not verified against official BeamSec documentation: no public BeamSec PhishPro API reference could be found to confirm the documented authentication scheme (see "Documentation Availability" above). If you see repeated 401/403 responses after setup, confirm the expected header format with BeamSec support before assuming a configuration mistake on your end.
- No field-level normalization defined yet: beyond the campaign ID and launch timestamp, raw BeamSec field names are not yet mapped to Logsign's canonical field schema; expect flattened, largely unmapped fields in the raw event body until this is implemented.
- This integration only covers PhishPro campaign and campaign-detail data via this REST API. No other BeamSec product surface (e.g. PhishTrace) is part of this integration.