Purpose
This guide explains how to obtain a Company ID and API Key from the SOCRadar Extended Threat Intelligence platform and use them in Logsign USO to ingest SOCRadar security incidents, account/credential leak detections, and platform audit logs for security analytics and forensic purposes.
SOCRadar is a cloud-hosted digital risk protection and threat intelligence platform and does not expose its data over syslog. This API poller is the supported way to bring SOCRadar data into Logsign USO. It covers three modules: the Incidents API (SOCRadar's alarms and threat incidents), the Leaks API (leaked account and credential detections tied to your company), and the platform's audit log API (user activity inside the SOCRadar console). SOCRadar's other modules, such as Threat Feed IOC, TAXII/MISP feeds, and brand protection/takedown data, are not covered by this integration and are out of scope here.
Prerequisites
You need administrative access to the SOCRadar platform's Settings area to locate your Company ID and to generate or view the API Key. Both values live under the platform's Settings menu, not inside a specific module, so the account you use must have access to company-level settings rather than just analyst/incident-viewing permissions.
Use least privilege where possible. SOCRadar's public integration documentation (as consumed by third-party connectors such as Cortex XSOAR and Stellar Cyber) describes a single company-scoped API Key rather than a key tied to a granular, individually toggleable permission set. No SOCRadar-published option to create a role-scoped or read-only API Key was found during this research, and this has not been verified against a live SOCRadar tenant (doğrulanmadı). Until this is confirmed, treat the API Key as a sensitive, company-wide credential: generate it under a dedicated account you control for the Logsign integration rather than a shared administrator login, so you can trace and revoke it independently of other integrations, and ask your SOCRadar account team directly whether scoped or read-only keys are available on your plan.
Step 1: Find Your Company ID
Sign in to the SOCRadar platform and go to Settings > Company Profile. Look for the Company Information section, where your Company ID is displayed. Copy this value; it is a short numeric identifier (for example 387) and does not change once assigned.
Step 2: Generate Your API Key
Still under Settings, go to API & Integrations > API Options (this menu is sometimes labeled the Integration Page's API Reference tab depending on your platform version). Generate an API Key if you do not already have one, and copy it somewhere safe. SOCRadar's console lets you regenerate the key from this screen if it is ever compromised; regenerating it immediately invalidates the old key, so update the Logsign data source at the same time you rotate the key.
Step 3: Confirm Your Platform Base URL
Most SOCRadar tenants are served from the shared platform address https://platform.socradar.com. This is not a formally published, fixed regional list the way some other vendors provide; it is the default address referenced by SOCRadar's own third-party connector documentation (for example the Stellar Cyber and Cortex XSOAR integration guides) and matches the default used in Logsign's own poller test configuration. It has not been independently confirmed against a live SOCRadar tenant during this research (doğrulanmadı). If your organization was onboarded onto a dedicated or regional SOCRadar deployment, confirm the exact API base URL with your SOCRadar account manager or support contact before proceeding, rather than assuming the default.
Format matters here. Enter the URL with the https:// prefix and without a trailing slash, for example https://platform.socradar.com and not platform.socradar.com or https://platform.socradar.com/. The poller builds each request by directly concatenating this value with the API path, so a trailing slash produces a malformed double-slash URL that SOCRadar's API will reject.
Step 4: Configure the Integration in Logsign USO
After obtaining the Company ID, API Key, and base URL, log in to Logsign USO and add a new SOCRadar data source. You will be asked for:
| Field | Value |
|---|---|
| API URL | Your platform base URL from Step 3, for example https://platform.socradar.com |
| Token | The API Key from Step 2 |
| Company ID | The numeric Company ID from Step 1 |
Use the Test Connection button before saving. Logsign validates the credentials by calling the audit log endpoint with the Company ID and Token you entered; if it returns an error message from SOCRadar, the panel shows it directly so you can tell whether the Company ID, the Token, or the base URL is the problem before the source goes live.
Once saved, Logsign polls all three endpoints (incidents, leaks, and audit logs) on the configured interval, tracking a separate time-based cursor per endpoint so each one advances independently. On the very first poll for a newly created source, each endpoint's cursor starts about three hours in the past; this initial lookback window is fixed in the poller itself and is not affected by the general "Log Start Date" option shown in the source configuration screen.
Troubleshooting
| Error | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | SOCRadar returns this when the Company ID does not exist, or when the Company ID and the API Key do not belong to the same company (for example, a key from one company entered alongside another company's ID). | Re-copy the Company ID from Settings > Company Profile and the API Key from Settings > API & Integrations, making sure both come from the same SOCRadar account, then re-test the connection. |
| 403 Forbidden | Not explicitly documented by SOCRadar; typically means the authenticated key does not have access to the requested module or the module is not enabled on your subscription. | Confirm with your SOCRadar account team that your plan includes the Incidents, Leaks, and Audit Log modules used by this integration. |
| 429 Too Many Requests | Rate limiting. Third-party SOCRadar connector documentation notes that sending more than one request per second against the same API Key can trigger this, which is more likely if the same key is shared across multiple integrations or tools polling SOCRadar at once. Note that the current Logsign poller code logs this specific status code with a message referring to an invalid token; treat that log text as a known inaccuracy and read it as a rate-limit signal instead (doğrulanmadı against SOCRadar's own published limits, since no official rate-limit figure was found during this research). | Avoid reusing the same API Key for other tools querying SOCRadar on a tight schedule. If 429s recur, contact Logsign support; this poller does not currently retry automatically within the same cycle. |
Notes and Limits
- This integration only covers the Incidents, Leaks, and Audit Log APIs. Other SOCRadar surfaces, such as Threat Feed IOC, the TAXII/MISP feed servers, and brand protection/takedown workflows, are not part of this integration and would require a separate connector.
- The poller does not send a page size or limit parameter to any of the three endpoints; each poll retrieves every record SOCRadar returns for the time window since the last saved position in a single response. If your company generates a very high daily volume of incidents or leak detections, confirm with SOCRadar whether the API applies its own internal page size, since this has not been independently verified (doğrulanmadı).
- If a poll cycle fails (non-200 response) for one of the three endpoints, that endpoint's cursor is not advanced, so no events are lost; it is simply retried on the next scheduled poll using the same starting point.
- Make sure the API URL you enter is your platform base address only (for example
https://platform.socradar.com), not a URL that already includes/api/company/...or similar path segments. Logsign appends the correct API path automatically.