Purpose
This guide explains how to configure the McAfee Web Gateway EDR response integration in Logsign, so that an alarm, correlation rule, or incident analyst can trigger an action on a McAfee Web Gateway appliance directly from the Logsign Responses module.
McAfee Web Gateway was rebranded to Skyhigh Secure Web Gateway after McAfee's enterprise security business was spun off and acquired by STG in 2022. The appliance, its administration interface (known as the Konfigurator), and the REST API this integration talks to have not changed name or behavior as part of that rebrand; this guide applies equally to appliances still labeled "McAfee Web Gateway" and to newer ones labeled "Skyhigh Secure Web Gateway."
Read the Available Methods section before you start. This integration currently exposes a single action, Commit, and it does not add, remove, or look up entries in any block list or rule by itself. It only applies configuration changes that are already pending on the appliance. If your goal is to have Logsign automatically add a malicious URL or domain to a McAfee/Skyhigh block list, that specific capability is not implemented in this integration today; see Notes and Limits for what this means in practice.
Prerequisites
You will need the following before configuring this integration:
| Requirement | Details |
|---|---|
| Appliance access | A McAfee Web Gateway or Skyhigh Secure Web Gateway appliance (physical, virtual, or cloud) with network access from the Logsign server. |
| REST interface enabled | The appliance's REST interface must be turned on. This is a separate setting from the admin GUI; see Step 1. |
| Dedicated administrator account | An account created specifically for this integration, with a role that has REST interface access and only the policy/list edit rights it actually needs. Do not use the built-in Super Administrator account for this. See Step 1. |
| Network path | Logsign must be able to reach the appliance over HTTPS on the port configured for the Konfigurator/REST interface. Confirm this port with your appliance administrator; it is commonly the same port used for the admin GUI (see Step 2). |
| Logsign permissions | Access to Settings > Integrations > Responses in Logsign, with rights to add a device. |
Step 1: Enable the REST API and create a least-privilege user on the Web Gateway
On the appliance side, two things need to be true before Logsign can connect: the REST interface has to be switched on, and the account Logsign authenticates with has to be explicitly granted access to it.
To enable the REST interface, log in to the Web Gateway UI as an administrator and go to Configuration > User Interface, then enable the REST interface option for HTTPS access. The exact label of this setting can differ slightly between appliance versions; if you cannot find it under Configuration > User Interface, check your appliance's own release documentation for the current wording. This step is based on third-party and community documentation of the Konfigurator REST interface rather than a live test against a customer appliance, so treat the exact menu wording as not independently verified.
Next, create a dedicated administrator role and account for Logsign rather than reusing an existing Super Administrator login. Go to Accounts > Administrator Accounts, open the Roles section, and edit (or create) a role that has REST interface access enabled in its access rights. Only add the additional rights this role actually needs, such as edit access to the specific policy lists you plan to manage through the appliance's own UI or scripts; it does not need full system administration rights just to call login and commit. Then, under Internal Administrator Accounts, add a new account and assign it this role. As with the REST interface toggle above, the precise menu labels for role permissions can vary by appliance version and were not independently verified against a live appliance during this research; confirm the exact checkbox names on your own system.
Keep the username and password for this account handy. You will enter them directly into Logsign in Step 2, and Logsign stores the password encrypted.
Step 2: Configure the integration in Logsign
In Logsign, go to Settings > Integrations > Responses, search for McAfee Web Gateway EDR, click Configure, and then click +Device. Fill in the fields as follows:
| Field | Required | Description |
|---|---|---|
| Host | Yes | The IP address of the Web Gateway appliance's Konfigurator/REST endpoint. Enter the bare address only, for example 10.10.20.30, with no https:// prefix and no path; Logsign builds the full URL itself. |
| Port | Yes | The TCP port the REST interface listens on. This is normally the same HTTPS port used for the appliance's admin GUI, not port 443. Confirm the current value in the appliance's own User Interface settings rather than assuming a fixed default, since it is configurable per appliance. |
| Username | Not marked mandatory in the Logsign form, but functionally required | The administrator account you created in Step 1. Basic Auth will fail without it, so leaving it blank will make every action fail with an authentication error even though the form does not force you to fill it in. |
| Password | Not marked mandatory in the Logsign form, but functionally required | The password for the account above. Logsign stores it encrypted and only decrypts it in memory at request time. |
Click Create to save the device, then use the Test button to confirm Logsign can log in to the appliance. The test only performs a login call; it confirms your credentials and REST access are valid, but it does not confirm that the account has rights to actually commit configuration changes, since that requires a separate permission on the appliance side. A successful test does not guarantee a successful Commit later.
Available Methods
Commit
This is the only method this integration exposes today. It logs in to the appliance fresh (a new session on every call, not a reused one) and then calls the appliance's commit action, which applies whatever configuration changes are currently pending on the appliance, such as edits to system files, log settings, or lists.
Commit does not target a specific list or rule. It does not accept a list name, a URL, a domain, or any other value as input, and Logsign's implementation of this integration does not itself add, remove, or query entries in any block list, allow list, or policy rule. In practice this means the actual change (for example, adding a malicious domain to a block list) has to be made separately on the appliance, either through its own admin UI or through a script or process outside Logsign, before this Commit action is triggered. Commit is the step that makes that already-staged change live; it does not create the change itself.
| Field | Description |
|---|---|
| Device | Select the McAfee Web Gateway EDR device you configured in Step 2. This is the only input the method takes; there are no additional parameters. |
Use this action from a correlation rule or an alarm's automated response, or run it manually from within an incident, whenever you need Logsign to push through pending changes on the appliance as part of your response workflow.
Notes and Limits
- Commit is a global, appliance-wide action. If more than one pending change exists on the appliance when it runs, all of them are applied, not just the one your incident response process intended. Coordinate with whoever else manages the appliance so an unrelated pending change does not go live unintentionally through this integration.
- The underlying McAfee/Skyhigh REST client bundled with this integration also defines Restart and Shutdown actions for the appliance, but neither is registered as a callable method in the Logsign integration or listed in its manifest, so neither can be triggered from Logsign today. This is a code-level observation from the integration's source, not a documented product limitation.
- This integration disables TLS certificate verification when connecting to the appliance. A self-signed or internal CA certificate on the Web Gateway will not block the connection, and you do not need to import a CA certificate into Logsign for this integration to work.
- The Logsign configuration form does not include a proxy setting for this integration, even though the underlying configuration structure has an unused field for one. There is currently no supported way to route this integration's traffic through a proxy from the Logsign UI.
- Authentication is HTTP Basic Auth against the appliance's own login endpoint on every call; there is no OAuth flow, no API key, and no token to rotate. Rotating the password on the appliance requires updating it in the Logsign device configuration at the same time.
- The exact on-appliance steps for enabling the REST interface and configuring role permissions (Step 1) are based on secondary sources, since the official Skyhigh Security documentation pages returned only navigation content and not article text during this research. Confirm the current menu wording against your own appliance's admin UI before relying on it for a customer rollout.
Troubleshooting
| Error | Likely cause | What to check |
|---|---|---|
| 404 Not Found on Test/login | The REST interface is not enabled on the appliance, or the Host/Port entered does not point at the Konfigurator REST endpoint at all. | Confirm the REST interface is switched on under Configuration > User Interface on the appliance, and that Port matches the appliance's actual Konfigurator/GUI HTTPS port rather than 443 or another guessed value. |
| 401 Unauthorized | Wrong username or password, or the account is locked or disabled on the appliance. | Re-enter the credentials in the Logsign device configuration, confirm the account is active on the appliance, and test login with the same credentials directly against the appliance if possible. |
| 403 Forbidden | The account authenticates successfully but its administrator role does not have REST interface access enabled, or lacks the specific policy/list edit rights needed for whatever change is pending. | On the appliance, go to Accounts > Administrator Accounts > Roles, open the role assigned to this account, and confirm REST interface access and the relevant edit rights are enabled. |
| Connection refused or timeout | A firewall or network path is blocking Logsign from reaching the appliance, or the Host/Port values are wrong. | Confirm the port used for the REST interface is open between Logsign and the appliance, and that Host and Port in the Logsign device configuration match the appliance's real address and port. |
| Commit reports success but no change is visible on the appliance | Commit only applies changes that are already pending. If nothing was staged on the appliance before Commit ran, there was nothing for it to apply. | Confirm the intended list or policy edit was actually made and left pending on the appliance, through its own UI or another process, before triggering Commit from Logsign. |