Purpose
This guide explains how to configure the AlienVault OTX (Open Threat Exchange) Response integration in Logsign USO, so that an analyst (or an action rule) can look up OTX pulse/threat information for an IPv4 address, a domain, or a file hash directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration, not a containment integration; it does not block or change state anywhere. It only runs when a method is called from Settings > Integrations > Responses, an Action Rule, or a manual incident action.
Prerequisites
- An AlienVault OTX account (free registration at otx.alienvault.com) and its API key.
Step 1: Obtain Your OTX API Key
- Log in to your OTX account at otx.alienvault.com.
- Open your account settings/profile page and copy your OTX API Key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for AlienVault OTX, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this OTX device in Logsign. |
| Api Key | Yes | Your OTX API Key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- ipv4_by_section — gets OTX pulse info for an IPv4 address. Args: ip (required), section (required, one of: general, reputation, geo, malware, url_list, passive_dns, http_scans).
- domain_by_section — gets OTX pulse info for a domain. Args: domain (required), section (required, one of: general, geo, malware, url_list, passive_dns, http_scans, whois).
- file_hash_by_section — gets OTX pulse info for a file hash. Args: file_hash (required), section (required, one of: general, analysis).
Known issue with file_hash_by_section: source-code review found that the method name declared here (file_hash_by_section) does not match the name Logsign's implementation actually registers internally (filehash_by_section, without the underscore between "file" and "hash"). Because of this mismatch, calling this method as shown in the Logsign UI may fail to resolve to working code. This is a known code defect, not a configuration problem on your end; if you hit this, do not spend time re-checking your API key or the ip/domain methods (which work correctly), and raise it with Logsign support/engineering.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or revoked Api Key. | Re-enter the Api Key exactly as shown in your OTX account settings. |
| 429 Too Many Requests | OTX enforces rate limits based on your account tier. | Reduce the frequency of automated lookups. |
| file_hash_by_section always fails | The known manifest/code naming mismatch described above. | Not a configuration issue; see the Known Issue note above. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks, quarantines, or changes state anywhere. For containment based on what you find here, use a separate response integration for the relevant firewall/EDR product.