Purpose
This guide explains how to configure the MalwareBazaar (abuse.ch) Response integration in Logsign USO, so that an analyst (or an action rule) can look up malware sample information by hash, tag, or signature/family directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration; it does not block or change state anywhere.
Prerequisites
- An abuse.ch account with a MalwareBazaar Auth-Key. As of recent abuse.ch policy, an Auth-Key is required for API access even though MalwareBazaar's data itself is free to use; register at abuse.ch to obtain one.
Step 1: Obtain Your Auth-Key
- Register for (or log in to) an abuse.ch account.
- Generate an Auth-Key for API access from your abuse.ch account settings.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for MalwareBazaar, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this MalwareBazaar device in Logsign. |
| Auth Key | Yes | Your abuse.ch Auth-Key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- query_malware — looks up a sample by hash. Arg: hash (required).
- query_tag — looks up samples by tag. Arg: tag (required).
- query_signature — looks up samples by malware signature/family name. Arg: signature (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or missing Auth Key. | Confirm your abuse.ch Auth-Key is entered exactly and is still valid. |
| 429 Too Many Requests | abuse.ch enforces rate limits on the Auth-Key tier. | Reduce the frequency of automated lookups. |
| No results for a known-bad hash | The sample was not submitted to/indexed by MalwareBazaar (it only covers samples submitted to it, not a universal malware database). | Cross-check against another threat-intel source; MalwareBazaar's coverage depends on community submissions. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.