Purpose
This guide explains how to configure the PassiveTotal (RiskIQ) Response integration in Logsign USO, so that an analyst (or an action rule) can pull general, malware-related, and OSINT enrichment data, plus WHOIS lookups, for a domain or IP directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration; it does not block or change state anywhere.
Prerequisites
- A PassiveTotal (RiskIQ / Microsoft Defender Threat Intelligence) account with API access, and an API key.
Step 1: Obtain Your PassiveTotal Credentials
- Log in to your PassiveTotal account.
- Open your account/API settings page and note your account Username and generate/copy your API Key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for PassiveTotal, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this PassiveTotal device in Logsign. |
| Username | Yes | Your PassiveTotal account username/email. |
| Key | Yes | Your PassiveTotal API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- enrichment_data — general enrichment data for a domain/IP. Arg: query (required).
- enrichment_malware — malware-related enrichment for a domain/IP. Arg: query (required).
- enrichment_osint — OSINT-sourced enrichment for a domain/IP. Arg: query (required).
- whois — WHOIS lookup. Args: query, field (both required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Username or Key. | Re-enter both fields exactly as shown in your PassiveTotal account settings. |
| 429 Too Many Requests | PassiveTotal enforces API rate/quota limits per subscription tier. | Reduce the frequency of automated lookups, or check your plan's quota. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.