Purpose
This guide explains how to configure the MxToolbox Response integration in Logsign USO, so that an analyst (or an action rule) can run MxToolbox lookup commands (DNS, blacklist, mail-server checks, and similar) and manage monitors directly from a Logsign Incident. This is a read-only lookup integration; it does not block or change state anywhere.
Prerequisites
- An MxToolbox account with API access and an API key.
Step 1: Obtain Your MxToolbox API Key
- Log in to your MxToolbox account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for MxToolbox, click Configure then +Device, and fill in:
| Field | Description |
|---|---|
| Device Name | Free-text label identifying this MxToolbox device in Logsign. |
| Api Key | Your MxToolbox API key from Step 1. Not enforced as required by the configuration schema, but functionally necessary; leave it blank and calls will fail authentication. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- lookup — runs an MxToolbox lookup command (for example a DNS or blacklist check). Args: command, argument (required); port (optional).
- monitor — creates or queries a monitor. Args: tag, name, command (all optional).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Missing or wrong Api Key. | Confirm the Api Key field is filled in and matches your MxToolbox account exactly. |
| 429 Too Many Requests | MxToolbox enforces API rate limits based on your plan. | Reduce the frequency of automated lookups. |
| lookup fails with an unrecognized command error | The command value does not match a valid MxToolbox lookup command. | Confirm the command argument matches one of MxToolbox's documented lookup command names. |
Notes and Limits
- This integration is read-only lookup; it never blocks or changes state anywhere.