Purpose
This guide explains how to configure the Any.Run Response integration in Logsign USO, so that an analyst (or an action rule) can submit a URL for interactive sandbox analysis, and fetch prior analysis history and reports, directly from a Logsign Incident. This is a query/submission integration, not a containment integration: it submits samples for detonation and reads back results, it does not block or change state anywhere else.
Prerequisites
- An Any.Run account with API access (a paid plan tier is typically required for API access; confirm with Any.Run that your subscription includes it).
- An Any.Run API key.
Step 1: Obtain Your Any.Run API Key
- Log in to your Any.Run account.
- Open your account/API settings page and generate or copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Any.Run, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Any.Run device in Logsign. |
| Api Key | Yes | Your Any.Run API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- get_analysis_history — lists your account's analysis history. No args.
- get_url_analysis — submits a URL for interactive sandbox analysis. Arg: url. Not enforced as required by the configuration schema, but the call fails without it; always provide a value.
- get_report — fetches an analysis report for a given task. Arg: task_id (required). This method polls asynchronously (Any.Run analysis takes time to complete); Logsign checks back periodically (default every 60 seconds) until the report is ready.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your Any.Run account settings. |
| 403 Forbidden on get_url_analysis or get_report | Your Any.Run plan does not include API access, or does not include the specific analysis feature being called. | Confirm with Any.Run that your subscription tier includes API access. |
| 429 Too Many Requests | Any.Run enforces API rate limits based on your subscription tier. | Reduce the frequency of automated submissions and lookups. |
| get_report keeps returning "not ready" | Normal while the sandbox analysis is still running. | Wait for the analysis to complete; Any.Run sandbox runs typically take a few minutes. |
Notes and Limits
- This integration only submits/reads sandbox analyses; it does not block or quarantine anything based on the results. Use a separate response integration for any containment action you want to trigger from an Any.Run verdict.