Purpose
This guide explains how to configure the Maltiverse Response integration in Logsign USO, so that an analyst (or an action rule) can look up threat/reputation data for an IP, hostname, or URL, and run full-text searches against Maltiverse's indicator database, directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration; it does not block or change state anywhere.
Prerequisites
- A Maltiverse account with API access and a Bearer token.
Step 1: Obtain a Maltiverse API Token
- Log in to your Maltiverse account.
- Open your account/API settings and copy your Bearer token.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Maltiverse, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Maltiverse device in Logsign. |
| Token | Yes | Your Maltiverse Bearer token from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- get-ip — reputation/threat lookup for an IP. Arg: ip (required).
- get-hostname — reputation/threat lookup for a hostname. Arg: hostname (required).
- get-url — reputation/threat lookup for a URL. Arg: url (required).
- search — full-text search across Maltiverse indicators. Args: query (required); from, size, sort, range, range_field (optional). Known issue: a code bug currently drops the from value before it reaches Maltiverse, so pagination beyond the first page of results does not work; the other optional arguments are unaffected.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or expired Token. | Re-enter the Token exactly as issued, and confirm it has not expired in your Maltiverse account. |
| 429 Too Many Requests | Maltiverse enforces API rate limits. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.
- Known issue: the search method's from argument (used for paging through results) is not currently sent to Maltiverse due to a code bug. A fix has been proposed to Logsign engineering; until it ships, search always returns results starting from the first page regardless of the value you provide.