Purpose
This guide explains how to configure the IPVoid Response integration in Logsign USO, so that an analyst (or an action rule) can check an IP address against IPVoid's (APIVoid) blacklist/reputation database directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration with a single method; it does not block or change state anywhere.
Prerequisites
- An APIVoid account (IPVoid's parent service) with an API key and sufficient API credits for the IP reputation check.
Step 1: Obtain Your APIVoid API Key
- Log in to your APIVoid account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for IPVoid, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this IPVoid device in Logsign. |
| Api Key | Yes | Your APIVoid API key from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- check — IP reputation/blacklist check across IPVoid's aggregated blacklist sources. Arg: ip (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your APIVoid account. |
| Error mentioning insufficient credits | Your APIVoid account has run out of API credits for the billing period. | Check your APIVoid account's remaining credit balance and plan. |
| 429 Too Many Requests | APIVoid enforces API rate limits based on your plan. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.