Purpose
This guide explains how to configure the PhishTank Response integration in Logsign USO, so that an analyst (or an action rule) can check whether a URL is a known phishing site directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration with a single method; it does not block or change state anywhere.
Prerequisites
- A PhishTank account and API key. PhishTank (operated by Cisco Talos) offers free registration for API access.
Step 1: Obtain Your PhishTank API Key
- Register for (or log in to) a PhishTank account.
- Open your account settings and copy your API key, and note your account username.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for PhishTank, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this PhishTank device in Logsign. |
| Username | Yes | Your PhishTank account username. |
| Apikey | Yes | Your PhishTank API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- check_url — checks whether a URL is a known phish in PhishTank's community-verified database. Arg: url.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong Username or Apikey. | Re-enter both fields exactly as shown in your PhishTank account. |
| 509/rate limit error | PhishTank enforces a request-per-hour limit for free accounts. | Reduce the frequency of automated lookups if you hit this repeatedly. |
Notes and Limits
- PhishTank's coverage depends on community submissions and verification; a "not found" result means the URL is not in PhishTank's database, not necessarily that it is safe.
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.