Purpose
This guide explains how to configure the Have I Been Pwned (HIBP) Response integration in Logsign USO, so that an analyst (or an action rule) can look up details of a named data breach, list breaches affecting a domain, and list breaches for a specific email account directly from a Logsign Incident. This is a read-only lookup integration; it does not block or change state anywhere.
Prerequisites
- A Have I Been Pwned API key (a paid subscription; HIBP's account-search API is not free).
Step 1: Obtain Your HIBP API Key
- Subscribe to the HIBP API at haveibeenpwned.com/API/Key.
- Copy your API key once issued.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for HaveIBeenPwned, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this HIBP device in Logsign. |
| Host | Yes | HIBP API host (typically the standard haveibeenpwned.com API address). |
| Api Key | Yes | Your HIBP API key from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- getting_a_single_breached_site — fetches details of one named breach. Arg: name (required).
- getting_all_breached_sites_in_the_system — lists all breaches recorded for a domain. Arg: domain (required).
- getting_all_breaches_for_an_account — lists breaches associated with a specific email/account. Arg: account (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or expired Api Key. | Re-enter the Api Key exactly as issued, and confirm your HIBP subscription is active. |
| 429 Too Many Requests | HIBP enforces a strict rate limit (typically one request per a fixed interval) per API key. | Reduce the frequency of automated lookups, especially for getting_all_breaches_for_an_account, which is the most rate-limited endpoint. |
Notes and Limits
- This integration is read-only lookup; it never blocks or changes state anywhere. Consider privacy implications before wiring account-breach lookups into automated correlation rules that run against real user email addresses at scale.