Purpose
This guide explains how to configure the Scamalytics Response integration in Logsign USO, so that an analyst (or an action rule) can look up an IP's fraud/proxy risk score directly from a Logsign Incident. This is a read-only lookup integration with a single method; it does not block or change state anywhere.
Prerequisites
- A Scamalytics account with API access: a hostname (subdomain assigned to your account), a username, and an API key.
Step 1: Obtain Your Scamalytics API Credentials
- Log in to your Scamalytics account.
- Open your account/API settings and note your assigned API hostname, username, and API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Scamalytics, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Scamalytics device in Logsign. |
| Hostname | Yes | Your account-specific Scamalytics API hostname. |
| Username | Yes | Your Scamalytics account username. |
| Api Key | Yes | Your Scamalytics API key. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- check — fraud/proxy risk score lookup for an IP. Arg: ip (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong Hostname, Username, or Api Key. | Re-enter all three fields exactly as shown in your Scamalytics account. |
| 429 Too Many Requests | Scamalytics enforces API rate limits based on your plan. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is read-only lookup; it never blocks or changes state anywhere.