Purpose
This guide explains how to configure the Nmap Response integration in Logsign USO, so that an analyst (or an action rule) can run an Nmap scan against a host or network directly from a Logsign Incident, using several of Nmap's standard scan profiles (intense, quick, ping, traceroute, script scan, and combinations). Unlike most Response integrations, Nmap runs locally, not against a vendor cloud API: there are no credentials to configure, since Nmap itself must be installed and reachable by the Logsign server (or the host running the integration).
Prerequisites
- Nmap installed and executable on the server that will run these scans (confirm with your Logsign deployment how/where this integration executes Nmap; this was not independently verified during this research and may depend on your specific installation).
- Network reachability from that server to the targets you intend to scan, and authorization to scan them. Only scan hosts and networks you are authorized to scan.
Step 1: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Nmap, click Configure then +Device, and fill in:
| Field | Description |
|---|---|
| Device Name | Free-text label identifying this Nmap device in Logsign. |
No credentials or connection fields are required for this integration; click Create to save the device.
Available Methods
All methods below take a host argument (the scan target) and an optional timeout.
- ping-scan — host discovery only, no port scan.
- quick-scan — fast scan of the most common ports.
- quick-scan-plus — quick scan with OS and version detection.
- quick-traceroute — traceroute to the host.
- regular-scan — Nmap's default scan profile.
- intense-scan — Nmap's "Intense scan" profile (thorough, slower).
- intense-scan-plus-udp — intense scan including UDP ports.
- intense-scan-all-tcp-ports — intense scan of all 65535 TCP ports.
- intense-scan-no-ping — intense scan without a host-discovery ping first (useful for hosts that block ICMP).
- script-scan — scan using Nmap's default NSE (scripting engine) scripts.
A separate scan-network method is also available for scanning a list of hosts/subnets against a list of ports in one call, instead of a single host. Args: ip_list (required) and port_list (optional).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| Scan never returns / times out | Nmap is not installed/reachable where the integration executes, or the target is unreachable/firewalled. | Confirm Nmap is installed on the executing host and that network access to the target exists; try a longer timeout value. |
| intense-scan-all-tcp-ports is very slow | Expected behavior; scanning all 65535 TCP ports takes significantly longer than the default top-ports scans. | Use a longer timeout, or prefer quick-scan/regular-scan when speed matters more than exhaustive coverage. |
Notes and Limits
- Only scan hosts and networks you are authorized to scan. Running Nmap scans against systems without authorization may violate policy or law depending on your jurisdiction and the target's ownership.
- Exactly where/how Logsign executes the underlying Nmap process (which host, what privileges) was not independently verified during this research (not independently verified); confirm with your Logsign deployment team if scans fail unexpectedly with no clear network-level cause.