Purpose
This guide explains how to configure the URLVoid Response integration in Logsign USO, so that an analyst (or an action rule) can check a URL against URLVoid's (APIVoid) reputation/blacklist/risk-score database directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration with a single method; it does not block or change state anywhere.
Prerequisites
- An APIVoid account (URLVoid's parent service) with an API key and sufficient API credits.
Step 1: Obtain Your APIVoid API Key
- Log in to your APIVoid account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for URLVoid, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this URLVoid device in Logsign. |
| Api Key | Yes | Your APIVoid API key from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- check — URL reputation/blacklist/risk-score check across URLVoid's aggregated sources. Arg: url (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your APIVoid account. |
| Error mentioning insufficient credits | Your APIVoid account has run out of API credits for the billing period. | Check your APIVoid account's remaining credit balance and plan. |
| 429 Too Many Requests | APIVoid enforces API rate limits based on your plan. | Reduce the frequency of automated lookups. |
Notes and Limits
- This is a separate product from IPVoid, which checks IP addresses rather than URLs; both share the same APIVoid account/API key infrastructure but are configured as separate Logsign devices.
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.