Purpose
This guide explains how to configure the ThreatFox (abuse.ch) Response integration in Logsign USO, so that an analyst (or an action rule) can search ThreatFox's IOC database by a general search term or by file hash directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration; it does not block or change state anywhere.
Prerequisites
- None strictly required for basic lookups; note the same abuse.ch Auth-Key caveat described below.
Step 1: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for ThreatFox, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this ThreatFox device in Logsign. |
| Url | Yes | ThreatFox API base address. Defaults to https://threatfox-api.abuse.ch; only change it if abuse.ch instructs you to use a different endpoint. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- search-ioc — searches ThreatFox's IOC database by a general search term. Arg: search_term (required).
- search-hash — searches ThreatFox's database by file hash. Arg: search_term (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| Connection failure / timeout | Wrong Url, or network path from Logsign to abuse.ch is blocked. | Confirm the Url field is the correct ThreatFox API endpoint and that outbound HTTPS from Logsign is allowed. |
| 401/403 error | abuse.ch has begun requiring an Auth-Key for this endpoint and this integration's current code does not send one. | This integration does not currently expose an Auth-Key field; if abuse.ch policy requires one, this is a code change to raise with Logsign engineering. |
| 429 Too Many Requests | abuse.ch enforces rate limits. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.
- abuse.ch has been progressively requiring an Auth-Key across its services (URLhaus, MalwareBazaar, ThreatFox); this integration's current code does not send one for ThreatFox lookups. If authentication failures appear where they did not before, confirm with Logsign support whether this has since been addressed.