Purpose
This guide explains how to configure the Cuckoo Sandbox Response integration in Logsign USO, so that an analyst (or an action rule) can submit a URL or file for sandbox analysis and retrieve a Cuckoo analysis report directly from a Logsign Incident. This is a query/submission integration against a self-hosted Cuckoo Sandbox instance, not a containment integration.
Prerequisites
- A self-hosted Cuckoo Sandbox instance with its REST API reachable from the Logsign server.
- An API token, if your Cuckoo deployment requires one (Cuckoo can be deployed with or without API authentication depending on configuration).
Step 1: Prepare Cuckoo Sandbox for API Access
- Confirm your Cuckoo Sandbox instance's REST API is enabled and reachable from the Logsign server.
- If your Cuckoo deployment uses an API token, note it.
- Note the Cuckoo instance's hostname and the port its API listens on.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Cuckoo Sandbox, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Cuckoo device in Logsign. |
| Host | Yes | Hostname of your Cuckoo Sandbox instance. |
| Port | Yes | Port the Cuckoo REST API listens on. |
| Api Token | No | API token, if your Cuckoo deployment requires one. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- get-url-report — submits a URL and fetches its Cuckoo analysis report. Arg: url (required). Polls asynchronously (default every 60 seconds) until the report is ready; result includes a score.
- get-file-report — submits a file and fetches its Cuckoo analysis report. Arg: file_path (required). Also polls asynchronously; result includes md5, sha1, sha256, and score.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| Connection failure / timeout | Wrong Host/Port, or the Cuckoo instance's API is not reachable from Logsign. | Confirm the Host and Port match your Cuckoo instance and that outbound access from Logsign to it is allowed. |
| 401/403 error | Wrong or missing Api Token, if your Cuckoo deployment requires one. | Confirm whether your Cuckoo instance requires API authentication, and if so, that the Api Token field is correctly populated. |
| Report never becomes ready | Analysis takes time depending on your Cuckoo instance's queue and available analysis VMs. | Confirm your Cuckoo instance has available analysis machines and is not backlogged; check the Cuckoo instance directly if reports consistently never complete. |
Notes and Limits
- This integration depends entirely on your own self-hosted Cuckoo Sandbox instance's availability and analysis capacity; it is not a hosted cloud service.
- This integration only submits/reads sandbox analyses; it does not block or quarantine anything based on the results.