Purpose
This guide explains how to configure the SOCRadar Response integration in Logsign USO, so that an analyst (or an action rule) can fetch data-leak alarms and incident/alarm records from SOCRadar directly from a Logsign Incident. This is a query integration, not a containment integration; it does not block or change state anywhere. It is separate from the existing SOCRadar data-collection poller, which brings SOCRadar alerts into Logsign on a schedule; this Response integration is called on demand instead.
Prerequisites
- A SOCRadar account with API access: a Company ID and an API key.
Step 1: Obtain Your SOCRadar API Credentials
- Log in to your SOCRadar account.
- Open your account/API settings and note your Company ID and API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for SOCRadar, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this SOCRadar device in Logsign. |
| Host | Yes | SOCRadar API host address. |
| Api Key | Yes | Your SOCRadar API key from Step 1. Stored encrypted at rest. |
| Company Id | Yes | Your SOCRadar Company ID. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- get_leak — fetches data-leak alarms. Args (all required): limit, leak_type (CUSTOMER, EMPLOYEE, or "VIP EMPLOYEE"; defaults to CUSTOMER), start_date, end_date.
- get_incident — fetches incident/alarm records. Args (all required): limit, severity (INFO, LOW, MEDIUM, or HIGH; defaults to INFO), false_positive (boolean, defaults to true), start_date, end_date.
start_date and end_date must be given as YYYY-MM-DD HH:MM:SS (for example 2026-08-01 00:00:00), not ISO-8601 with a "T" separator; an ISO-formatted value fails to parse.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong Api Key or Company Id. | Re-enter both fields exactly as shown in your SOCRadar account. |
| 429 Too Many Requests | SOCRadar enforces API rate limits based on your plan. | Reduce the frequency of automated calls. |
| Empty results for a date range you expect data in | severity/leak_type filter excludes the records you're looking for, or false_positive defaults to true and is filtering results out. | Review the filter arguments (leak_type, severity, false_positive) against what you actually expect to see. |
Notes and Limits
- This is a separate integration from the SOCRadar data-collection poller (which brings SOCRadar alerts into Logsign automatically on a schedule); this Response integration is instead called on demand from an Incident or Action Rule. Both can be configured independently.
- This integration is read-only query; it never blocks or changes state anywhere.