Purpose
This guide explains how to configure the IP2Location Response integration in Logsign USO, so that an analyst (or an action rule) can look up IP geolocation and domain WHOIS information directly from a Logsign Incident. This is a read-only lookup integration; it does not block or change state anywhere.
Prerequisites
- An IP2Location.io account with an API key.
Step 1: Obtain Your IP2Location API Key
- Log in to your IP2Location.io account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for IP2Location, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this IP2Location device in Logsign. |
| Api Key | Yes | Your IP2Location.io API key from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- ip_geolocation — geolocation lookup for an IP address. Arg: ip_address (required).
- domain_whois_query — WHOIS lookup for a domain. Arg: domain_name (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your IP2Location.io account. |
| Error mentioning insufficient credits | Your IP2Location.io account has run out of API query credits. | Check your account's remaining credit balance and plan. |
| 429 Too Many Requests | IP2Location.io enforces API rate limits based on your plan. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is read-only lookup; it never blocks or changes state anywhere.