Purpose
This guide explains how to configure the Trapmine Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, run a wide range of endpoint containment, forensic-collection, and Android-device actions against Trapmine-managed endpoints directly from a Logsign Incident. This is Logsign's largest EDR-style Response integration by method count (33 methods): reboot/shutdown, process/thread/file/registry actions, network isolation, forensic artifact collection (running processes, memory injections, startup entries, PowerShell history, scheduled tasks, active connections, a short PCAP capture), a quick malware scan, and a separate set of Android mobile-device actions (wipe, lock, disable camera/Wi-Fi, reboot, uninstall an app).
Prerequisites
- A Trapmine management console with API access enabled and reachable from the Logsign server.
- A Trapmine API key.
- Use least privilege. If Trapmine supports scoped API keys, grant only what this integration needs (endpoint containment and forensic collection) rather than full administrative access.
Step 1: Obtain a Trapmine API Key
- Log in to the Trapmine management console with an administrator account.
- Navigate to the API key management area (the exact menu path varies by Trapmine version and was not independently verified during this research) and generate/copy an API key.
- Note the console's base host address.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Trapmine, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Trapmine device in Logsign. |
| Host | Yes | Base URL of your Trapmine console. |
| Api Key | Yes | Your Trapmine API key from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
Once configured, the following actions are available from an Incident, Alarm, or Action Rule. Most take a device argument (the target endpoint) and an optional user_id.
Power and process control
- reboot-computer / shutdown-computer — reboot or shut down a device.
- kill-process — kills a process by PID.
- kill-threads — kills a list of thread IDs.
File and registry actions
- delete-file — deletes a named file.
- delete-registry — deletes a registry key/value.
- clear-quarantine — clears the endpoint's local quarantine.
Network isolation
- network-isolation-enable (Containment) / network-isolation-disable (Recovery) — isolate or restore network access on the endpoint.
Search and forensic collection
- search-process-by-hash / search-process-by-name — search running processes by an indicator.
- search-file-by-hash / search-file-by-name — search files by an indicator.
- search-mutex-and-event — search mutex/event objects.
- search-registry-values — search registry values by an indicator.
- collect-running-processes, collect-memory-injection, collect-startup-entries, collect-powershell-history, collect-device-drivers, collect-installed-applications, collect-wmi-persistence, collect-scheduled-tasks, collect-active-connections — each collects the named category of forensic artifact from the endpoint.
- collect-pcap-dump-1-minute — captures one minute of network traffic on the endpoint.
- start-quick-malware-scan — triggers a quick AV/malware scan.
Android device actions
These take an x-agent-guid argument (the target Android device's agent identifier) instead of device.
- android-wipe-data — factory-wipes the device. Irreversible; use with caution.
- android-lock-screen — locks the device screen.
- android-disable-camera / android-disable-wi-fi — disables the camera or Wi-Fi.
- android-reboot — reboots the device.
- android-uninstall-apk-by-package-name — uninstalls an app by package name (arg: indicator).
Async results
- get-hunting-results — fetches results of a prior hunting/collection action via its result URL.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued, and confirm it has not been revoked in the Trapmine console. |
| 403 Forbidden | The API key does not have permission for the action being called. | Confirm the API key's scope in Trapmine covers the containment/collection actions you intend to use. |
| 429 Too Many Requests | Trapmine enforces API rate limits. | Reduce the frequency of automated actions, especially bulk collection or search calls. |
| Action targets the wrong endpoint or fails to find it | Wrong device (or x-agent-guid for Android) identifier. | Confirm the device identifier bound to the action matches the actual Trapmine-managed endpoint. |
Notes and Limits
- android-wipe-data is destructive and irreversible. Consider restricting which analysts or automation rules can call it, separately from the other containment actions.
- The exact console navigation path for generating an API key was not independently verified against a live Trapmine console during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.