Purpose
This guide explains how to configure the Cisco Threat Grid Response integration in Logsign USO, so that an analyst (or an action rule) can check the processing state of submitted samples and search Threat Grid's entity database (by IP, domain, or artifact) directly from a Logsign Incident. This is a read/query integration, not a containment integration.
Prerequisites
- A Cisco Threat Grid account (or Cisco Secure Malware Analytics, the current product name) with an API key.
- Knowledge of which Threat Grid region your account is hosted in (EU or global/US), since this must be selected explicitly in Logsign.
Step 1: Obtain Your Threat Grid API Key
- Log in to your Cisco Threat Grid / Secure Malware Analytics portal.
- Open your account settings and copy your API key.
- Note which region your account is hosted in (the portal's own URL will indicate this, for example a panacea.threatgrid.eu vs panacea.threatgrid.com address).
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Cisco Threat Grid, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Threat Grid device in Logsign. |
| Api Key | Yes | Your Threat Grid API key from Step 1. Stored encrypted at rest. |
| Root Url | Yes | Select the region matching your account: https://panacea.threatgrid.eu or https://panacea.threatgrid.com. Selecting the wrong region will cause every call to fail even with a correct API key. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- check_state_of_sample — checks the processing state of one submitted sample. Arg: id (numeric).
- check_state_of_multiple_samples — checks the processing state of multiple samples.
- search_submissions — searches submitted samples. Args: q (query), state (one of wait, prep, run, proc, succ, fail).
- entity_search_by_ip — searches Threat Grid entities related to an IP. Args: query, term.
- entity_search_by_domain — searches entities related to a domain. Args: query, term.
- entity_search_by_artifact — searches entities related to an artifact. Args: query, term.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error, or "not found" on everything | Wrong Root Url selected for your account's actual region. | Confirm which Threat Grid region your account is hosted in (check the URL you use to log in to the portal) and select the matching Root Url. |
| 401 Unauthorized with the correct region selected | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your Threat Grid account settings. |
| 429 Too Many Requests | Threat Grid enforces API rate limits based on your license tier. | Reduce the frequency of automated calls. |
Notes and Limits
- This integration does not include a method to submit new samples for analysis; it only checks state of existing submissions and searches the entity database. If you need to submit samples, that must be done through the Threat Grid portal or another mechanism outside this integration.
- This integration is read/query only; it never blocks or changes state anywhere.