Purpose
This guide explains how to configure the urlscan.io Response integration in Logsign USO, so that an analyst (or an action rule) can submit a URL for scanning, search prior scans by domain, and fetch a scan's result directly from a Logsign Incident. This is a query/submission integration, not a containment integration.
Prerequisites
- A urlscan.io account with an API key.
Step 1: Obtain Your urlscan.io API Key
- Log in to your urlscan.io account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for urlscan.io, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this urlscan.io device in Logsign. |
| Api Key | Yes | Your urlscan.io API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- scan — submits a URL for scanning. Arg: url (required).
- search — searches previous scans by domain. Arg: domain (required).
- result — fetches a scan's result by its UUID (returned by scan). Arg: uuid (required).
Typical usage is to call scan, note the returned UUID, then call result once scanning completes (urlscan.io scans typically take under a minute, but this integration does not automatically poll; you may need to call result again if the first attempt returns "not ready").
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your urlscan.io account. |
| 429 Too Many Requests | urlscan.io enforces rate limits based on your account tier. | Reduce the frequency of automated scan submissions. |
| result returns nothing shortly after scan | The scan has not finished processing yet. | Retry result after a short delay. |
Notes and Limits
- Every scan submitted through this integration is always public on urlscan.io, regardless of your urlscan.io account's own default visibility setting. Do not scan URLs that contain sensitive tokens, internal hostnames, or other information you would not want visible to anyone on urlscan.io.
- This integration does not block or change state anywhere; it only submits and reads scans.