Purpose
This guide explains how to configure the URLhaus (abuse.ch) Response integration in Logsign USO, so that an analyst (or an action rule) can look up threat information for a URL, a host, or a malware payload by MD5/SHA256 hash directly from a Logsign Incident. This is a read-only threat-intelligence lookup integration; it does not block or change state anywhere.
Prerequisites
- None required for basic lookups; URLhaus's public API can be used without an API key, though abuse.ch increasingly requires an Auth-Key for consistent access. If you have an abuse.ch Auth-Key, it is not requested as a separate field by this integration (see Notes below).
Step 1: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for URLhaus, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this URLhaus device in Logsign. |
| Url | Yes | URLhaus API base address. Defaults to https://urlhaus-api.abuse.ch; only change it if abuse.ch instructs you to use a different endpoint. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- url-information — threat info for a URL. Arg: url (required).
- host-information — threat info for a host. Arg: host (required).
- payload-information-md5 — malware payload info by MD5 hash. Arg: md5_hash (required).
- payload-information-sha256 — malware payload info by SHA256 hash. Arg: sha256_hash (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| Connection failure / timeout | Wrong Url, or network path from Logsign to abuse.ch is blocked. | Confirm the Url field is the correct URLhaus API endpoint and that outbound HTTPS from Logsign is allowed. |
| 401/403 error | abuse.ch has begun requiring an Auth-Key for this endpoint and this integration's current code does not send one. | This integration does not currently expose an Auth-Key field; if abuse.ch policy changes require one, this is a code change to raise with Logsign engineering, not something fixable from the configuration screen. |
| 429 Too Many Requests | abuse.ch enforces rate limits. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is read-only threat intelligence; it never blocks or changes state anywhere.
- abuse.ch has been progressively requiring an Auth-Key across its services; this integration's current code does not send one for URLhaus lookups. If you start seeing authentication failures that did not occur before, this may be the cause; confirm with Logsign support whether an Auth-Key field has since been added.