Purpose
This guide explains how to configure the FileOrbis Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, enable, disable, or delete a FileOrbis user account directly from a Logsign Incident. This is an identity-containment integration, configured under Settings > Integrations > Responses > +Device: its methods act on user account state, not on files or network traffic.
Prerequisites
- A FileOrbis deployment with its management API reachable from the Logsign server.
- A client key/secret pair with permission to manage user accounts.
- Use least privilege. Scope the API client to user-management only if your FileOrbis deployment supports scoped API clients.
Step 1: Obtain FileOrbis API Credentials
- Log in to your FileOrbis management console with an administrator account.
- Create (or designate) an API client for Logsign to use, and note its Client Key and Client Secret.
- Note the FileOrbis instance's hostname, and whether it is reachable over http or https.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for FileOrbis, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this FileOrbis device in Logsign. |
| Protocol | Yes | http or https. |
| Host | Yes | Hostname of your FileOrbis instance. |
| Client Key | Yes | The API client key from Step 1. Stored encrypted at rest. |
| Client Secret | Yes | The API client secret from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- enable-user (Recovery) — enables a FileOrbis user account. Arg: user_id (required).
- disable-user (Containment) — disables a user account, blocking their access. Arg: user_id (required).
- delete-user (Containment) — deletes a user account. Arg: user_id (required). This is not reversible from Logsign; use disable-user instead if you may need to restore access later.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401 Unauthorized | Wrong Client Key/Client Secret. | Re-enter both fields exactly as issued in your FileOrbis management console. |
| 403 Forbidden | The API client does not have permission to manage user accounts. | Confirm the API client's assigned permissions in FileOrbis include user management. |
| Method fails to find the user | Wrong user_id. | Confirm the user_id matches an existing FileOrbis account. |
Notes and Limits
- delete-user is irreversible. Prefer disable-user for containment scenarios where you may need to restore the account later.
- The Recovery/Containment labels above group methods by what they practically do; the underlying integration definition tags all three methods the same way internally, so do not rely on that internal tag if you inspect the integration definition directly.