Purpose
This guide explains how to configure the Malwation AIMA Response integration in Logsign USO, so that an analyst (or an action rule) can check the status or retrieve the result of a sandbox submission directly from a Logsign Incident. This is a query integration, not a containment integration.
Prerequisites
- A Malwation AIMA account with API access and an API key.
Step 1: Obtain Your Malwation AIMA API Key
- Log in to your Malwation AIMA account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Malwation AIMA, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Malwation AIMA device in Logsign. |
| Host | Yes | Base URL of the Malwation AIMA API. If you omit the scheme, the integration defaults to https:// automatically. |
| Api Key | Yes | Your Malwation AIMA API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- check-submission-status (Analysis): checks the processing status of a submission. Arg:
uuid(required). - get-submission (Analysis): fetches the full submission result (hashes, verdict level, file info) once ready. Arg:
uuid(required).
File-submission (add-submission) is not available through this integration. To submit a file for sandbox analysis, use the Malwation AIMA console or API directly, then use the methods above in Logsign to track and retrieve the result with the returned uuid.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your Malwation AIMA account. |
| get-submission returns "not ready" | The sandbox analysis has not finished yet. | Use check-submission-status first, and retry get-submission once the status indicates completion. |
Notes and Limits
- This integration only reads sandbox analysis results; it does not submit files, and it does not block or quarantine anything based on the results.
- The Host field's scheme defaults to
https://when omitted. Entering the scheme explicitly is still recommended for clarity.