Purpose
This guide explains how to configure the Malwation AIMA Response integration in Logsign USO, so that an analyst (or an action rule) can submit a file for sandbox analysis, and check the status or retrieve the result of a submission, directly from a Logsign Incident. This is a query/submission integration, not a containment integration.
Prerequisites
- A Malwation AIMA account with API access and an API key.
Step 1: Obtain Your Malwation AIMA API Key
- Log in to your Malwation AIMA account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Malwation AIMA, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this Malwation AIMA device in Logsign. |
| Host | Yes | Base URL of the Malwation AIMA API. Always include the https:// scheme explicitly; if you omit it, the integration silently connects over plain, unencrypted HTTP instead of failing or defaulting to HTTPS. |
| Api Key | Yes | Your Malwation AIMA API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- add-submission (Containment) — submits a file for sandbox analysis. Args required: environment (Windows 7 or Windows 10, x64), work_path (desktop, root, appdata, windows, or temp), timeout, and file (the integration does not validate this at the schema level, but it fails without a usable file); optional: is_public, mouse_simulation, enable_net.
- check-submission-status (Analysis) — checks the processing status of a submission. Arg: uuid (required, returned by add-submission).
- get-submission (Analysis) — fetches the full submission result (hashes, verdict level, file info) once ready. Arg: uuid (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your Malwation AIMA account. |
| get-submission returns "not ready" | The sandbox analysis has not finished yet. | Use check-submission-status first, and retry get-submission once the status indicates completion. |
Notes and Limits
- This integration only submits/reads sandbox analyses; it does not block or quarantine anything based on the results.
- Always enter the Host field with an explicit https:// prefix. If left without a scheme, the integration falls back to plain HTTP, sending your API key and submitted files unencrypted.