Purpose
This guide explains how to configure the Netsparker (Invicti) Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, browse scan agents/policies/websites, launch a new web application scan, and retrieve scan status/results/reports directly from a Logsign Incident. This is a query/scan-management integration, configured under Settings > Integrations > Responses > +Device.
Prerequisites
- A Netsparker Enterprise (Invicti) account with API access: a User ID and an API Token.
This integration connects to Netsparker's cloud service (netsparkercloud.com) and has no setting to point it at a self-hosted/on-premises Netsparker Enterprise instance. If your deployment is on-premises rather than cloud, confirm with Logsign support whether this integration can reach it before relying on it.
Step 1: Obtain Your Netsparker API Credentials
- Log in to your Netsparker Enterprise / Invicti account.
- Open your account/API settings and note your User ID and API Token.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Netsparker, click Configure then +Device, and fill in:
| Field | Description |
|---|---|
| Device Name | Free-text label identifying this Netsparker device in Logsign. |
| User Id | Your Netsparker User ID. |
| Api Token | Your Netsparker API Token. Stored encrypted at rest. |
The configuration schema does not formally mark either field as required, but both are functionally necessary for authentication; fill in both and click Create to save the device.
Available Methods
Discovery (agents, policies, profiles, websites)
- list-agents — lists scan agents (pagination).
- change-agent-status — changes an agent's status. Args: agent_id (required), status.
- list-scan-policies, get-policy-details-by-name (arg: policy_name, required) — list/inspect scan policies.
- list-agent-groups — lists agent groups.
- list-scan-profiles, get-scan-profile-details-by-name (arg: profile_name, required) — list/inspect scan profiles.
- list-websites, get-websites-by-name (arg: website_name_or_url, required) — list/inspect target websites.
- list-website-groups, get-website-group-by-name (arg: website_name, required) — list/inspect website groups.
Scans
- list-scans, list-scheduled-scans — list scans / scheduled scans.
- get-scans-by-website — lists scans for a website. Args required: website_url, target_url.
- start-scan (Containment/Analysis) — launches a new scan. Arg: scan_type (required).
- get-scan-status / get-scan-result — fetch status/result of a scan. Arg: scan_id (required).
- get-scan-report — generates/fetches a scan report. Args required: scan_id, type; optional: content_format, exclude_response_data, only_confirmed_issues, only_unconfirmed_issues, exclude_addressed_issues.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Missing or wrong User Id/Api Token. | Confirm both fields are filled in and match your Netsparker account exactly. |
| 429 Too Many Requests | Netsparker Cloud enforces API rate limits based on your plan. | Reduce the frequency of automated calls. |
| start-scan fails to find the target | The website/target is not registered in Netsparker, or scan_type is invalid. | Use list-websites/get-websites-by-name to confirm the target is registered before starting a scan. |
Notes and Limits
- Only scan websites you are authorized to scan. Launching web application scans against systems without authorization may violate policy or law depending on your jurisdiction and the target's ownership.
- Scans can take a significant amount of time depending on the target and scan policy; use get-scan-status to poll before expecting get-scan-result/get-scan-report to return complete data.