Purpose
This guide explains how to configure the ScopNET Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, block or unblock a network device/source, and list currently blocked devices, directly from a Logsign Incident. This is a NAC-style containment integration, configured under Settings > Integrations > Responses > +Device; it is separate from the existing ScopNET NAC data-collection integration, which brings ScopNET logs into Logsign.
Prerequisites
- A ScopNET NAC appliance with its API reachable from the Logsign server.
- A ScopNET API key.
- Use least privilege. Use an API key scoped to block/unblock and device-listing operations rather than a broader administrative key, if your ScopNET deployment supports scoped keys.
Step 1: Obtain a ScopNET API Key
- Log in to the ScopNET management console with an administrator account.
- Navigate to the API key management area (the exact menu path was not independently verified during this research) and generate/copy an API key.
- Note the ScopNET appliance's base URL.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Scopnet, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this ScopNET device in Logsign. |
| Host | Yes | Base URL of your ScopNET appliance. |
| Api Key | Yes | Your ScopNET API key from Step 1. Stored encrypted at rest. |
Click Create to save the device.
Available Methods
- block-request (Containment) — blocks/quarantines a device or source. Args required: name, source, reason; optional: filter_type (Daily or Hourly, defaults to Daily), duration.
- delete-block-request (Recovery) — removes an existing block. Args required: name, source, reason.
- get-blocked-devices (Analysis) — lists currently blocked devices, including device ID, host type, MAC, IP, hostname, detection time, and comments. Arg: detected_minute_before (optional).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in the ScopNET console. |
| delete-block-request fails to find the block | The name/source/reason values do not exactly match an existing block entry. | Use get-blocked-devices first to confirm the exact values of an active block before attempting to remove it. |
Notes and Limits
- This is a separate integration from ScopNET's data-collection (syslog) integration, which brings ScopNET NAC logs into Logsign; both can be configured independently.
- The exact console navigation path for generating an API key was not independently verified against a live ScopNET appliance during this research (not independently verified); the field names and method behavior above are taken directly from Logsign's integration code.