Purpose
This guide explains how to configure the Red Sift OnDMARC Response integration in Logsign USO, so that an analyst (or an action rule) can list, add, and remove monitored domains, and run DMARC analysis and sending-source lookups for a domain, directly from a Logsign Incident. This is an email-authentication monitoring/management integration, configured under Settings > Integrations > Responses > +Device.
Prerequisites
- A Red Sift OnDMARC account with API access and an API key.
Step 1: Obtain Your OnDMARC API Key
- Log in to your Red Sift OnDMARC account.
- Open your account/API settings and copy your API key.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for OnDMARC, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this OnDMARC device in Logsign. |
| Host | Yes | OnDMARC API address. Defaults to https://api.ondmarc.com; only change it if Red Sift instructs you to use a different endpoint. |
| Api Key | Yes | Your OnDMARC API key from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- get_domains (Analysis) — lists domains currently monitored by OnDMARC. No args.
- add_domain (Containment) — adds a domain for DMARC monitoring. Arg: domain (required).
- delete_domain (Eradication) — removes a domain from monitoring. Arg: domain (required).
- domain_analyzer — runs/fetches DMARC analysis for a domain. Arg: domain (required).
- domain_sources_details — fetches details of email-sending sources for a domain (useful for identifying legitimate vs. unauthorized senders). Arg: domain (required).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong or revoked Api Key. | Re-enter the Api Key exactly as issued in your OnDMARC account. |
| 429 Too Many Requests | Red Sift enforces API rate limits based on your plan. | Reduce the frequency of automated calls. |
| add_domain fails | The domain is already being monitored, or your OnDMARC plan has reached its domain limit. | Use get_domains to confirm the domain is not already added, and check your plan's domain quota. |
Notes and Limits
- delete_domain removes DMARC monitoring for that domain entirely; confirm this is intended before calling it, since re-adding a domain does not restore prior analysis history.
- The Analysis/Containment/Eradication labels above group methods by what they practically do; the underlying integration definition tags several of these methods differently internally, so do not rely on that internal tag if you inspect the integration definition directly.