Purpose
This guide explains how to configure the STM CyThreat Response integration in Logsign USO, so that an analyst (or an action rule) can look up IP, file hash, and domain reputation/context, and query CVE/vulnerability data by product or by CPE identifier, directly from a Logsign Incident. STM CyThreat is a threat-intelligence platform from the Turkish company STM (Savunma Teknolojileri Mühendislik). This is a read-only threat-intelligence lookup integration; it has no blocking/containment methods, only Analysis-type lookups.
Prerequisites
- An STM CyThreat account/subscription with API access.
- An API token and API password issued by STM for your account.
Step 1: Obtain Your STM CyThreat API Credentials
- Contact STM (or log in to your STM CyThreat account, if self-service credential generation is available) to obtain your API token and API password.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for STM CyThreat, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| Device Name | Yes | Free-text label identifying this STM CyThreat device in Logsign. |
| Url | Yes | STM CyThreat API address. Defaults to https://cti.stm.com.tr; only change it if STM instructs you to use a different endpoint. |
| Api Token | Yes | Your STM CyThreat API token from Step 1. Stored encrypted at rest. |
| Api Password | Yes | Your STM CyThreat API password from Step 1. Stored encrypted at rest. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
Click Create to save the device.
Available Methods
- get_ip_details — reputation/context lookup for an IP. Arg: ip_address (required).
- get_hash_details — reputation lookup for a file hash. Arg: hash (required).
- get_domain_details — reputation/context lookup for a domain. Arg: domain (required).
- get_vulnerabilities_by_product — CVE/vulnerability lookup by vendor, product, and version. Args (all required): vendor, product, version.
- get_cpe_details — CPE (Common Platform Enumeration) detail lookup. Arg: cpe (required). Known issue: a code bug currently sends this request to the same endpoint used by get_vulnerabilities_by_product instead of a dedicated CPE lookup endpoint, and does not forward the cpe value correctly; this method does not currently return usable CPE details. Do not rely on it until this is fixed.
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| 401/403 error | Wrong Api Token or Api Password. | Re-enter both fields exactly as issued by STM. |
| 429 Too Many Requests | STM CyThreat enforces API rate limits based on your subscription. | Reduce the frequency of automated lookups. |
Notes and Limits
- This integration is entirely read-only threat intelligence; it has no method to block, quarantine, or otherwise change state anywhere, unlike most other "Response" integrations in Logsign. Use a separate containment-capable integration if you need to act on what this returns.
- Known issue: get_cpe_details currently does not work correctly due to a code bug (it queries the wrong backend endpoint). A fix has been proposed to Logsign engineering. The other four methods (get_ip_details, get_hash_details, get_domain_details, get_vulnerabilities_by_product) are unaffected.