Purpose
This guide explains how to configure the Trend Micro TippingPoint Response integration in Logsign USO, so that Incidents and Alarms can automatically, or an analyst can manually, block a malicious IP through the TippingPoint Security Management System (SMS) reputation database and quarantine or release an endpoint. This is a Response (action) integration, configured under Settings > Integrations > Responses > +Device.
This replaces an older, SOAR-era "Trend Micro Security Management System" package that had no product-side manifest and was never actually reachable from Settings > Integrations > Responses; this TippingPoint integration is the first version of this connector that is visible and configurable in the product.
Prerequisites
- A Trend Micro TippingPoint SMS (Security Management System) instance, reachable from Logsign over HTTPS.
- An SMS API Key with permission to manage the reputation database (add/delete entries) and issue quarantine/unquarantine actions.
Step 1: Obtain an SMS API Key
In the TippingPoint SMS admin console, generate an API key for a user with reputation database and quarantine management permissions. Consult your TippingPoint SMS documentation or administrator for the exact steps in your SMS version; this key is sent by Logsign as the X-SMS-API-KEY request header on every call.
Step 2: Configure the Integration in Logsign USO
In Logsign USO, go to Settings > Integrations > Responses, search for Trend Micro TippingPoint, click Configure then +Device, and fill in:
| Field | Required | Description |
|---|---|---|
| URL | Yes | Base URL of the TippingPoint SMS instance (for example https://sms.yourcompany.com). |
| API Key | Yes | The SMS API key from Step 1. Stored encrypted at rest, sent as the X-SMS-API-KEY header. |
| Insecure Skip Verify | Yes | Disables TLS certificate validation on Logsign's outbound calls when enabled. Defaults to on; leave off unless you have a specific reason to keep it enabled. |
| Proxy URL | No | Outbound proxy to reach the SMS instance through, if required by your network. |
Click Create to save the device. Logsign verifies the connection with an smsAdmin/info?request=version call.
Available Methods
- add-reputation-entry (Containment): adds an IP to the SMS reputation database as a blacklist entry. Args:
ip(required),tag_data(optional, defaults toBlackList,<ip>if left blank),expire_time(required: 30 min / 1, 3, 6, 12 hour / 1 day / 1 week / 1 month / Permanent). Skips the call and reportsalready_exists: trueif the IP already carries the same tag data. Supports auto-expiry: when a non-permanentexpire_timeis set, Logsign automatically calls delete-reputation-entry once it elapses. - delete-reputation-entry (Recovery): removes an IP from the reputation database. Args:
ip(required). Deletion always uses SMS criteriaentry(only the given IP's entries), never the SMS "user" or "all" scopes, so it cannot wipe unrelated parts of the reputation database. No-ops (returnsdeleted: false) if the IP is not present. - quarantine (Containment): quarantines an endpoint IP under an SMS quarantine policy. Args:
ip(required),policy(required),timeout(optional). - unquarantine (Recovery): releases an endpoint IP from quarantine. Args:
ip(required),policy(required),timeout(optional).
Troubleshooting
| Symptom | Likely cause | What to check |
|---|---|---|
| Test / any call fails immediately | Wrong URL, or the API key is missing, invalid, or lacks permission. | Re-verify the URL and API Key fields; confirm the SMS user behind the key has reputation database and quarantine permissions. |
| add-reputation-entry reports already_exists even after you expected a fresh add | The IP already carries an entry with the same tag/category and value. | This is expected behavior, not an error. The integration avoids sending duplicate entries to the SMS. |
| quarantine/unquarantine fails | The policy name does not exist on the SMS, or the endpoint IP is not currently manageable under that policy. | Confirm the exact policy name in the SMS console and that the target IP is a valid quarantine candidate. |
Notes and Limits
- All calls go to the SMS's REST-style query endpoints (
/repEntries/add,/repEntries/delete,/repEntries/query,/quarantine/quarantine,/quarantine/unquarantine) over HTTPS with the API key in the request header; no OAuth exchange is involved. - Before adding or deleting a reputation entry, Logsign queries the existing reputation database for that IP to avoid duplicate adds and no-op deletes.