LogsignSiem
This Integration is part of the Logsign SIEM Pack.#
Supported versions
Supported Cortex XSOAR versions: 6.0.0 and later.
Logsign SIEM provides comprehensive visibility and control of your data lake by allowing security analysts to collect and store unlimited data, investigate and detect threats, and respond automatically.
This integration was integrated and tested with version 4.6.x of Logsign SIEM
Configure Logsign SIEM on Cortex XSOAR#
Navigate to Settings > Integrations > Servers & Services.
Search for Logsign SIEM.
Click Add instance to create and configure a new integration instance.
Parameter Description Required Server URL (e.g. https://192.168.0.1) Logsign SIEM API URL True API Key The API Key to use for connection True Trust any certificate (not secure) False Use system proxy settings False Last Run Time (ISO8601 format with UTC) Last run time format like '%Y-%m-%dT%H:%M:%SZ' True First Fetch Time (default 1 hour) First Fetch Time (e.g 1 hour) False isFetch False Max Fetch Maximum number of incidents per fetch (Recommended less than 200) False Click Test to validate the URLs, token, and connection.
Commands#
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
logsign-fetch-incidents#
Gets Incidents from Logsign SIEM
Base Command#
logsign-fetch-incidents
Input#
| Argument Name | Description | Required |
|---|---|---|
| last_run | Last Run Fomat: '%Y-%m-%dT%H:%M:%SZ'. Possible values are: . | Required |
| query | Lucene query support | Optional |
Context Output#
| Output Path | Type | Description |
|---|---|---|
| Logsign.Incidents.Severity.Name | String | Incident Severity |
| Logsign.Incidents.Time.Generated | date | Time Generation of incident |
| Logsign.Incidents.EventMap.Context | String | Context of Event |
| Logsign.Incidents.Event.Category | String | Category of triggered event |
| Logsign.Incidents.EventSource.IP | unknown | The eventsource addresses that are associated with the incident |
| Logsign.Incidents.Destination.IP | unknown | The destination addresses that are associated with the incident |
| Logsign.Incidents.Source.IP | unknown | The source addresses that are associated with the incident |
| Logsign.Incidents.Destination.Port | unknown | Destination Port |
| Logsign.Incidents.Source.Port | unknown | Source Port |
| Logsign.Incidents.Alert.Category | String | Category of Incident |
| Logsign.Incidents.Alert.Info | String | Incident Description |
| Logsign.Incidents.Alert.AlertUID | Number | ID of Incident |
| Logsign.Incidents.Alert.TriggerEventID | Number | Trigger Event ID |
| Logsign.Incidents.EventSource.HostName | String | The eventsource hostname that are associated with the incident |
Command Example#
!logsign-fetch-incidents last_run=2021-07-27T10:27:00Z
Context Example#
Human Readable Output#
logsign-get-columns-query#
Gets column values based on your lucene query
Base Command#
logsign-get-columns-query
Input#
| Argument Name | Description | Required |
|---|---|---|
| query | Query Description. | Required |
| grouped_column | Group Column . | Required |
| criteria | Criteria Value. Possible values are: unique, value. | Required |
| time_frame | Time Frame (e.g 1 hour). | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| LogsignSiem.Columns | Unknown | Column list returned as the result of the query |
Command Example#
!logsign-get-columns-query criteria="value" grouped_column="Source.IP" query="*" time_frame="1 day"
Context Example#
Human Readable Output#
Results#
columns 192.168.1.35,
192.168.1.17,
192.168.1.18,
192.168.1.5,
192.168.1.93
logsign-get-count-query#
Gets count of column values.
Base Command#
logsign-get-count-query
Input#
| Argument Name | Description | Required |
|---|---|---|
| query | Query. | Required |
| grouped_column | Grouped Column. | Required |
| criteria | Criteria Value. Possible values are: unique, value. | Required |
| time_frame | Time Frame. | Required |
Context Output#
| Path | Type | Description |
|---|---|---|
| LogsignSiem.Count | Number | Count number returned as the result of the query |
Command Example#
!logsign-get-count-query criteria="value" grouped_column="Source.IP" query="*" time_frame="1 day"
Context Example#
Human Readable Output#
Results#
count 785554