category: Analytics & SIEM
sectionorder:
- Connect
- Collect
provider: Logsign
commonfields:
  id: LogsignSiem
  version: -1
configuration:
- additionalinfo: LogsignSiem API URL
  display: Server URL (e.g. https://192.168.0.1)
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: The API Key to use for connection
  display: API Key
  name: apikey
  required: true
  type: 4
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: First Fetch Time (e.g 1 hour)
  defaultvalue: 1 hour
  display: First Fetch Time (default 1 hour)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: Maximum number of incidents per fetch (Recommended less than 200)
  defaultvalue: '50'
  display: Max Fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  advanced: true
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- additionalinfo: 'Note: When a space character is used, it must be enclosed in single quotes. Query example: Alert.Info:''Registry Object Changed'''
  defaultvalue: Alert.Category:*
  display: Query
  name: query
  type: 0
  required: false
  section: Collect
description: Logsign SIEM provides to collect and store unlimited data, investigate and detect threats, and respond automatically.
display: LogsignSiem
name: LogsignSiem
script:
  commands:
  - arguments:
    - description: Query Description.
      name: query
      required: true
    - description: 'Group Column.'
      name: grouped_column
      required: true
    - auto: PREDEFINED
      description: Criteria Value.
      name: criteria
      predefined:
      - unique
      - value
      required: true
    - description: Time Frame (e.g 1 hour).
      name: time_frame
      required: true
    description: Query for columns.
    name: logsign-get-columns-query
    outputs:
    - contextPath: LogsignSiem.Columns
      description: Column list returned as the result of the query.
      type: Unknown
  - arguments:
    - description: Query.
      name: query
      required: true
    - description: Grouped Column.
      name: grouped_column
      required: true
    - auto: PREDEFINED
      description: Criteria Value.
      name: criteria
      predefined:
      - unique
      - value
      required: true
    - description: Time Frame (e.g 1 day).
      name: time_frame
      required: true
    description: Get Count Query.
    name: logsign-get-count-query
    outputs:
    - contextPath: LogsignSiem.Count
      description: Count number returned as the result of the query.
      type: Number
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- No tests (auto formatted)
fromversion: 6.0.0
defaultmapperin: LogsignSIEM Mapper
defaultclassifier: LogsignSIEM Classifier