Pulsedive FAQs
Answers to some of the most popular and frequently asked questions we get at Pulsedive.
Below are a few answers to some of the most popular and frequently asked questions about the Pulsedive Community platform:
- What does Pulsedive do?
- Who uses Pulsedive?
- What can I do for FREE?
- How can I get a free API key?
- What kinds of data can I find?
- What's on an IOC page?
- What’s the difference between scanning and submitting?
- Can you tell me more about these passive and active scans - and your infrastructure?
- How does Pulsedive risk scoring work?
- What kinds of data can Pulsedive users edit?
- How do you keep data recent and relevant?
- How are threats and feeds linked to indicators?
- What's on a Threat page?
- How can I use Explore?
- How do I use Analyze?
- Does Pulsedive integrate with [insert software here]?
- Which paid Pulsedive products are best for which use cases?
- What if I want a private version of Pulsedive’s platform just for myself/my team?
- Where can I learn more about Pulsedive?
What does Pulsedive do?
Pulsedive's community platform brings together known community threat intelligence into one place and vets that data to reduce noise and help security teams make determinations. We correlate observed IOCs not only by ASN or country but by more complex characteristics like HTTP headers and PTR records.
In other words, we ingest from user submissions and quality feeds. We then perform scans to provide a wealth of real-time contextual information on each indicator. This includes all the properties, linked indicators, risk factors, and risk scores you see on our indicator pages. We also deduplicate indicators, merge threat aliases, update news streams, and more to provide vetted, unique, and timely threat intelligence.
Check out Pulsedive Docs for more details about how we collect data.
Who uses Pulsedive?
Everyone can.
Our global community includes a wide range of users, from students to CISOs across sectors - and teams blue, red, and purple. A majority of users come from security analyst and engineering backgrounds, most often in security operations and, obviously, threat intelligence teams. However, we also support many home hobbyists, academic and independent researchers, students, and special use cases as well.
What can I do for FREE?
With a free account, you can search and/or scan any indicator and get back contextual intelligence, investigate threats, check out our source feeds, query, and filter across our entire database, stream the latest news/events, and more.
Simply put, many of the actions an individual researcher, hunter, analyst, or enthusiast might want to try out in a threat intelligence platform are already free. We even include an API key with every registered account.
If you have additional needs for yourself or your team, we have upgrades like:
- Individual Pro subscriptions, which come with more data in the same intuitive interface.
- Commercial API plans to flexibly integrate Pulsedive into your workflow.
- Commercial Feed plans for bulk download of vetted threat intelligence.
How can I get a free API key?
Every registered user has an API key. After registering a free account (https://pulsedive.com/register) and logging in, you can find your key on your account page. From there, check out our API Quickstart to authenticate your first request and start retrieving data - all in under five minutes.
What kinds of data can I find?
Indicators are the core intelligence objects in Pulsedive. When you submit or encounter an observable entity, such as a suspicious domain, Pulsedive processes and enriches it into an indicator object. For an overview of what an Indicator is and the types of data we collect, check out our Data Model - Indicators page.
For a detailed deep-dive on the types of data associated with indicators and examples, check out the Response section of our Indicator - Get By Value page in our API Reference. The same data is available via the UI in our Community Platform.
Threats are named higher-level entities that group and contextualize indicators. A threat might represent a malware family, an adversary group, or a campaign. Where an indicator tells you what Pulsedive observed, a threat tells you what that observation is part of. For an overview of what a Threat is and the types of data we collect, check out our Data Model - Threats page.
Feeds are curated collections of indicators sourced from third-party organizations, research projects, or automated intelligence pipelines. They answer a fundamental provenance question: where did this indicator come from, and who is tracking it? For an overview of what a Threat is and the types of data we collect, check out our Data Model - Feeds page.
What's on an IOC page?
There's a lot of information we collect and share with you on domains, IPs, and URLs. To get you started, here's an overview of how to read our IOC pages and all the potential types of data you might find on one.
What’s the difference between scanning and submitting?
In Pulsedive, you can scan without submitting. If an indicator is not already in our database, it means you can opt to perform a passive or active scan, retrieve, and review the data, but no data is permanently stored.
This is valuable for users who do not want or cannot share indicators publicly with the community. However, we encourage our users to submit when possible, so everyone can benefit from new threat intelligence.
Can you tell me more about these passive and active scans - and your infrastructure?
Pulsedive scans indicators directly to collect properties. All scans run from hardened, rotating proxies across multiple countries. There are two scan types:
- Passive: Lookups that do not interact directly with the target, including WHOIS, DNS, and metadata retrieval.
- Active: Direct outreach to the target using headless browser instrumentation, which intercepts HTTP requests, TLS certificate data, cookies, and other response data. Active scans are more comprehensive but generate more noise than passive scans.
To learn more about scanning through the API, visit Scan overview.
How does Pulsedive risk scoring work?
Risk is a shared vocabulary across all three entities in Pulsedive, but it works differently depending on the entity. Learn about the risk levels that Pulsedive uses and how risk rolls up from indicators into threat and feed summaries in our Risk Overview.
To learn how risk is determined and overridden on each entity, refer to the Indicators, Threats, and Feeds sections.
What kinds of data can Pulsedive users edit?
Basic account users can submit and scan indicators, as well as add comments to indicator and threat pages.
Our enrichment and evaluation process is designed to avoid false positives, but we do have a trusted group of Contributors, Researchers, and Admins with elevated permissions who can further vet and update data. Message us at support@pulsedive.com if you have questions or find an issue with our data.
How do you keep data recent and relevant?
Due to our many sources and unique user submissions, we are processing threat intelligence data that no one else has, every day.
Indicators are automatically aged out after a period of inactivity unless they reappear in one of our sources, are reported by users, or are reactivated by a Contributor or Admin. These retired indicators show a “Retired” risk rating and can be excluded in “Explore” queries if specified. However, users can search for an indicator that is retired and still see all of the historical data.
How are threats and feeds linked to indicators?
Some OSINT feeds occasionally have threat information listed in one of the fields or columns, and other feeds are dedicated to a specific threat, like Zeus Bad Domains or Phishtank. Pulsedive is configured to link all IOCs in these feeds to the relevant threat. Additionally, a limited set of vetted users with elevated permissions can link IOCs to threats upon submission, as well as edit IOCs to add or remove threats.
Explore how indicators, threats, and feeds connect in Pulsedive, including typed indicator links and cross-entity summaries on our Relationships page.
What's on a Threat page?
Threat pages cover overviews, news, IOCs, TTPs, and other relevant information regarding various threat types. Here's some of the information that can be found on our Threat pages.
How can I use Explore?
Our Explore query language enables users to search across our entire Community dataset of indicators and threats with Boolean logic and wildcards. You can search indicators with any combination of indicator value, type, risk, last seen timestamp, threat, feed, attribute, and/or property. (Nearly anything we show on an IOC page, you can add to your query.) To search threats, toggle the search mode at the top right of the Explore page. You can search threats with any combination of threat name, alias, category, risk, last seen timestamp, feed, and threat attribute.
Autocomplete can help with suggestions to get started, but doesn't reflect our full range of capabilities. Our Explore page comes with a quick start guide that walks you through how to use the page and sample queries.
How do I use Analyze?
Analyze is used for the bulk processing, enrichment, and exporting of indicators. It's designed to support internal investigations, proactively find potential threats, parse and enrich indicators from external reports, and make it easy to extract and compare key information in bulk and on demand.
Learn more with a step by step walkthrough in this blog.
Does Pulsedive integrate with [insert software here]?
We design our API and Feed to be easily integrated with most tools - in JSON, CSV, and STIX/TAXII 2.1 formats. In addition to enabling custom integrations, we maintain a non-exhaustive list of integration partners here.
Pulsedive
If you have built or would like to see a new integration, reach out to us at support@pulsedive.com.
Which paid Pulsedive products are best for which use cases?
Pro: Ideal for individual analysts, researchers, and hobbyists to support analysis and personal projects. Pro comes with upgraded capabilities, like historical screenshots, 3rd party integrations, increased Analyze limits and Explore results, and more. Bundles are also available for security teams using the Pulsedive GUI for triage and research.
API: Recommended for on-demand lookups, enrichment, and scanning. Many customers leverage the Pulsedive API to enrich alerts, tickets, and other workflow steps with SIEM and SOAR solutions. Our flexible API also makes custom integrations a breeze. Check out the API docs to learn more.
Feed: Best configurable bulk export of Pulsedive's dataset for high-volume enrichment, alerting, and blocking. Available in CSV and STIX/TAXII 2.1 format. Popular use cases include alerting on IOCs, enriching logs, and blocking potential threats. Check out our Bulk Export page to learn more.
Our products are complementary, so each team may use one, two, or multiple combinations of our products within their security stack. See below for common ways customers use our products.
Enterprise: The Enterprise TIP platform is ideal when organizations want a private Pulsedive platform with more control and privacy. See the next question for more details.
What if I want a private version of Pulsedive’s platform just for myself/my team?
Check out our Enterprise TIP. Our Enterprise TIP is a dedicated, private, cloud-hosted threat intelligence platform that takes all the functionality you know and love from Pulsedive with flexible customization and advanced threat intel management - just for your team. Enterprise is ideal for growing teams that crave versatility and affordability, without the challenges of maintaining homegrown or open-source systems. Learn more in our brochure or drop us a note at sales@pulsedive.com.
Where can I learn more about Pulsedive?
Learn about Pulsedive on our About pages and about how we work in our Documentation.
Have questions? We have answers! Email support@pulsedive.com