Dataminr Pulse

Dataminr Pulse is a real-time information discovery platform that provides critical alerts from publicly available data sources.

Dataminr Pulse is a leading real-time information discovery platform that provides critical alerts on global events. By integrating Dataminr Pulse with Swimlane Turbine, users can seamlessly retrieve and manage real-time alerts and preconfigured alert lists. This integration empowers security teams to enhance situational awareness and respond swiftly to emerging threats, leveraging Dataminr's comprehensive alerting capabilities within the Swimlane Turbine environment.

Prerequisites

Before you can use the Dataminr Pulse connector for Swimlane, you'll need access to the Dataminr API. This requires the following:

OAuth2 authorization using the following parameters:

URL: The endpoint for accessing Dataminr's API services.

Client ID: A unique identifier for your application to authenticate with Dataminr.

Client Secret: A secret key used in conjunction with the Client ID to authenticate your application securely.

Asset Setup

You will need a client ID and client secret along with the url to access the API.

Capabilities

This Connector provides the following capabilities:

Get Alerts

Get Alert Lists

Get Alerts

Input param query is required if lists is not provided.

Input param lists is required if query is not provided.

For cyber specific alerts only an additional metadata object will be returned in the alert object. A description of this object and related fields, along with an example of a cyber alert, is provided below.

Name	Type	Description
vulnerabilities	Object	Contains a list of CVE, cvss v2 pairings.
addresses	Object	List of IP addresses and ports, if available .
urls	List of Strings	Identifier for a specific part of a website referenced in posts which could related to a target or attacker’s infrastructure
asns	List of Strings	Name of the autonomous systems number of company hosting the impacted service(s)
orgs	List of Strings	Name of the ASN (company hosting the impacted service)
hashes	List of Strings	A unique identifier or fingerprint for a file, often a malicious executable
products	List of Strings	The server software used on an IP address
malwares	List of Strings	Malicious software posing a threat
threats	List of Strings	Ransomware of APT Group posing a threat

Limitations

The API does not currently support filtering alerts by time.

Additional Documentation

Dataminr Pulse Connector Documentation

Dataminr Pulse API Documentation

Configurations

Oauth 2.0 Client Credentials

Authenticates using oauth 2.0 client credentials

Configuration Parameters

Parameter	Description	Type	Required
url	A URL to the target host.	string	Required
client_id	The client ID	string	Required
client_secret	The client secret.	string	Required
verify_ssl	Verify SSL certificate	boolean	Optional
http_proxy	A proxy to route requests through.	string	Optional

Actions

Get Alerts

Retrieve the latest alerts from Dataminr Pulse using specified alert version parameters.

Endpoint

URL: api/3/alerts

Method: GET

Input

Argument Name	Type	Required	Description
parameters.query	string	Optional	Parameters for the Get Alerts action
parameters.lists	string	Optional	This is Comma delimited set of list IDs. Comma-separated string.
parameters.from	string	Optional	From points to a cursor that you want any alerts after.
parameters.to	string	Optional	To points to a cursor that you want any alerts before.
parameters.num	number	Optional	Maximum number of alerts to return, default = 40.
parameters.alertversion	number	Required	Alertversion must be equal or greater than 14.

Input Example

{"parameters":{"query":"(hurricane OR fire) AND office building"}}

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
data	object	Response data
data.alerts	array	Response data
data.alerts.alertId	string	Response data
data.alerts.availableRelatedAlerts	number	Response data
data.alerts.eventTime	number	Response data
data.alerts.eventVolume	number	Response data
data.alerts.eventLocation	object	Response data
data.alerts.eventLocation.coordinates	array	Response data
data.alerts.eventLocation.name	string	Response data
data.alerts.eventLocation.places	array	Response data
data.alerts.eventLocation.radius	number	Response data
data.alerts.source	object	Response data
data.alerts.source.displayName	string	Response data
data.alerts.source.entityName	string	Response data
data.alerts.source.link	string	Response data
data.alerts.source.verified	boolean	Response data
data.alerts.source.channels	array	Response data
data.alerts.post	object	Response data
data.alerts.post.timestamp	number	Response data
data.alerts.post.languages	array	Response data
data.alerts.post.languages.position	number	Response data
data.alerts.post.languages.lang	string	Response data
data.alerts.post.media	array	Response data

Output Example

{"status_code":200,"response_headers":{"Date":"Tue, 22 Aug 2023 06:08:11 GMT","Content-Type":"application/json;charset=utf-8","Content-Length":"4830","Connection":"keep-alive","vary":"Accept-Encoding, User-Agent","content-encoding":"gzip","x-correlation-id":"b3062d5b7dc03328eb970d709e795100, 36e2cc964b21b9228f46dd64bb308fe6","strict-transport-security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","x-frame-options":"DENY, DENY","access-control-allow-origin":"*","acce...

Get Alerts Lists

Retrieve all preconfigured alert lists from Dataminr Pulse, providing a comprehensive overview of alerts.

Endpoint

URL: account/2/get_lists

Method: GET

Output

Parameter	Type	Description
status_code	number	HTTP status code of the response
reason	string	Response reason phrase
watchlists	object	Output field: watchlists
watchlists.TOPIC	array	Output field: watchlists.TOPIC
watchlists.TOPIC.id	number	Unique identifier
watchlists.TOPIC.type	string	Type of the resource
watchlists.TOPIC.name	string	Name of the resource
watchlists.TOPIC.description	string	Output field: watchlists.TOPIC.description
watchlists.TOPIC.properties	object	Output field: watchlists.TOPIC.properties
watchlists.TOPIC.properties.watchlistColor	string	Output field: watchlists.TOPIC.properties.watchlistColor
watchlists.COMPANY	array	Output field: watchlists.COMPANY
watchlists.COMPANY.id	number	Unique identifier
watchlists.COMPANY.type	string	Type of the resource
watchlists.COMPANY.name	string	Name of the resource
watchlists.COMPANY.description	string	Output field: watchlists.COMPANY.description
watchlists.COMPANY.properties	object	Output field: watchlists.COMPANY.properties
watchlists.COMPANY.properties.watchlistColor	string	Output field: watchlists.COMPANY.properties.watchlistColor
watchlists.COMPANY.companies	array	Output field: watchlists.COMPANY.companies
watchlists.COMPANY.companies.id	string	Unique identifier
watchlists.COMPANY.companies.name	string	Name of the resource

Output Example

{"status_code":200,"response_headers":{"Date":"Mon, 21 Aug 2023 09:25:55 GMT","Content-Type":"application/json; charset=UTF-8","Content-Length":"248","Connection":"keep-alive","access-control-max-age":"604800","vary":"Accept-Encoding","content-encoding":"gzip","x-correlation-id":"ccc7ea78bae01e8ca8f3ca1fd9c63a86, 46f369571dfe3cbb775911784cf9d34a","strict-transport-security":"max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains","x-frame-options":"DENY, DENY","x-rate-limit-lim...

Response Headers

Header	Description	Example
access-control-allow-headers	HTTP response header: access-control-allow-headers	authorization, x-verify-credentials-authorization, x-auth-service-provider, x-twitter-client-version, Content-Type
access-control-allow-methods	HTTP response header: access-control-allow-methods	GET,POST,PUT,DELETE,PATCH
access-control-allow-origin	HTTP response header: access-control-allow-origin	*
access-control-max-age	HTTP response header: access-control-max-age	604800
Connection	HTTP response header: Connection	keep-alive
content-encoding	HTTP response header: content-encoding	gzip
Content-Length	The length of the response body in bytes	248
Content-Type	The media type of the resource	application/json;charset=utf-8
Date	The date and time at which the message was originated	Tue, 22 Aug 2023 06:08:11 GMT
strict-transport-security	HTTP response header: strict-transport-security	max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
vary	HTTP response header: vary	Accept-Encoding, User-Agent
x-correlation-id	A unique identifier for correlating requests	ccc7ea78bae01e8ca8f3ca1fd9c63a86, 46f369571dfe3cbb775911784cf9d34a
x-frame-options	HTTP response header: x-frame-options	DENY, DENY
x-rate-limit-limit	HTTP response header: x-rate-limit-limit	60
x-rate-limit-remain	HTTP response header: x-rate-limit-remain	59
x-rate-limit-reset	HTTP response header: x-rate-limit-reset	1692610555015