Pulsedive
The Pulsedive connector allows for the integration of Pulsedive's comprehensive threat intelligence into security automation workflows.
Pulsedive is a threat intelligence platform that provides real-time data on indicators of compromise (IOCs) and facilitates proactive cyber threat analysis. The Pulsedive connector for Swimlane Turbine allows users to integrate rich threat intelligence into their security workflows, enabling automated scanning, information retrieval, and comprehensive analysis of threats. By leveraging Pulsedive's capabilities, security teams can enhance their incident response with actionable insights, streamline investigations, and improve their overall security posture without the need for manual queries or coding.
Limitations
None to date
Supported Versions
This connector supports the latest version of the Pulsedive API.
Additional Docs
Links to third party vendorβs API documentation:
Configuration
Prerequisites
To effectively utilize the Pulsedive connector within the Swimlane Turbine platform, ensure you have the following prerequisites:
- API Key Authentication with the necessary parameters:
- URL: The endpoint URL for the Pulsedive API.
- API Key: Your unique authentication key provided by Pulsedive.
Authentication Methods
The following authentication methods are supported for this connector:
API Key Authentication
- URL: The endpoint URL for the Pulsedive API.
- API Key: Your unique identifier to authenticate with the Pulsedive API.
Troubleshooting Tips:
- Ensure the API key has the necessary permissions.
- Verify that the API key is not expired or revoked.
Capabilities
This connector provides the following capabilities:
- Add to the Queue
- Get Indicators by Indicator ID
- Get Indicator by Value
- Get Indicators Links
- Get Indicators Properties
- Retrieve the Result
Add to the Queue
The first step to scanning an indicator is adding the indicator to the queue for processing. We can specify whether we want to perform an active scan for the indicator by setting the probe parameter to 0 for passive or 1 for active.
Pulsedive's documentation for this action can be found here.
Get Indicators by Indicator ID
This query will return the latest properties if the historical parameter is omitted. To return all historical properties, you can set the historical parameter to 1.
Schema is an optional parameter to return associated attributes with the indicator type you are querying. For example, if you are querying google.com, the schema parameter will return only attributes associated with domains. Customizable indicator types is in the Pulsedive roadmap.
Pulsedive's documentation for this action can be found here.
Get Indicator by Value
This query is identical to querying by indicator ID, but the information is retrieved using the indicator value. Querying links and properties by indicator value won't work.
Pulsedive's documentation for this action can be found here.
Get Indicators Links
Retrieve links associated with specific indicators.
Pulsedive's documentation for this action can be found here.
Get Indicators Properties
You can bundle this request with the initial indicators request by setting the historical property to 1 in the initial request. Executing them separately or omitting historical properties on the initial request might be better for performance if you don't need all historical data
Pulsedive's documentation for this action can be found here.
Retrieve the Result
Once we've added an indicator to the queue for analysis, we'll use the qid to check on the result. The status field will let us know if the request is still processing. Once we get a response that contains a success message we'll know the scan is finished. The Pulsedive platform generally checks for results every 500 ms.
The API request is only recorded when you add the indicator to the queue. We don't log requests when you check for analysis results so this won't be marked against your rate limit. With that being said, we ask that you please do not abuse the request.
Pulsedive's documentation for this action can be found here.
Configurations
Pulsedive API Key Authentication
Authenticates using an API Key
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
x-apikey | API key | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Add to the Queue
Initiates the scanning process by adding an indicator to Pulsedive's queue, with options for passive or active scans.
Endpoint
- URL: /api/analyze.php
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
data_body | object | Optional | Response data |
data_body.value | string | Optional | Response data |
data_body.probe | string | Optional | Response data |
data_body.pretty | string | Optional | Response data |
Input Example
{"data_body":{"value":"pulsedive.com","probe":"1","pretty":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
success | string | Whether the operation was successful |
qid | number | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"Date":"Tue, 19 Nov 2024 08:56:07 GMT","Server":"Apache","Cache-Control":"no-store, no-cache, must-revalidate","Content-Security-Policy":"default-src 'self'","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Requests-Remaining-Month":"488","X-Requests-Remaining-Second":"0","X-Requests-Remaining-Day":"43","Content-Encoding":"gzip","Vary":"Accept-Encoding","Keep-Alive":"t...
Get Indicators by indicator ID
Retrieve current or historical properties of a Pulsedive indicator by its unique ID.
Endpoint
- URL: /api/info.php
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.iid | string | Optional | Indicator ID |
parameters.historical | string | Optional | Include historical properties |
parameters.schema | string | Optional | Include attribute schema |
parameters.pretty | string | Optional | Pretty-print JSON response |
Input Example
{"parameters":{"iid":"2","historical":"0","schema":"1","pretty":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
qid | object | Unique identifier |
iid | number | Unique identifier |
indicator | string | Output field: indicator |
type | string | Type of the resource |
risk | string | Output field: risk |
risk_recommended | string | Output field: risk_recommended |
manualrisk | number | Output field: manualrisk |
retired | object | Output field: retired |
stamp_added | string | Output field: stamp_added |
stamp_updated | string | Output field: stamp_updated |
stamp_seen | string | Output field: stamp_seen |
stamp_probed | string | Output field: stamp_probed |
stamp_retired | object | Output field: stamp_retired |
recent | number | Output field: recent |
submissions | number | Output field: submissions |
umbrella_rank | object | Output field: umbrella_rank |
umbrella_domain | object | Output field: umbrella_domain |
riskfactors | array | Output field: riskfactors |
riskfactors.rfid | number | Unique identifier |
riskfactors.description | string | Output field: riskfactors.description |
riskfactors.risk | string | Output field: riskfactors.risk |
redirects | object | Output field: redirects |
redirects.from | array | Output field: redirects.from |
Output Example
{"qid":{},"iid":123,"indicator":"string","type":"string","risk":"string","risk_recommended":"string","manualrisk":123,"retired":{},"stamp_added":"string","stamp_updated":"string","stamp_seen":"string","stamp_probed":"string","stamp_retired":{},"recent":123,"submissions":123}
Get Indicators by Value
Retrieve detailed information for a specific indicator value from Pulsedive, excluding associated links and properties.
Endpoint
- URL: /api/info.php
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.indicator | string | Optional | Parameters for the Get Indicators by Value action |
parameters.pretty | string | Optional | Parameters for the Get Indicators by Value action |
Input Example
{"parameters":{"indicator":"pulsedive.com","pretty":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
qid | object | Unique identifier |
iid | number | Unique identifier |
indicator | string | Output field: indicator |
type | string | Type of the resource |
risk | string | Output field: risk |
risk_recommended | string | Output field: risk_recommended |
manualrisk | number | Output field: manualrisk |
retired | object | Output field: retired |
stamp_added | string | Output field: stamp_added |
stamp_updated | string | Output field: stamp_updated |
stamp_seen | string | Output field: stamp_seen |
stamp_probed | string | Output field: stamp_probed |
stamp_retired | object | Output field: stamp_retired |
recent | number | Output field: recent |
submissions | number | Output field: submissions |
umbrella_rank | object | Output field: umbrella_rank |
umbrella_domain | object | Output field: umbrella_domain |
riskfactors | array | Output field: riskfactors |
riskfactors.rfid | number | Unique identifier |
riskfactors.description | string | Output field: riskfactors.description |
riskfactors.risk | string | Output field: riskfactors.risk |
redirects | object | Output field: redirects |
redirects.from | array | Output field: redirects.from |
Output Example
{"qid":{},"iid":123,"indicator":"string","type":"string","risk":"string","risk_recommended":"string","manualrisk":123,"retired":{},"stamp_added":"string","stamp_updated":"string","stamp_seen":"string","stamp_probed":"string","stamp_retired":{},"recent":123,"submissions":123}
Get Indicators Links
Retrieve associated links for specific indicators from Pulsedive, aiding in comprehensive threat analysis.
Endpoint
- URL: /api/info.php
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.indicator | string | Optional | Parameters for the Get Indicators Links action |
parameters.get | string | Optional | Parameters for the Get Indicators Links action |
parameters.pretty | string | Optional | Parameters for the Get Indicators Links action |
Input Example
{"parameters":{"indicator":"pulsedive.com","get":"links","pretty":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Active DNS | array | Output field: Active DNS |
Active DNS.iid | number | Unique identifier |
Active DNS.indicator | string | Output field: Active DNS.indicator |
Active DNS.type | string | Type of the resource |
Active DNS.risk | string | Output field: Active DNS.risk |
Active DNS.stamp_linked | string | Output field: Active DNS.stamp_linked |
Active DNS.summary | object | Output field: Active DNS.summary |
Active DNS.summary.properties | object | Output field: Active DNS.summary.properties |
Active DNS.summary.properties.whois | object | Output field: Active DNS.summary.properties.whois |
Active DNS.summary.properties.whois.++privacy | string | Output field: Active DNS.summary.properties.whois.++privacy |
Active DNS.summary.properties.whois.++gdpr | string | Output field: Active DNS.summary.properties.whois.++gdpr |
Active DNS.summary.properties.geo | object | Output field: Active DNS.summary.properties.geo |
Active DNS.summary.properties.geo.country | string | Output field: Active DNS.summary.properties.geo.country |
Active DNS.summary.properties.geo.countrycode | string | Output field: Active DNS.summary.properties.geo.countrycode |
Active DNS.summary.properties.geo.region | string | Output field: Active DNS.summary.properties.geo.region |
Active DNS.summary.properties.geo.city | string | Output field: Active DNS.summary.properties.geo.city |
Active DNS.summary.properties.http | object | Output field: Active DNS.summary.properties.http |
Active DNS.summary.properties.http.++content-type | string | Type of the resource |
Active DNS.summary.properties.http.++code | string | Output field: Active DNS.summary.properties.http.++code |
Active DNS.summary.attributes | array | Output field: Active DNS.summary.attributes |
Active DNS.summary.domainiid | number | Unique identifier |
Active DNS.summary.domain | string | Output field: Active DNS.summary.domain |
Output Example
{"status_code":200,"response_headers":{"Date":"Thu, 07 Nov 2024 06:53:39 GMT","Server":"Apache","Cache-Control":"no-store, no-cache, must-revalidate","Content-Security-Policy":"default-src 'self'","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Requests-Remaining-Second":"0","X-Requests-Remaining-Day":"7","Content-Encoding":"gzip","Vary":"Accept-Encoding","Keep-Alive":"timeout=5, max=100","Connection":"Kee...
Get Indicators Properties
Retrieve properties of Pulsedive indicators, with an option to include historical data for optimized performance.
Endpoint
- URL: /api/info.php
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.iid | string | Optional | Parameters for the Get Indicators Properties action |
parameters.get | string | Optional | Parameters for the Get Indicators Properties action |
parameters.pretty | string | Optional | Parameters for the Get Indicators Properties action |
Input Example
{"parameters":{"iid":"2","get":"properties","pretty":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
whois | array | Output field: whois |
whois.pid | number | Unique identifier |
whois.stamp_seen | string | Output field: whois.stamp_seen |
whois.name | string | Name of the resource |
whois.value | string | Value for the parameter |
whois.latest | number | Output field: whois.latest |
geo | array | Output field: geo |
geo.pid | number | Unique identifier |
geo.stamp_seen | string | Output field: geo.stamp_seen |
geo.name | string | Name of the resource |
geo.value | string | Value for the parameter |
geo.latest | number | Output field: geo.latest |
http | array | Output field: http |
http.pid | number | Unique identifier |
http.stamp_seen | string | Output field: http.stamp_seen |
http.name | string | Name of the resource |
http.value | string | Value for the parameter |
http.latest | number | Output field: http.latest |
http.clean | number | Output field: http.clean |
http.risky | number | Output field: http.risky |
http.unique | number | Output field: http.unique |
ssl | array | Output field: ssl |
ssl.pid | number | Unique identifier |
Output Example
{"whois":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123}],"geo":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123}],"http":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123,"clean":123,"risky":123,"unique":123}],"ssl":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123,"clean":123}],"dns":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"...
Retrieve the Result
Retrieve analysis results for an indicator in Pulsedive using the provided Queue ID (QID).
Endpoint
- URL: /api/analyze.php
- Method: GET
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
parameters.qid | number | Optional | Parameters for the Retrieve the Result action |
parameters.pretty | string | Optional | Parameters for the Retrieve the Result action |
Input Example
{"parameters":{"qid":1520723759,"pretty":"1"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
error | string | Error message if any |
status | string | Status value |
qid | string | Unique identifier |
Output Example
{"status_code":200,"response_headers":{"Date":"Tue, 19 Nov 2024 05:48:33 GMT","Server":"Apache","Cache-Control":"no-store, no-cache, must-revalidate","Content-Security-Policy":"default-src 'self'","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Requests-Remaining-Month":"492","X-Requests-Remaining-Second":"0","X-Requests-Remaining-Day":"47","Content-Encoding":"gzip","Vary":"Accept-Encoding","Keep-Alive":"t...
Response Headers
Header | Description | Example |
|---|---|---|
Cache-Control | Directives for caching mechanisms | no-store, no-cache, must-revalidate |
Connection | HTTP response header: Connection | Keep-Alive |
Content-Encoding | HTTP response header: Content-Encoding | gzip |
Content-Security-Policy | HTTP response header: Content-Security-Policy | default-src 'self' |
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 07 Nov 2024 06:53:39 GMT |
Keep-Alive | HTTP response header: Keep-Alive | timeout=5, max=100 |
Server | Information about the software used by the origin server | Apache |
Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains |
Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked |
Vary | HTTP response header: Vary | Accept-Encoding |
X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff |
X-Requests-Remaining-Day | HTTP response header: X-Requests-Remaining-Day | 43 |
X-Requests-Remaining-Month | HTTP response header: X-Requests-Remaining-Month | 492 |
X-Requests-Remaining-Second | HTTP response header: X-Requests-Remaining-Second | 0 |
X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |