--- title: Pulsedive slug: connectors/pulsedive docTags: createdAt: 2026-06-09T16:29:54.908Z --- The Pulsedive connector allows for the integration of Pulsedive's comprehensive threat intelligence into security automation workflows. Pulsedive is a threat intelligence platform that provides real-time data on indicators of compromise (IOCs) and facilitates proactive cyber threat analysis. The Pulsedive connector for Swimlane Turbine allows users to integrate rich threat intelligence into their security workflows, enabling automated scanning, information retrieval, and comprehensive analysis of threats. By leveraging Pulsedive's capabilities, security teams can enhance their incident response with actionable insights, streamline investigations, and improve their overall security posture without the need for manual queries or coding. ### Limitations None to date ### Supported Versions This connector supports the latest version of the Pulsedive API. ### Additional Docs Links to third party vendor’s API documentation: - [Pulsedive API Documentation](https://pulsedive.com/api/) - [Indicators API Documentation](https://pulsedive.com/api/indicators) ## Configuration ### Prerequisites To effectively utilize the Pulsedive connector within the Swimlane Turbine platform, ensure you have the following prerequisites: - API Key Authentication with the necessary parameters: - URL: The endpoint URL for the Pulsedive API. - API Key: Your unique authentication key provided by Pulsedive. ## Authentication Methods The following authentication methods are supported for this connector: ### API Key Authentication - URL: The endpoint URL for the Pulsedive API. - API Key: Your unique identifier to authenticate with the Pulsedive API. **Troubleshooting Tips:** - Ensure the API key has the necessary permissions. - Verify that the API key is not expired or revoked. ## Capabilities This connector provides the following capabilities: - Add to the Queue - Get Indicators by Indicator ID - Get Indicator by Value - Get Indicators Links - Get Indicators Properties - Retrieve the Result ### Add to the Queue The first step to scanning an indicator is adding the indicator to the queue for processing. We can specify whether we want to perform an active scan for the indicator by setting the probe parameter to 0 for passive or 1 for active. Pulsedive's documentation for this action can be found [here](https://pulsedive.com/api/scan). ### Get Indicators by Indicator ID This query will return the latest properties if the historical parameter is omitted. To return all historical properties, you can set the historical parameter to 1. Schema is an optional parameter to return associated attributes with the indicator type you are querying. For example, if you are querying google.com, the schema parameter will return only attributes associated with domains. Customizable indicator types is in the Pulsedive roadmap. Pulsedive's documentation for this action can be found [here](https://pulsedive.com/api/indicators). ### Get Indicator by Value This query is identical to querying by indicator ID, but the information is retrieved using the indicator value. Querying links and properties by indicator value won't work. Pulsedive's documentation for this action can be found [here](https://pulsedive.com/api/indicators). ### Get Indicators Links Retrieve links associated with specific indicators. Pulsedive's documentation for this action can be found [here](https://pulsedive.com/api/indicators). ### Get Indicators Properties You can bundle this request with the initial indicators request by setting the historical property to 1 in the initial request. Executing them separately or omitting historical properties on the initial request might be better for performance if you don't need all historical data Pulsedive's documentation for this action can be found [here](https://pulsedive.com/api/indicators). ### Retrieve the Result Once we've added an indicator to the queue for analysis, we'll use the qid to check on the result. The status field will let us know if the request is still processing. Once we get a response that contains a success message we'll know the scan is finished. The Pulsedive platform generally checks for results every 500 ms. The API request is only recorded when you add the indicator to the queue. We don't log requests when you check for analysis results so this won't be marked against your rate limit. With that being said, we ask that you please do not abuse the request. Pulsedive's documentation for this action can be found [here](https://pulsedive.com/api/scan). # Configurations ## Pulsedive API Key Authentication Authenticates using an API Key ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | x-apikey | API key | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Add to the Queue Initiates the scanning process by adding an indicator to Pulsedive's queue, with options for passive or active scans. ### Endpoint - **URL:** `/api/analyze.php` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------ | -------- | ------------ | --------------- | | `data_body` | object | Optional | Response data | | `data_body.value` | string | Optional | Response data | | `data_body.probe` | string | Optional | Response data | | `data_body.pretty` | string | Optional | Response data | ### Input Example `{"data_body":{"value":"pulsedive.com","probe":"1","pretty":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `success` | string | Whether the operation was successful | | `qid` | number | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 19 Nov 2024 08:56:07 GMT","Server":"Apache","Cache-Control":"no-store, no-cache, must-revalidate","Content-Security-Policy":"default-src 'self'","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Requests-Remaining-Month":"488","X-Requests-Remaining-Second":"0","X-Requests-Remaining-Day":"43","Content-Encoding":"gzip","Vary":"Accept-Encoding","Keep-Alive":"t...` ## Get Indicators by indicator ID Retrieve current or historical properties of a Pulsedive indicator by its unique ID. ### Endpoint - **URL:** `/api/info.php` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ----------------------- | -------- | ------------ | ----------------------------- | | `parameters.iid` | string | Optional | Indicator ID | | `parameters.historical` | string | Optional | Include historical properties | | `parameters.schema` | string | Optional | Include attribute schema | | `parameters.pretty` | string | Optional | Pretty-print JSON response | ### Input Example `{"parameters":{"iid":"2","historical":"0","schema":"1","pretty":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `qid` | object | Unique identifier | | `iid` | number | Unique identifier | | `indicator` | string | Output field: indicator | | `type` | string | Type of the resource | | `risk` | string | Output field: risk | | `risk_recommended` | string | Output field: risk\_recommended | | `manualrisk` | number | Output field: manualrisk | | `retired` | object | Output field: retired | | `stamp_added` | string | Output field: stamp\_added | | `stamp_updated` | string | Output field: stamp\_updated | | `stamp_seen` | string | Output field: stamp\_seen | | `stamp_probed` | string | Output field: stamp\_probed | | `stamp_retired` | object | Output field: stamp\_retired | | `recent` | number | Output field: recent | | `submissions` | number | Output field: submissions | | `umbrella_rank` | object | Output field: umbrella\_rank | | `umbrella_domain` | object | Output field: umbrella\_domain | | `riskfactors` | array | Output field: riskfactors | | `riskfactors.rfid` | number | Unique identifier | | `riskfactors.description` | string | Output field: riskfactors.description | | `riskfactors.risk` | string | Output field: riskfactors.risk | | `redirects` | object | Output field: redirects | | `redirects.from` | array | Output field: redirects.from | ### Output Example `{"qid":{},"iid":123,"indicator":"string","type":"string","risk":"string","risk_recommended":"string","manualrisk":123,"retired":{},"stamp_added":"string","stamp_updated":"string","stamp_seen":"string","stamp_probed":"string","stamp_retired":{},"recent":123,"submissions":123}` ## Get Indicators by Value Retrieve detailed information for a specific indicator value from Pulsedive, excluding associated links and properties. ### Endpoint - **URL:** `/api/info.php` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ------------------------------------------------- | | `parameters.indicator` | string | Optional | Parameters for the Get Indicators by Value action | | `parameters.pretty` | string | Optional | Parameters for the Get Indicators by Value action | ### Input Example `{"parameters":{"indicator":"pulsedive.com","pretty":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------- | -------- | ------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `qid` | object | Unique identifier | | `iid` | number | Unique identifier | | `indicator` | string | Output field: indicator | | `type` | string | Type of the resource | | `risk` | string | Output field: risk | | `risk_recommended` | string | Output field: risk\_recommended | | `manualrisk` | number | Output field: manualrisk | | `retired` | object | Output field: retired | | `stamp_added` | string | Output field: stamp\_added | | `stamp_updated` | string | Output field: stamp\_updated | | `stamp_seen` | string | Output field: stamp\_seen | | `stamp_probed` | string | Output field: stamp\_probed | | `stamp_retired` | object | Output field: stamp\_retired | | `recent` | number | Output field: recent | | `submissions` | number | Output field: submissions | | `umbrella_rank` | object | Output field: umbrella\_rank | | `umbrella_domain` | object | Output field: umbrella\_domain | | `riskfactors` | array | Output field: riskfactors | | `riskfactors.rfid` | number | Unique identifier | | `riskfactors.description` | string | Output field: riskfactors.description | | `riskfactors.risk` | string | Output field: riskfactors.risk | | `redirects` | object | Output field: redirects | | `redirects.from` | array | Output field: redirects.from | ### Output Example `{"qid":{},"iid":123,"indicator":"string","type":"string","risk":"string","risk_recommended":"string","manualrisk":123,"retired":{},"stamp_added":"string","stamp_updated":"string","stamp_seen":"string","stamp_probed":"string","stamp_retired":{},"recent":123,"submissions":123}` ## Get Indicators Links Retrieve associated links for specific indicators from Pulsedive, aiding in comprehensive threat analysis. ### Endpoint - **URL:** `/api/info.php` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------- | -------- | ------------ | ---------------------------------------------- | | `parameters.indicator` | string | Optional | Parameters for the Get Indicators Links action | | `parameters.get` | string | Optional | Parameters for the Get Indicators Links action | | `parameters.pretty` | string | Optional | Parameters for the Get Indicators Links action | ### Input Example `{"parameters":{"indicator":"pulsedive.com","get":"links","pretty":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | --------------------------------------------------- | -------- | ----------------------------------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `Active DNS` | array | Output field: Active DNS | | `Active DNS.iid` | number | Unique identifier | | `Active DNS.indicator` | string | Output field: Active DNS.indicator | | `Active DNS.type` | string | Type of the resource | | `Active DNS.risk` | string | Output field: Active DNS.risk | | `Active DNS.stamp_linked` | string | Output field: Active DNS.stamp\_linked | | `Active DNS.summary` | object | Output field: Active DNS.summary | | `Active DNS.summary.properties` | object | Output field: Active DNS.summary.properties | | `Active DNS.summary.properties.whois` | object | Output field: Active DNS.summary.properties.whois | | `Active DNS.summary.properties.whois.++privacy` | string | Output field: Active DNS.summary.properties.whois.++privacy | | `Active DNS.summary.properties.whois.++gdpr` | string | Output field: Active DNS.summary.properties.whois.++gdpr | | `Active DNS.summary.properties.geo` | object | Output field: Active DNS.summary.properties.geo | | `Active DNS.summary.properties.geo.country` | string | Output field: Active DNS.summary.properties.geo.country | | `Active DNS.summary.properties.geo.countrycode` | string | Output field: Active DNS.summary.properties.geo.countrycode | | `Active DNS.summary.properties.geo.region` | string | Output field: Active DNS.summary.properties.geo.region | | `Active DNS.summary.properties.geo.city` | string | Output field: Active DNS.summary.properties.geo.city | | `Active DNS.summary.properties.http` | object | Output field: Active DNS.summary.properties.http | | `Active DNS.summary.properties.http.++content-type` | string | Type of the resource | | `Active DNS.summary.properties.http.++code` | string | Output field: Active DNS.summary.properties.http.++code | | `Active DNS.summary.attributes` | array | Output field: Active DNS.summary.attributes | | `Active DNS.summary.domainiid` | number | Unique identifier | | `Active DNS.summary.domain` | string | Output field: Active DNS.summary.domain | ### Output Example `{"status_code":200,"response_headers":{"Date":"Thu, 07 Nov 2024 06:53:39 GMT","Server":"Apache","Cache-Control":"no-store, no-cache, must-revalidate","Content-Security-Policy":"default-src 'self'","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Requests-Remaining-Second":"0","X-Requests-Remaining-Day":"7","Content-Encoding":"gzip","Vary":"Accept-Encoding","Keep-Alive":"timeout=5, max=100","Connection":"Kee...` ## Get Indicators Properties Retrieve properties of Pulsedive indicators, with an option to include historical data for optimized performance. ### Endpoint - **URL:** `/api/info.php` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------------- | | `parameters.iid` | string | Optional | Parameters for the Get Indicators Properties action | | `parameters.get` | string | Optional | Parameters for the Get Indicators Properties action | | `parameters.pretty` | string | Optional | Parameters for the Get Indicators Properties action | ### Input Example `{"parameters":{"iid":"2","get":"properties","pretty":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `whois` | array | Output field: whois | | `whois.pid` | number | Unique identifier | | `whois.stamp_seen` | string | Output field: whois.stamp\_seen | | `whois.name` | string | Name of the resource | | `whois.value` | string | Value for the parameter | | `whois.latest` | number | Output field: whois.latest | | `geo` | array | Output field: geo | | `geo.pid` | number | Unique identifier | | `geo.stamp_seen` | string | Output field: geo.stamp\_seen | | `geo.name` | string | Name of the resource | | `geo.value` | string | Value for the parameter | | `geo.latest` | number | Output field: geo.latest | | `http` | array | Output field: http | | `http.pid` | number | Unique identifier | | `http.stamp_seen` | string | Output field: http.stamp\_seen | | `http.name` | string | Name of the resource | | `http.value` | string | Value for the parameter | | `http.latest` | number | Output field: http.latest | | `http.clean` | number | Output field: http.clean | | `http.risky` | number | Output field: http.risky | | `http.unique` | number | Output field: http.unique | | `ssl` | array | Output field: ssl | | `ssl.pid` | number | Unique identifier | ### Output Example `{"whois":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123}],"geo":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123}],"http":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123,"clean":123,"risky":123,"unique":123}],"ssl":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"string","latest":123,"clean":123}],"dns":[{"pid":123,"stamp_seen":"string","name":"Example Name","value":"...` ## Retrieve the Result Retrieve analysis results for an indicator in Pulsedive using the provided Queue ID (QID). ### Endpoint - **URL:** `/api/analyze.php` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------- | -------- | ------------ | --------------------------------------------- | | `parameters.qid` | number | Optional | Parameters for the Retrieve the Result action | | `parameters.pretty` | string | Optional | Parameters for the Retrieve the Result action | ### Input Example `{"parameters":{"qid":1520723759,"pretty":"1"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `error` | string | Error message if any | | `status` | string | Status value | | `qid` | string | Unique identifier | ### Output Example `{"status_code":200,"response_headers":{"Date":"Tue, 19 Nov 2024 05:48:33 GMT","Server":"Apache","Cache-Control":"no-store, no-cache, must-revalidate","Content-Security-Policy":"default-src 'self'","X-Content-Type-Options":"nosniff","X-XSS-Protection":"1; mode=block","Strict-Transport-Security":"max-age=31536000; includeSubDomains","X-Requests-Remaining-Month":"492","X-Requests-Remaining-Second":"0","X-Requests-Remaining-Day":"47","Content-Encoding":"gzip","Vary":"Accept-Encoding","Keep-Alive":"t...` # Response Headers | **Header** | **Description** | **Example** | | --------------------------- | -------------------------------------------------------- | ----------------------------------- | | Cache-Control | Directives for caching mechanisms | no-store, no-cache, must-revalidate | | Connection | HTTP response header: Connection | Keep-Alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | Content-Security-Policy | HTTP response header: Content-Security-Policy | default-src 'self' | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 07 Nov 2024 06:53:39 GMT | | Keep-Alive | HTTP response header: Keep-Alive | timeout=5, max=100 | | Server | Information about the software used by the origin server | Apache | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | X-Content-Type-Options | HTTP response header: X-Content-Type-Options | nosniff | | X-Requests-Remaining-Day | HTTP response header: X-Requests-Remaining-Day | 43 | | X-Requests-Remaining-Month | HTTP response header: X-Requests-Remaining-Month | 492 | | X-Requests-Remaining-Second | HTTP response header: X-Requests-Remaining-Second | 0 | | X-XSS-Protection | HTTP response header: X-XSS-Protection | 1; mode=block |