Configure and automate bulk indicator exports from Pulsedive in CSV format.
To use this feature, you must have a Pulsedive Feed plan.
Your export access and available options are determined by your plan.
Pulsedive’s CSV export delivers a filtered subset of Pulsedive’s indicator dataset as a flat file.
Configure your Direct URL with the filters you need, then point your tooling at it to automate recurring ingestion.
The Direct URL is a GET request to Pulsedive’s CSV export endpoint with your API key and chosen filters as query parameters.
A Direct URL looks like this:
Use the fields parameter to control which columns appear in your CSV output.
The indicator value is always included as the first column, regardless of which fields you select.
Field
Parameter value
Description
Indicator value
(always included)
The indicator itself: an IP address, domain, URL, or IPv6 address.
Indicator ID
id
Pulsedive’s unique internal identifier for the indicator.
Type
type
The indicator type: ip, ipv6, domain, or url.
Risk
risk
The indicator’s risk level, and retirement status if applicable. See Reading the Output.
Threats
threats
Threat names associated with the indicator, comma-separated.
Feeds
feeds
Source feeds that reference the indicator, in Feed Name:Organization format, comma-separated.
User Submission Count
usersubmissions
The number of times Pulsedive users have submitted this indicator.
Risk Factors
riskfactors
The risk factors contributing to the indicator’s score, comma-separated.
Reference URL
reference
A direct link to the indicator’s page on pulsedive.com.
Use the seen or added parameter to filter by time period.
Use seen to filter by when an indicator was last seen.
Use added to filter by when it was first added to Pulsedive.Both parameters accept the same values:
Value
Description
all
All time
year
Last year
month
Last month
week
Last week
day
Last day
The time period available to you depends on your Feed plan. To view plan details, visit pulsedive.com/about/feed.
The risk field combines an indicator’s risk level and its retirement status in a single value.
When an indicator is retired, Pulsedive appends :retired to the risk level.For example, an indicator with a high risk score that has since been retired appears as:
high:retired
Check for the :retired suffix if your pipeline needs to handle active and retired indicators differently.
The threats, feeds, and riskfactors fields may contain multiple values.
Pulsedive separates multiple values within a single field with a comma. Single fields that contain multiple values are encapsulated in quotes, which most CSV parsers will handle correctly.When parsing these fields, treat the comma as an inner delimiter within the field value, not as a column separator.
