Skip to main content
To use this feature, you must have a Pulsedive Feed plan. Your export access and available options are determined by your plan.
Pulsedive’s CSV export delivers a filtered subset of Pulsedive’s indicator dataset as a flat file. Configure your Direct URL with the filters you need, then point your tooling at it to automate recurring ingestion.

The Direct URL

The Direct URL is a GET request to Pulsedive’s CSV export endpoint with your API key and chosen filters as query parameters. A Direct URL looks like this:
Your Direct URL contains your API key. Treat it as a secret. Do not commit it to version control or share it publicly.
To find your API key, visit your Pulsedive account page.

Try It

Fields

Use the fields parameter to control which columns appear in your CSV output. The indicator value is always included as the first column, regardless of which fields you select.

Filters

Use filters to limit your export to the indicators that matter for your use case. The options available to you depend on your Feed plan.

Indicator Types

Filter by indicator type using the types parameter. Accepts a comma-separated list. All Feed plans include all four indicator types.

Indicator Risk

Filter by risk level using the risk parameter. Accepts a comma-separated list. Risk level availability varies by plan. To view which risk levels are available on your plan, visit pulsedive.com/about/feed.

Timestamp

Use the seen or added parameter to filter by time period. Use seen to filter by when an indicator was last seen. Use added to filter by when it was first added to Pulsedive. Both parameters accept the same values: The time period available to you depends on your Feed plan. To view plan details, visit pulsedive.com/about/feed.

Retired Indicators

Use the retired parameter to control whether retired indicators appear in your export. Access to retired indicators depends on your Feed plan.

Header Row

Use the header parameter to include or exclude a column header row as the first line of the CSV.

Reading the Output

A few fields in the CSV output have formatting behaviors worth knowing before you build a parser.

Risk and Retirement Status

The risk field combines an indicator’s risk level and its retirement status in a single value. When an indicator is retired, Pulsedive appends :retired to the risk level. For example, an indicator with a high risk score that has since been retired appears as:
Check for the :retired suffix if your pipeline needs to handle active and retired indicators differently.

Multiple Values in a Single Field

The threats, feeds, and riskfactors fields may contain multiple values. Pulsedive separates multiple values within a single field with a comma. Single fields that contain multiple values are encapsulated in quotes, which most CSV parsers will handle correctly. When parsing these fields, treat the comma as an inner delimiter within the field value, not as a column separator.

Feeds Format

Each entry in the feeds field follows Feed Name:Organization format. For example:

Empty Fields

Fields with no data output as empty. Your parser should handle empty values for any optional field.
Not sure whether CSV or STIX/TAXII 2.1 is the right format for your use case? Visit Choose an Export Format.