Skip to main content
Cortex XSOAR is Palo Alto Networks’ security orchestration, automation, and response platform, used to automate enrichment, investigation, and response through playbooks. The Pulsedive pack adds Pulsedive as a source you can call from any playbook or from the CLI, so an analyst or an automated playbook can pull Pulsedive’s risk score and context into an investigation without leaving Cortex XSOAR. The pack is community-supported, not Palo Alto-certified, so support runs through the community rather than Palo Alto’s support channel.

Prerequisites

Before you connect Cortex XSOAR to Pulsedive, make sure you have:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • Cortex XSOAR version 6.0.0 or later, or Cortex XSIAM, with permission to install packs and configure integration instances.

Connecting Cortex XSOAR to Pulsedive

Follow these steps to install the Pulsedive pack and configure it with your API key, so its commands become available in your playbooks:
  1. In Cortex XSOAR, go to Marketplace and search for Pulsedive.
  2. Select the Pulsedive pack and select Install.
  3. Go to Settings > Integrations > Instances and search for Pulsedive.
  4. Select Add instance.
  5. Enter your Pulsedive API key, then select Test to confirm the connection.
  6. Select Done to save.
For the current parameter list and any changes to the pack, visit Pulsedive on Cortex XSOAR.

Available Commands

These commands cover the core Pulsedive enrichment and scan workflow, so you can build a playbook without writing raw API calls:
  • ip: Returns IP information and reputation.
  • domain: Returns domain information and reputation.
  • url: Returns URL information and reputation.
  • pulsedive-scan: Starts a passive or active scan of an indicator.
  • pulsedive-scan-result: Retrieves the result of a scan started with pulsedive-scan, using the QID it returned.
The domain and url commands can make the indicator’s data publicly visible on Pulsedive. Check Pulsedive’s submission behavior before running these commands against sensitive or internal-only values.

Verifying the Connection

Confirm that Cortex XSOAR can reach Pulsedive before you build it into a playbook.
  1. Run the ip, domain, or url command from the CLI against a known indicator.
  2. Confirm that a DBot message with Pulsedive data appears in the War Room.

Using Pulsedive Data in Cortex XSOAR

Once configured, add any Pulsedive command as a playbook task or run it ad hoc from the CLI, so its output feeds directly into your existing investigation and response workflows. To browse and import ready-made automation, visit the Pulsedive pack on the Cortex Marketplace.