> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with Cortex XSOAR

> Use the Cortex XSOAR Pulsedive pack to enrich domains, URLs, and IPs with Pulsedive risk scores, and to trigger on-demand scans from a playbook.

[Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar) is Palo Alto Networks' security orchestration, automation, and response platform, used to automate enrichment, investigation, and response through playbooks.
The Pulsedive pack adds Pulsedive as a source you can call from any playbook or from the CLI, so an analyst or an automated playbook can pull Pulsedive's risk score and context into an investigation without leaving Cortex XSOAR.
The pack is community-supported, not Palo Alto-certified, so support runs through the community rather than Palo Alto's support channel.

## Prerequisites

Before you connect Cortex XSOAR to Pulsedive, make sure you have:

* A Pulsedive account and API key.
  Find your API key on your [Pulsedive account page](https://pulsedive.com/account).
* Cortex XSOAR version 6.0.0 or later, or Cortex XSIAM, with permission to install packs and configure integration instances.

## Connecting Cortex XSOAR to Pulsedive

Follow these steps to install the Pulsedive pack and configure it with your API key, so its commands become available in your playbooks:

1. In Cortex XSOAR, go to **Marketplace** and search for **Pulsedive**.
2. Select the Pulsedive pack and select **Install**.
3. Go to **Settings** > **Integrations** > **Instances** and search for **Pulsedive**.
4. Select **Add instance**.
5. Enter your Pulsedive API key, then select **Test** to confirm the connection.
6. Select **Done** to save.

For the current parameter list and any changes to the pack, visit [Pulsedive on Cortex XSOAR](https://xsoar.pan.dev/docs/reference/integrations/pulsedive).

## Available Commands

These commands cover the core Pulsedive enrichment and scan workflow, so you can build a playbook without writing raw API calls:

* `ip`: Returns IP information and reputation.
* `domain`: Returns domain information and reputation.
* `url`: Returns URL information and reputation.
* `pulsedive-scan`: Starts a passive or active scan of an indicator.
* `pulsedive-scan-result`: Retrieves the result of a scan started with `pulsedive-scan`, using the QID it returned.

> [!NOTE]
>
> The `domain` and `url` commands can make the indicator's data publicly visible on Pulsedive.
> Check [Pulsedive's submission behavior](https://docs.pulsedive.com/analyze/overview) before running these commands against sensitive or internal-only values.

## Verifying the Connection

Confirm that Cortex XSOAR can reach Pulsedive before you build it into a playbook.

1. Run the `ip`, `domain`, or `url` command from the CLI against a known indicator.
2. Confirm that a DBot message with Pulsedive data appears in the War Room.

## Using Pulsedive Data in Cortex XSOAR

Once configured, add any Pulsedive command as a playbook task or run it ad hoc from the CLI, so its output feeds directly into your existing investigation and response workflows.

To browse and import ready-made automation, visit the [Pulsedive pack on the Cortex Marketplace](https://cortex.marketplace.pan.dev/marketplace/details/Pulsedive/).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.