Skip to main content
IBM QRadar SOAR is the incident response platform security teams use to orchestrate investigation and response through workflows and rules. The Pulsedive app adds three Pulsedive functions to QRadar SOAR, so a workflow can query an indicator, threat, or feed by ID or by value, or run a search. The app is published in IBM’s QRadar SOAR community apps repository, so support runs through the community rather than IBM’s support channel. This is an enrichment integration that queries the Pulsedive API on demand. To import Pulsedive data in bulk instead, visit Feed.

Available Functions

These functions cover the two ways to reach a single indicator, threat, or feed and the way to reach many, so a workflow can enrich what it already has or go looking for more.
  • Pulsedive: Query by ID: Retrieves an indicator, threat, or feed by its Pulsedive ID, or a related report such as its linked indicators or properties.
  • Pulsedive: Query by Value: Retrieves an indicator by its value, such as a domain or an IP address, or a threat or feed by its name.
  • Pulsedive: Search: Searches Pulsedive for indicators, threats, or feeds matching the criteria you supply, such as risk, indicator type, threat, feed, or attribute.

What the App Installs

Alongside the three functions, the app installs an example workflow and a rule for each one, and a custom artifact type. The app also adds a Pulsedive ID artifact type, which holds the ID of a Pulsedive indicator, threat, or feed. To query by ID, add an artifact of this type to an incident, then run Pulsedive Query by ID from it.

Prerequisites

Before you connect QRadar SOAR to Pulsedive, make sure you have the account and access the app needs, so installation and configuration go smoothly:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • IBM QRadar SOAR version 51.0.0 or later.
  • An integration server running resilient_circuits 51.0.0 or later, with SSH access.
  • An account with permission to edit incident fields, create and edit workflows, read, create and edit functions, read incident action invocations, edit organization data, and create and edit scripts. If you authenticate with an API key account, it needs Incidents.Edit.Fields, Workflows.Create, Workflows.Edit, Functions.Read, Functions.Create, Functions.Edit, Other.ReadIncidentsActionInvocations, Edit Org Data, Scripts.Create, and Scripts.Edit.
  • Outbound connectivity from the integration server to https://pulsedive.com on port 443.

Connecting QRadar SOAR to Pulsedive

QRadar SOAR calls the Pulsedive API through an app that runs on your integration server and holds your API key. Once the app is installed, configured, and running, its functions are available to your workflows.
1

Install the app

Install the app on your integration server, then import its customizations into QRadar SOAR, so its functions appear in the workflow editor.
  1. Download fn_pulsedive.zip from the QRadar SOAR community apps repository.
  2. Copy the file to your integration server over SSH, then unzip it.
  3. Install the package with pip, using the .tar.gz file in the unzipped directory.
  4. Import the app’s configuration:
  5. Import the app’s customizations:
2

Configure the app

Add your Pulsedive credentials to the app configuration file, so the functions can authenticate.
  1. Open app.config on the integration server.
  2. Set the Pulsedive values:
  3. Save and close the file.
  4. Optionally, test the configuration:
  5. Start the integration:
For the app source and full configuration reference, visit the Pulsedive app documentation.
3

Verify the connection

Confirm that QRadar SOAR can retrieve Pulsedive data before you build the app into your response process.
  1. Add a DNS Name artifact to an incident, using a domain Pulsedive already knows, such as one you can look up on pulsedive.com.
  2. Run the Pulsedive Query by Value rule on that artifact. Rules run from the object they are bound to, so you reach this one from the artifact rather than from the workflow list.
  3. Confirm that the workflow returns a risk value and risk factors rather than an empty result.
    An empty result on a known indicator points at the configuration rather than the indicator, so check pulsedive_api_key and pulsedive_api_url first.

Using Pulsedive Data in QRadar SOAR

Once the app is running, add any Pulsedive function as a workflow step, so its output feeds your existing enrichment and response process.
To build on an example workflow, clone it first and edit the copy, so your changes survive an app upgrade.
To understand the risk values and risk factors these functions return, visit Risk. To review the search criteria available to Pulsedive: Search, visit Explore.