> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with IBM QRadar SOAR

> Use the Pulsedive app for IBM QRadar SOAR to query Pulsedive by ID or value and search it from your incident workflows.

[IBM QRadar SOAR](https://www.ibm.com/products/qradar-soar) is the incident response platform security teams use to orchestrate investigation and response through workflows and rules.
The Pulsedive app adds three Pulsedive functions to QRadar SOAR, so a workflow can query an indicator, threat, or feed by ID or by value, or run a search.
The app is published in IBM's QRadar SOAR community apps repository, so support runs through the community rather than IBM's support channel.

This is an enrichment integration that queries the Pulsedive API on demand.
To import Pulsedive data in bulk instead, visit [Feed](https://docs.pulsedive.com/export/overview.md).

## Available Functions

These functions cover the two ways to reach a single indicator, threat, or feed and the way to reach many, so a workflow can enrich what it already has or go looking for more.

* **Pulsedive: Query by ID**: Retrieves an indicator, threat, or feed by its Pulsedive ID, or a related report such as its linked indicators or properties.
* **Pulsedive: Query by Value**: Retrieves an indicator by its value, such as a domain or an IP address, or a threat or feed by its name.
* **Pulsedive: Search**: Searches Pulsedive for indicators, threats, or feeds matching the criteria you supply, such as risk, indicator type, threat, feed, or attribute.

## What the App Installs

Alongside the three functions, the app installs an example workflow and a rule for each one, and a custom artifact type.

| Rule | Runs from | Workflow |
| - | - | - |
| **Pulsedive Query by ID** | An artifact of type **Pulsedive ID** | **Example: Pulsedive Query by ID** |
| **Pulsedive Query by Value** | An artifact of type **IP Address**, **DNS Name**, **URL**, or **String** | **Example: Pulsedive Query by Value** |
| **Pulsedive Search** | An incident | **Example: Pulsedive Search** |

The app also adds a **Pulsedive ID** artifact type, which holds the ID of a Pulsedive indicator, threat, or feed.
To query by ID, add an artifact of this type to an incident, then run **Pulsedive Query by ID** from it.

## Prerequisites

Before you connect QRadar SOAR to Pulsedive, make sure you have the account and access the app needs, so installation and configuration go smoothly:

* A Pulsedive account and API key.
  Find your API key on your [Pulsedive account page](https://pulsedive.com/account).
* IBM QRadar SOAR version `51.0.0` or later.
* An integration server running `resilient_circuits` `51.0.0` or later, with SSH access.
* An account with permission to edit incident fields, create and edit workflows, read, create and edit functions, read incident action invocations, edit organization data, and create and edit scripts.
  If you authenticate with an API key account, it needs `Incidents.Edit.Fields`, `Workflows.Create`, `Workflows.Edit`, `Functions.Read`, `Functions.Create`, `Functions.Edit`, `Other.ReadIncidentsActionInvocations`, Edit Org Data, `Scripts.Create`, and `Scripts.Edit`.
* Outbound connectivity from the integration server to `https://pulsedive.com` on port `443`.

## Connecting QRadar SOAR to Pulsedive

QRadar SOAR calls the Pulsedive API through an app that runs on your integration server and holds your API key.
Once the app is installed, configured, and running, its functions are available to your workflows.

**1. Install the app**

Install the app on your integration server, then import its customizations into QRadar SOAR, so its functions appear in the workflow editor.

1. Download `fn_pulsedive.zip` from the [QRadar SOAR community apps repository](https://github.com/ibmresilient/resilient-community-apps/tree/main/fn_pulsedive).

2. Copy the file to your integration server over SSH, then unzip it.

3. Install the package with pip, using the `.tar.gz` file in the unzipped directory.

4. Import the app's configuration:

   ```bash theme={null}
   resilient-circuits config -u
   ```

5. Import the app's customizations:

   ```bash theme={null}
   resilient-circuits customize -y -l fn-pulsedive
   ```

**2. Configure the app**

Add your Pulsedive credentials to the app configuration file, so the functions can authenticate.

1. Open `app.config` on the integration server.

2. Set the Pulsedive values:

   | Setting | Description |
   | - | - |
   | `pulsedive_api_key` | Your Pulsedive API key. |
   | `pulsedive_api_url` | Use `https://pulsedive.com/api/`. |

3. Save and close the file.

4. Optionally, test the configuration:

   ```bash theme={null}
   resilient-circuits selftest -l fn-pulsedive
   ```

5. Start the integration:

   ```bash theme={null}
   resilient-circuits run
   ```

For the app source and full configuration reference, visit the [Pulsedive app documentation](https://ibmresilient.github.io/resilient-community-apps/fn_pulsedive/README.html).

**3. Verify the connection**

Confirm that QRadar SOAR can retrieve Pulsedive data before you build the app into your response process.

1. Add a **DNS Name** artifact to an incident, using a domain Pulsedive already knows, such as one you can look up on [pulsedive.com](https://pulsedive.com).
2. Run the **Pulsedive Query by Value** rule on that artifact.
   Rules run from the object they are bound to, so you reach this one from the artifact rather than from the workflow list.
3. Confirm that the workflow returns a risk value and risk factors rather than an empty result.

   > [!TIP]
   >
   > An empty result on a known indicator points at the configuration rather than the indicator, so check `pulsedive_api_key` and `pulsedive_api_url` first.

## Using Pulsedive Data in QRadar SOAR

Once the app is running, add any Pulsedive function as a workflow step, so its output feeds your existing enrichment and response process.

> [!TIP]
>
> To build on an example workflow, clone it first and edit the copy, so your changes survive an app upgrade.

To understand the risk values and risk factors these functions return, visit [Risk](https://docs.pulsedive.com/model/risk.md).
To review the search criteria available to **Pulsedive: Search**, visit [Explore](https://docs.pulsedive.com/api/explore/overview.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.