Skip to main content
Mihari is an open-source query aggregator that security teams use for OSINT-based threat hunting, running scheduled searches across many services and persisting new findings for review. Pulsedive is one of Mihari’s default data sources, so once configured, Pulsedive results are included whenever a rule runs a cross search, without a separate lookup step.

Prerequisites

Before you connect Mihari to Pulsedive, make sure you have:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • Mihari installed (gem install mihari) with its configuration file set up for your database and other data sources.

Connecting Mihari to Pulsedive

Follow these steps to add your Pulsedive API key to Mihari’s configuration, so it is included in cross searches:
  1. Open Mihari’s configuration file.
  2. Add your Pulsedive API key to the Pulsedive entry under the analyzers or providers section.
  3. Save the file.
Mihari’s configuration format has changed across versions, so check the Mihari documentation for the exact key names in the version you’re running.

Verifying the Connection

Confirm that Mihari can reach Pulsedive before you rely on it in a scheduled rule.
  1. Run a cross search against an indicator you know Pulsedive has data on.
  2. Confirm that Pulsedive appears among the sources returning results.

Using Pulsedive Data in Mihari

Once configured, Pulsedive is included automatically in cross searches by IP or domain, so its results feed into the same alerts and database as Mihari’s other sources. Because Mihari persists results and flags new findings, a rule that includes Pulsedive can surface newly linked infrastructure over time, not just a single point-in-time lookup.