Integrate with MSTICPy

MSTICPy is Microsoft’s open-source Python library for threat intelligence and security investigation, built for use in Jupyter notebooks and automated scripts. Pulsedive is a registered threat intelligence provider in MSTICPy, so once configured, you can query it through MSTICPy’s standard TILookup interface alongside any other provider you have set up, or reach for the dedicated PDlookup class when you need scanning or the query explorer instead of simple enrichment.

Prerequisites

Before you connect MSTICPy to Pulsedive, make sure you have:

A Pulsedive account and API key. Find your API key on your Pulsedive account page.
MSTICPy installed in your Python environment:
pip install msticpy

Connecting MSTICPy to Pulsedive

Follow these steps to add Pulsedive to your msticpyconfig.yaml, so it is available as a provider in your notebooks:

Open your msticpyconfig.yaml file.

Add a Pulsedive entry under TIProviders:

TIProviders:
    Pulsedive:
    Args:
        AuthKey: your_pd_api_key
    Primary: True
    Provider: Pulsedive

Save the file.

For the full set of options, including the PDlookup class, visit the MSTICPy Pulsedive notebook.

Verifying the Connection

Confirm that MSTICPy can reach Pulsedive before you rely on it in a notebook.

from msticpy.context.tilookup import TILookup
ti_lookup = TILookup()
result = ti_lookup.lookup_ioc("8.8.8.8", providers=["Pulsedive"])

Confirm that the result includes Pulsedive data before you build further logic around it.

Using Pulsedive Data in MSTICPy

Once configured, use TILookup.lookup_ioc or lookup_iocs for standard enrichment, so Pulsedive results sit alongside any other provider you are querying in the same notebook. For threat lookups, domain scanning, or Pulsedive’s query explorer, which go beyond what TILookup covers, use the PDlookup class directly instead.

Feed

SIEM & SOAR

Investigation Tools

Developer Tools

Prerequisites

Connecting MSTICPy to Pulsedive

Verifying the Connection

Using Pulsedive Data in MSTICPy