> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with MSTICPy

> Configure Pulsedive as a threat intelligence provider in MSTICPy to enrich IOCs from Python notebooks and scripts.

[MSTICPy](https://msticpy.readthedocs.io/en/latest/) is Microsoft's open-source Python library for threat intelligence and security investigation, built for use in Jupyter notebooks and automated scripts.
Pulsedive is a registered threat intelligence provider in MSTICPy, so once configured, you can query it through MSTICPy's standard `TILookup` interface alongside any other provider you have set up, or reach for the dedicated `PDlookup` class when you need scanning or the query explorer instead of simple enrichment.

## Prerequisites

Before you connect MSTICPy to Pulsedive, make sure you have:

* A Pulsedive account and API key.
  Find your API key on your [Pulsedive account page](https://pulsedive.com/account).
* MSTICPy installed in your Python environment:

  ```
  pip install msticpy
  ```

## Connecting MSTICPy to Pulsedive

Follow these steps to add Pulsedive to your `msticpyconfig.yaml`, so it is available as a provider in your notebooks:

1. Open your `msticpyconfig.yaml` file.

2. Add a Pulsedive entry under `TIProviders`:

   ```yaml theme={null}
   TIProviders:
       Pulsedive:
       Args:
           AuthKey: your_pd_api_key
       Primary: True
       Provider: Pulsedive
   ```

3. Save the file.

For the full set of options, including the `PDlookup` class, visit the [MSTICPy Pulsedive notebook](https://github.com/microsoft/msticpy/blob/main/docs/notebooks/PulsediveLookup.ipynb).

## Verifying the Connection

Confirm that MSTICPy can reach Pulsedive before you rely on it in a notebook.

```python theme={null}
from msticpy.context.tilookup import TILookup
ti_lookup = TILookup()
result = ti_lookup.lookup_ioc("8.8.8.8", providers=["Pulsedive"])
```

Confirm that the result includes Pulsedive data before you build further logic around it.

## Using Pulsedive Data in MSTICPy

Once configured, use `TILookup.lookup_ioc` or `lookup_iocs` for standard enrichment, so Pulsedive results sit alongside any other provider you are querying in the same notebook.

For threat lookups, domain scanning, or Pulsedive's query explorer, which go beyond what `TILookup` covers, use the `PDlookup` class directly instead.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.