Skip to main content
Sumo Logic Automation Service and Cloud SOAR are the platforms security teams use to automate enrichment, investigation, and response through playbooks. The Pulsedive integration adds six Pulsedive actions to those playbooks, so a playbook can look up an indicator’s reputation, retrieve threat context, or submit an indicator for scanning without a custom API call. Sumo Logic builds and publishes the integration, and distributes it through App Central. This is an enrichment integration that queries the Pulsedive API on demand. To import Pulsedive data in bulk instead, visit Feed.

Available Actions

These actions cover indicator lookups, threat context, and scan submission, so a playbook can enrich a value, pull the story behind a threat, or request fresh analysis.
  • IP Reputation: Gathers reputation information for a specific IP.
  • URL Reputation: Gathers reputation information for a specific URL.
  • Domain Reputation: Gathers reputation information for a specific domain.
  • Get Threat details: Gets threat details by threat ID or by threat name.
  • Add to Queue: Adds the indicator to the queue for processing. This submits the indicator to Pulsedive for scanning. Use it only where submitting an indicator suits your analysis, and pair it with Retrieve Result from Queue to collect the result.
  • Retrieve Result from Queue: Gathers information on a specific indicator value.

Prerequisites

Before you connect Sumo Logic to Pulsedive, make sure you have the account and access the integration needs, so installation and configuration go smoothly:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • Sumo Logic Automation Service or Cloud SOAR, with permission to add integrations from App Central.
  • Outbound connectivity to https://pulsedive.com on port 443.

Connecting Sumo Logic to Pulsedive

Sumo Logic calls the Pulsedive API through an integration resource that holds your API key. Once the resource is configured, any playbook can use the Pulsedive actions as steps.
1

Install the integration

Go to Sumo Logic’s App Central and install the Pulsedive integration, so its actions become available in Sumo Logic.
2

Configure the resource

Add your API key to the integration’s resource, so its actions can authenticate with Pulsedive.
If you configured the resource during installation, skip to the next step.
  1. Open the Integrations page.
    • In the new UI, select Automation > Integrations from the main Sumo Logic menu.
    • In the classic UI, select Automation from the main menu, then select Integrations in the left nav bar.
  2. Select the installed Pulsedive integration.
  3. Hover over the resource name and select Edit.
  4. Enter details for the resource:
  5. Select TEST and confirm the configuration passes, then select SAVE.
For Sumo Logic’s reference, visit the Pulsedive integration page.
3

Verify the connection

Confirm that Sumo Logic can retrieve Pulsedive data before you build the integration into a playbook.
  1. Run Domain Reputation against an indicator Pulsedive already knows, such as a domain you can look up on pulsedive.com.
  2. Confirm that the action returns a risk value and risk factors rather than an empty result.
    An empty result on a known indicator points at the resource configuration rather than the indicator, so check the API key and URL first.

Using Pulsedive Data in Sumo Logic

Once you configure the resource, add any Pulsedive action as a playbook step, so its output feeds your existing enrichment and response workflows. To understand the risk values and risk factors these actions return, visit Risk.