Skip to main content
Swimlane Turbine is the security automation platform teams use to build playbooks that enrich, investigate, and respond. The Pulsedive connector adds six Pulsedive actions to those playbooks, so a playbook can look up an indicator, pull its links and properties, or queue a scan without a custom API call. Swimlane builds and publishes the connector. This is an enrichment integration that queries the Pulsedive API on demand. To import Pulsedive data in bulk instead, visit Feed.
This guide covers the Pulsedive connector for Swimlane Turbine. Swimlane also publishes an older Pulsedive plugin for Swimlane 10 on AppHub, which is a separate piece of software with different capabilities.

Available Actions

These actions cover indicator lookups, relationship and property retrieval, and scanning, so a playbook can enrich what it has or request fresh analysis.
  • Get Indicators by indicator ID: Retrieves current or historical properties of an indicator by its Pulsedive indicator ID.
  • Get Indicators by Value: Retrieves an indicator by its value, such as a domain or an IP address.
  • Get Indicators Links: Retrieves the indicators linked to an indicator, such as its active DNS, reverse DNS, mail servers, redirects, and SSL certificate domains. Accepts an indicator value directly.
  • Get Indicators Properties: Retrieves an indicator’s properties, including WHOIS, geolocation, HTTP, SSL, and DNS data. Accepts an indicator ID, so query by value first when you only have the value.
  • Add to the Queue: Adds an indicator to Pulsedive’s queue for analysis and returns a queue ID.
  • Retrieve the Result: Returns the analysis result for a queue ID.
Add to the Queue takes a probe parameter that decides how Pulsedive analyzes the indicator. Set probe to 0 for a passive scan, which collects data without contacting the indicator, through WHOIS and DNS requests. Set probe to 1 for an active scan, which adds port scanning and web browser analysis and is more detectable. Swimlane’s published example for this action sends "probe":"1", so set the value deliberately rather than accepting the example. To learn what each scan type does, visit Analyze.

Prerequisites

Before you connect Turbine to Pulsedive, make sure you have the account and access the connector needs, so installation and configuration go smoothly:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • Swimlane Turbine, with permission to add connectors and create connector configurations.
  • Outbound connectivity to https://pulsedive.com on port 443.

Connecting Turbine to Pulsedive

Turbine calls the Pulsedive API through a connector configuration that holds your API key. Once the configuration is saved, any playbook can use the Pulsedive actions as steps.
1

Add the connector

In Turbine, add the Pulsedive connector, so its actions become available to your playbooks.
2

Configure authentication

Configure authentication with your API key, so the connector’s actions can authenticate with Pulsedive.
  1. Create a Pulsedive API Key Authentication configuration.
  2. Enter details for the configuration:
  3. Save the configuration.
For Swimlane’s reference, visit the Pulsedive connector documentation.
3

Verify the connection

Confirm that Turbine can reach Pulsedive before you build the connector into a playbook.
  1. Run Get Indicators by Value against an indicator Pulsedive already knows, such as a domain you can look up on pulsedive.com.
  2. Confirm that the action returns a risk value and risk factors rather than an empty result.
    An empty result on a known indicator points at the configuration rather than the indicator, so check url and x-apikey first.

Using Pulsedive Data in Turbine

Once you save the configuration, add any Pulsedive action as a playbook step, so its output feeds your existing enrichment and response workflows. Pair Add to the Queue with Retrieve the Result when you scan. The queue ID from the first action is the input to the second, and the result isn’t ready until the response reports success. To understand the risk values and risk factors these actions return, visit Risk. To understand how Pulsedive links indicators to each other, visit Relationships.