Skip to main content
TheHive is an open-source case management platform that security teams use to investigate and respond to incidents, and it delegates observable enrichment to Cortex, its companion analysis engine. The Pulsedive analyzer runs inside Cortex, so once it is enabled, any analyst working a case in TheHive can enrich an observable with Pulsedive’s risk data without leaving their investigation.
This analyzer is community-maintained; the underlying Pulsedive endpoint it calls is stable, but confirm it still behaves as expected in your environment before relying on it.

Prerequisites

Before you connect Cortex to Pulsedive, make sure you have:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • A Cortex instance connected to your TheHive instance, with permission to enable and configure analyzers.

Connecting Cortex to Pulsedive

Follow these steps to enable the Pulsedive analyzer in Cortex, so it becomes available as an enrichment option in TheHive:
  1. In Cortex, go to Organization > Analyzers.
  2. Find Pulsedive_GetIndicator in the analyzer catalog and select it to enable it for your organization.
  3. Open its configuration and enter your Pulsedive API key.
  4. Save the configuration.
For the analyzer’s source and any updates, visit the Pulsedive analyzer on GitHub.

Verifying the Connection

Confirm that the analyzer runs successfully before you rely on it during an investigation.
  1. In TheHive, open a case with a domain, IP, URL, or hash observable.
  2. Run the Pulsedive_GetIndicator analyzer on it.
  3. Confirm that a short report with Pulsedive data appears.

Using Pulsedive Data in TheHive

Once enabled, run the Pulsedive analyzer on any supported observable in a case, so its risk data and threat associations become part of your investigation record. The analyzer supports domain, IP, URL, and hash observables, and returns both a short summary and a long report, so you can scan results quickly or dig into the full detail when an indicator warrants it.