Skip to main content
ThreatQ is ThreatQuotient’s threat intelligence platform, where security teams store, score, and act on the intelligence their tools produce. The Pulsedive operation adds an on-demand enrichment action to ThreatQ, so an analyst or workflow can pull Pulsedive’s context onto an object without leaving the platform. ThreatQuotient builds and supports the operation, and lists it on the ThreatQ Marketplace. This is an enrichment integration that queries the Pulsedive API on demand. To import Pulsedive data in bulk instead, visit Feed.

Available Actions

The operation provides a single action that adapts to whichever object you run it on, so one action covers both indicator lookups and threat research.
  • Query: Queries Pulsedive for any context it has on the given object.
Query runs on these ThreatQ object types:
  • Indicators, specifically IP Address, IPv6 Address, FQDN, URL, and CVE
  • Adversaries
  • Events
  • Incidents
  • Intrusion Sets
  • Malware
  • Tools
  • Vulnerabilities
On an indicator, Query returns Pulsedive’s risk value, risk factors, attributes, geolocation, WHOIS registrant data, feed membership, and linked indicators. On the other object types, Query returns Pulsedive’s threat record, including the risk value, the Wikipedia summary, and recent news links.

Prerequisites

Before you connect ThreatQ to Pulsedive, make sure you have the account and access the operation needs, so installation and configuration go smoothly:
  • A Pulsedive account and API key. Find your API key on your Pulsedive account page.
  • ThreatQ version 4.34.0 or later, with permission to add and enable integrations.
  • Outbound connectivity to https://pulsedive.com on port 443.

Connecting ThreatQ to Pulsedive

ThreatQ calls the Pulsedive API through an operation that holds your API key. Once the operation is configured and enabled, the Query action appears on the object types it supports.
1

Install the operation

In ThreatQ, go to the My Integration section and install the Pulsedive operation, so ThreatQ can run it on your objects.
2

Configure the operation

Add your API key and enable the operation, so the Query action can authenticate with Pulsedive.
  1. Go to your integrations management page.
  2. Select Operation from the Type dropdown.
  3. Select the Pulsedive entry to open its details page.
  4. On the Configuration tab, enter your Pulsedive API key in the API Key field.
  5. Review the remaining settings, then select Save.
  6. Select the toggle switch above the Additional Information section to enable the operation.
For ThreatQuotient’s reference, visit the Pulsedive Operation guide.
3

Verify the connection

Confirm that ThreatQ can reach Pulsedive before you build the operation into your process.
  1. Open an indicator Pulsedive already knows, such as a domain you can look up on pulsedive.com.
  2. Run the Query action on it.
  3. Confirm that a Risk attribute and at least one Risk Factor attribute appear on the indicator.
    An empty result on a known indicator points at the configuration rather than the indicator, so check the API key and the enable toggle first.

Using Pulsedive Data in ThreatQ

Once you enable the operation, Pulsedive context lands on your objects as attributes and related indicators, so it scores and correlates alongside your other sources. Pulsedive’s linked indicators arrive with a status that reflects how directly they relate, so review them before you promote them into detection. To understand the risk values and risk factors this operation returns, visit Risk. To understand how Pulsedive links indicators to each other, visit Relationships.