> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate with ThreatQuotient

> Use the ThreatQ Pulsedive operation to enrich indicators, adversaries, malware, and other ThreatQ objects with Pulsedive risk and threat context.

[ThreatQ](https://www.threatq.com/) is ThreatQuotient's threat intelligence platform, where security teams store, score, and act on the intelligence their tools produce.
The Pulsedive operation adds an on-demand enrichment action to ThreatQ, so an analyst or workflow can pull Pulsedive's context onto an object without leaving the platform.
ThreatQuotient builds and supports the operation, and lists it on the ThreatQ Marketplace.

This is an enrichment integration that queries the Pulsedive API on demand.
To import Pulsedive data in bulk instead, visit [Feed](https://docs.pulsedive.com/export/overview.md).

## Available Actions

The operation provides a single action that adapts to whichever object you run it on, so one action covers both indicator lookups and threat research.

* **Query**: Queries Pulsedive for any context it has on the given object.

Query runs on these ThreatQ object types:

* Indicators, specifically IP Address, IPv6 Address, FQDN, URL, and CVE
* Adversaries
* Events
* Incidents
* Intrusion Sets
* Malware
* Tools
* Vulnerabilities

On an indicator, Query returns Pulsedive's risk value, risk factors, attributes, geolocation, WHOIS registrant data, feed membership, and linked indicators.
On the other object types, Query returns Pulsedive's threat record, including the risk value, the Wikipedia summary, and recent news links.

## Prerequisites

Before you connect ThreatQ to Pulsedive, make sure you have the account and access the operation needs, so installation and configuration go smoothly:

* A Pulsedive account and API key.
  Find your API key on your [Pulsedive account page](https://pulsedive.com/account).
* ThreatQ version `4.34.0` or later, with permission to add and enable integrations.
* Outbound connectivity to `https://pulsedive.com` on port `443`.

## Connecting ThreatQ to Pulsedive

ThreatQ calls the Pulsedive API through an operation that holds your API key.
Once the operation is configured and enabled, the Query action appears on the object types it supports.

**1. Install the operation**

In ThreatQ, go to the **My Integration** section and install the Pulsedive operation, so ThreatQ can run it on your objects.

**2. Configure the operation**

Add your API key and enable the operation, so the Query action can authenticate with Pulsedive.

1. Go to your integrations management page.
2. Select **Operation** from the **Type** dropdown.
3. Select the Pulsedive entry to open its details page.
4. On the **Configuration** tab, enter your Pulsedive API key in the **API Key** field.
5. Review the remaining settings, then select **Save**.
6. Select the toggle switch above the **Additional Information** section to enable the operation.

For ThreatQuotient's reference, visit the [Pulsedive Operation guide](https://helpcenter.threatq.com/Integration_Documentation/operation/Pulsedive_Operation.htm).

**3. Verify the connection**

Confirm that ThreatQ can reach Pulsedive before you build the operation into your process.

1. Open an indicator Pulsedive already knows, such as a domain you can look up on [pulsedive.com](https://pulsedive.com).
2. Run the **Query** action on it.
3. Confirm that a **Risk** attribute and at least one **Risk Factor** attribute appear on the indicator.

   > [!TIP]
   >
   > An empty result on a known indicator points at the configuration rather than the indicator, so check the API key and the enable toggle first.

## Using Pulsedive Data in ThreatQ

Once you enable the operation, Pulsedive context lands on your objects as attributes and related indicators, so it scores and correlates alongside your other sources.

Pulsedive's linked indicators arrive with a status that reflects how directly they relate, so review them before you promote them into detection.

To understand the risk values and risk factors this operation returns, visit [Risk](https://docs.pulsedive.com/model/risk.md).
To understand how Pulsedive links indicators to each other, visit [Relationships](https://docs.pulsedive.com/model/relationships.md).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.