# Pulsedive Docs

> Official API documentation for Pulsedive threat intelligence platform. Retrieve enriched indicator data, look up threats and feeds, scan IOCs for analysis, query the Pulsedive database, automate workflows, and consume intelligence via STIX 2.1/TAXII 2.1.

- [Pulsedive Documentation](https://docs.pulsedive.com/index.md): Find everything you need to look up indicators, investigate threats, and integrate Pulsedive into your detection and response workflows.
- [Data Model](https://docs.pulsedive.com/model/overview.md): Learn how Pulsedive structures threat intelligence around three core entities: indicators, threats, and feeds, and how they relate to each other.
- [How Pulsedive Collects Data](https://docs.pulsedive.com/model/collection.md): Learn how Pulsedive enriches indicators through scanning, third-party sources, community submissions, and research, and how to interpret freshness timestamps.
- [Indicators](https://docs.pulsedive.com/model/indicators.md): Learn how Pulsedive enriches observable entities into indicators, including risk scoring, properties, attributes, and lifecycle tracking.
- [Threats](https://docs.pulsedive.com/model/threats.md): Understand how Pulsedive models malware families, adversary groups, and campaigns, and how they connect to indicators and feeds.
- [Feeds](https://docs.pulsedive.com/model/feeds.md): Learn how Pulsedive represents third-party intelligence collections, including provenance, update schedules, and linked indicators.
- [Relationships](https://docs.pulsedive.com/model/relationships.md): Explore how indicators, threats, and feeds connect in Pulsedive, including typed indicator links and cross-entity summaries.
- [Risk](https://docs.pulsedive.com/model/risk.md): Understand Pulsedive's risk levels, how indicator risk is calculated and overridden, and how risk rolls up into threat and feed summaries.
- [Overview](https://docs.pulsedive.com/addon/overview.md): Enrich web content with Pulsedive threat intelligence directly in your browser.
- [Usage](https://docs.pulsedive.com/addon/usage.md): How to use the Pulsedive browser add-on to streamline threat research.
- [API Reference](https://docs.pulsedive.com/api/overview.md): Access comprehensive threat intelligence through Pulsedive's API. Search indicators, scan for threats, retrieve feed data, and automate security workflows with the same endpoints that power our web interface.
- [Quickstart](https://docs.pulsedive.com/api/quickstart.md): Jump into Pulsedive’s powerful threat intelligence. This quickstart guide walks you through getting your API key, authenticating your first request, and retrieving data--all in under five minutes. No fluff, all action.
- [Authentication](https://docs.pulsedive.com/api/authentication.md): Securely authenticate your requests to Pulsedive’s API to enable seamless access to threat intelligence data.
- [Responses](https://docs.pulsedive.com/api/responses.md): Understand Pulsedive API response formats, HTTP status codes, and error handling.
- [Rate Limits](https://docs.pulsedive.com/api/limits.md): Understand Pulsedive API rate limits, monitor usage with HTTP headers, and handle 429 errors.
- [Pagination](https://docs.pulsedive.com/api/pagination.md): Retrieve large datasets efficiently with automatic page breaks.
- [Indicators](https://docs.pulsedive.com/api/indicator/overview.md): Get threat intelligence for domains, IPs, and URLs.
- [Get Indicator by Value](https://docs.pulsedive.com/api/indicator/get-by-value.md): Retrieve detailed threat intelligence information for a specific indicator by looking up the indicator's value. To query links and properties, retrieve the indicator by ID instead.
- [Get Indicator by ID](https://docs.pulsedive.com/api/indicator/get-by-id.md): Retrieve detailed threat intelligence information for a specific indicator by looking up the indicator's unique identifier.
- [Get Indicator Links or Properties](https://docs.pulsedive.com/api/indicator/get-links-properties.md): Retrieve links or properties for a specific indicator.
- [Scan an Indicator](https://docs.pulsedive.com/api/scan/overview.md): Scan indicators on-demand to gather fresh threat intelligence, with or without storing results.
- [Add Indicator to the Queue](https://docs.pulsedive.com/api/scan/add.md): Add an indicator to the scanning queue and receive a queue ID, so you can poll for results.
- [Poll for Scan Results](https://docs.pulsedive.com/api/scan/poll.md): Poll for scan results using the queue ID returned from the POST request.
- [Explore](https://docs.pulsedive.com/api/explore/overview.md): Search across Pulsedive's threat intelligence dataset using flexible queries with boolean logic.
- [Query Language](https://docs.pulsedive.com/api/explore/query-language.md): Learn Pulsedive's query language syntax for searching threat intelligence data. Use boolean logic, wildcards, and field-specific searches to find indicators by risk, type, attributes, and more.
- [Search Dataset](https://docs.pulsedive.com/api/explore/search.md): Query Pulsedive's dataset using the Explore query language. Search across indicators or threats by value, type, risk, timestamps, feeds, attributes, and properties using boolean logic and wildcards.
- [Threats](https://docs.pulsedive.com/api/threat/overview.md): Retrieve information on malware families, threat actors, and campaigns.
- [Get Threat by Name](https://docs.pulsedive.com/api/threat/get-by-name.md): Retrieve detailed threat intelligence information for a specific threat by looking up the threat's name. To query links, retrieve the threat by ID instead.
- [Get Threat by ID](https://docs.pulsedive.com/api/threat/get-by-id.md): Retrieve detailed threat intelligence information for a specific threat by looking up the threat's ID.
- [Get Linked Indicators](https://docs.pulsedive.com/api/threat/get-linked-indicators.md): Retrieve indicators linked to a specific threat.
- [Feeds](https://docs.pulsedive.com/api/feed/overview.md): Access curated threat intelligence collections from security providers.
- [Get Feed by Name and Organization](https://docs.pulsedive.com/api/feed/get-by-name-organization.md): Retrieve detailed threat intelligence information for a specific feed by looking up the feed's unique identifier.
- [Get Feed by ID](https://docs.pulsedive.com/api/feed/get-by-id.md): Retrieve detailed threat intelligence information for a specific feed by looking up the feed's unique identifier.
- [Get Linked Indicators](https://docs.pulsedive.com/api/feed/get-linked-indicators.md): Retrieve indicators linked to a specific feed.
- [STIX/TAXII Reference](https://docs.pulsedive.com/taxii/overview.md): Export indicators and threats using industry-standard STIX format through our TAXII 2.1 endpoint.
- [Quick Setup](https://docs.pulsedive.com/taxii/quick-setup.md): Server endpoints, authentication, and platform-specific setup instructions for Pulsedive's TAXII server.
- [Authentication](https://docs.pulsedive.com/taxii/authentication.md): Authenticate with Pulsedive's TAXII server using your API key through HTTP Basic Auth or query parameters.
- [Versioning](https://docs.pulsedive.com/taxii/versioning.md): Content negotiation and version support for Pulsedive's TAXII 2.1 implementation.
- [Filtering](https://docs.pulsedive.com/taxii/filtering.md): Refine TAXII results using query string filter parameters.
- [Pagination](https://docs.pulsedive.com/taxii/pagination.md): Retrieve large result sets efficiently using next token or timestamp-based pagination.
- [API Roots](https://docs.pulsedive.com/taxii/api-root/overview.md): Discover available API roots and server capabilities through Pulsedive's TAXII server endpoints.
- [Get API Roots](https://docs.pulsedive.com/taxii/api-root/get.md): Get information about available API roots and server capabilities.
- [Collections](https://docs.pulsedive.com/taxii/collection/overview.md): Access organized sets of STIX threat intelligence through TAXII collections.
- [Get Collections](https://docs.pulsedive.com/taxii/collection/get.md): Get information about all [available collections](/taxii/collection/overview#available-collections) in the API root.
- [Objects](https://docs.pulsedive.com/taxii/object/overview.md): Retrieve individual STIX objects from collections with filtering and pagination support.
- [Get Objects](https://docs.pulsedive.com/taxii/object/get.md): Fetch STIX objects from a specific collection with optional filtering and pagination.
- [Bulk Export](https://docs.pulsedive.com/export/overview.md): Export Pulsedive's threat intelligence dataset in bulk for automated ingestion into your security tooling.
- [CSV Export](https://docs.pulsedive.com/export/csv.md): Configure and automate bulk indicator exports from Pulsedive in CSV format.
- [STIX/TAXII Export](https://docs.pulsedive.com/export/taxii.md): Export Pulsedive threat intelligence in STIX 2.1 format via the TAXII 2.1 server.
- [Choose an Export Format](https://docs.pulsedive.com/export/formats.md): Compare CSV and STIX/TAXII 2.1 to find the right format for your security workflow.
- [Get an Export](https://docs.pulsedive.com/export/get.md): Configure your export format, find your API key, and pull your first Pulsedive Feed export.
- [Automate Your Export](https://docs.pulsedive.com/export/automate.md): Automate recurring Pulsedive Feed exports and integrate them into your existing security tooling.
- [Integrations](https://docs.pulsedive.com/integrations.md): Connect Pulsedive to your third-party solutions, including threat intelligence platforms (TIP), SIEM, and SOAR. Step-by-step setup guides for bulk ingestion, workflow enrichment, and blocklist integrations.
- [Integrate with Microsoft Sentinel](https://docs.pulsedive.com/integrations/microsoft-sentinel.md): Import scored, deduplicated Pulsedive threat intelligence into Microsoft Sentinel over TAXII 2.1 to power detection, alerting, and investigation.
- [Integrate with OpenCTI](https://docs.pulsedive.com/integrations/opencti.md): Import scored, deduplicated Pulsedive threat intelligence into OpenCTI over TAXII 2.1 for correlation, investigation, and sharing.
- [Integrate with Splunk Enterprise Security](https://docs.pulsedive.com/integrations/splunk-enterprise-security.md): Bring Pulsedive threat intelligence into Splunk Enterprise Security as a CSV-based lookup for correlation and risk scoring.
- [Integrate with Tines](https://docs.pulsedive.com/integrations/tines.md): Use Tines's pre-built Pulsedive Stories and action templates to add threat intelligence enrichment to any security automation workflow.
- [Libraries](https://docs.pulsedive.com/libraries.md): Explore community libraries for the Pulsedive API. Find SDKs, client libraries, and tools to integrate threat intelligence into your applications.
- [Troubleshoot](https://docs.pulsedive.com/troubleshoot.md): Get help with Pulsedive: troubleshoot common issues, connect with the community, or reach the team directly.
- [Customer Support](https://docs.pulsedive.com/troubleshoot/support.md): Get help with Pulsedive’s API and threat intelligence platform. Find answers, troubleshoot common issues, and get personalized assistance.
- [Account Management](https://docs.pulsedive.com/troubleshoot/common-issues/account-management.md): Diagnose and resolve the most common issues customers experience when managing their Pulsedive account.
- [Scan](https://docs.pulsedive.com/troubleshoot/common-issues/scan.md): Diagnose issues when a scan doesn't return the data you expect or seems stuck.
- [Risk Score](https://docs.pulsedive.com/troubleshoot/common-issues/risk-score.md): Understand what's behind an indicator's risk score, and what to do if you disagree with it.
- [Feed](https://docs.pulsedive.com/troubleshoot/common-issues/feed.md): Diagnose TAXII connectivity issues and errors when pulling a specific collection.
- [API](https://docs.pulsedive.com/troubleshoot/common-issues/api.md): Diagnose and resolve the most common issues developers hit when working with Pulsedive's API.
- [Browser Add-On](https://docs.pulsedive.com/troubleshoot/common-issues/browser-addon.md): Resolve issues with highlighting, popups, and auto-scan behavior in the Pulsedive browser add-on.
- [Connecting to the Pulsedive Docs MCP server](https://docs.pulsedive.com/troubleshoot/resources/docs-mcp.md): Connect Claude, Cursor, and other AI tools to a read-only MCP server so they can search Pulsedive's documentation directly.

## OpenAPI Specs

- [feed-by-id](/api/feed/feed-by-id.yaml)
- [feed-by-name-and-org](/api/feed/feed-by-name-and-org.yaml)
- [feed-get-links](/api/feed/feed-get-links.yaml)
- [indicator-by-id](/api/indicator/indicator-by-id.yaml)
- [indicator-by-value](/api/indicator/indicator-by-value.yaml)
- [indicator-get-links-properties](/api/indicator/indicator-get-links-properties.yaml)
- [scan-explore](/api/scan-explore.yaml)
- [threat-by-id](/api/threat/threat-by-id.yaml)
- [threat-by-name](/api/threat/threat-by-name.yaml)
- [threat-get-links](/api/threat/threat-get-links.yaml)
- [api](/taxii/api.yaml)

## Optional

- [About Us](https://pulsedive.com/about/company)
- [Community](https://pulsedive.com/discord)
- [Blog](https://blog.pulsedive.com)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.