Feeds

Feeds are curated collections of indicators sourced from third-party organizations, research projects, or automated intelligence pipelines. They answer a fundamental provenance question: where did this indicator come from, and who is tracking it?

​

Identity

Each feed has a name and belongs to an organization. Pulsedive assigns each feed a category, such as malware, attack, botnet, or spam, which classifies the type of activity the feed tracks. Feeds also carry a pricing tier (pricing), which reflects the source feed’s own pricing model, not a Pulsedive plan. This tells you whether the upstream source is free or commercial.

​

Schedule and Access

Each feed includes a schedule field that describes how frequently the feed provider updates it. The accesslink field points to where you can access or subscribe to the feed at its source.

​

Lifecycle Timestamps

Feeds carry four timestamps that together describe both the feed’s metadata history and the freshness of its data: The gap between stamp_pulled and stamp_modified is a useful freshness signal for the source. If stamp_pulled is recent and stamp_modified is close behind it, the source is actively producing new data. If stamp_pulled is recent but stamp_modified is significantly older, the source feed has gone stale: Pulsedive is retrieving on schedule, but the upstream provider has not published anything new in some time.

​

Indicator Summary

Feeds surface aggregated data from their linked indicators, giving you a high-level view of the feed’s contents without retrieving the full indicator list. The summary includes:

• Aggregated attributes across linked indicators
• Common properties observed across linked indicators
• Screenshots collected from linked indicators

Feeds do not carry native attributes or properties of their own. All enrichment data in a feed summary comes from the indicators the feed contains.

​

Indicators

A feed’s linked indicators are retrieved separately from the feed’s core data, which keeps responses efficient when you need only the feed’s metadata. Linked indicator results are paginated.

​

Risk

Pulsedive does not assign risk directly to feeds. A feed’s risk summary reflects the distribution of risk levels across its linked indicators, giving you a quick read on the overall severity of the activity the feed tracks.