> ## Documentation Index
> Fetch the complete documentation index at: https://docs.pulsedive.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Feeds

> Learn how Pulsedive represents third-party intelligence collections, including provenance, update schedules, and linked indicators.

Feeds are curated collections of indicators sourced from third-party organizations, research projects, or automated intelligence pipelines.
They answer a fundamental provenance question: where did this indicator come from, and who is tracking it?

### Identity

Each feed has a name and belongs to an organization.
Pulsedive assigns each feed a category, such as `malware`, `attack`, `botnet`, or `spam`, which classifies the type of activity the feed tracks.

Feeds also carry a pricing tier (`pricing`), which reflects the source feed's own pricing model, not a Pulsedive plan.
This tells you whether the upstream source is free or commercial.

### Schedule and Access

Each feed includes a `schedule` field that describes how frequently the feed provider updates it.
The `accesslink` field points to where you can access or subscribe to the feed at its source.

### Lifecycle Timestamps

Feeds carry four timestamps that together describe both the feed's metadata history and the freshness of its data:

| Field            | Description                                          |
| ---------------- | ---------------------------------------------------- |
| `stamp_added`    | When Pulsedive first added the feed                  |
| `stamp_updated`  | When Pulsedive last updated the feed's metadata      |
| `stamp_pulled`   | When Pulsedive last retrieved data from the feed     |
| `stamp_modified` | When the feed's data was last modified at the source |

The gap between `stamp_pulled` and `stamp_modified` is a useful freshness signal for the source.
If `stamp_pulled` is recent and `stamp_modified` is close behind it, the source is actively producing new data.
If `stamp_pulled` is recent but `stamp_modified` is significantly older, the source feed has gone stale: Pulsedive is retrieving on schedule, but the upstream provider has not published anything new in some time.

### Indicator Summary

Feeds surface aggregated data from their linked indicators, giving you a high-level view of the feed's contents without retrieving the full indicator list.
The summary includes:

* Aggregated attributes across linked indicators
* Common properties observed across linked indicators
* Screenshots collected from linked indicators

Feeds do not carry native attributes or properties of their own.
All enrichment data in a feed summary comes from the indicators the feed contains.

### Indicators

A feed's linked indicators are retrieved separately from the feed's core data, which keeps responses efficient when you need only the feed's metadata.
Linked indicator results are paginated.

### Risk

Pulsedive does not assign risk directly to feeds.
A feed's risk summary reflects the distribution of risk levels across its linked indicators, giving you a quick read on the overall severity of the activity the feed tracks.