Dataminr Pulse ReGenAI

Dataminr Pulse's AI-powered, real-time intelligence integrates into Cortex XSOAR workflows for faster detection and response.

Data Enrichment & Threat Intelligence · Dataminr Pulse

Details

ID	`Dataminr Pulse ReGenAI`
Provider	Dataminr
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

Dataminr Pulse brings the most advanced AI-powered real-time intelligence into Cortex XSOAR, easily fitting into your workflows and enabling rapid identification and mitigation of emerging threats so you can deliver faster time to detection and response.

Swiftly Close The Loop From Insight to Response

Effectively detect, prioritize and manage risk to protect your physical and digital assets with the fastest real-time alerting to discover threats as they unfold.

Broad Global Threat Coverage at Unmatched AI Speed

Dataminr has been the global leader in AI for risk detection since 2009. Dataminr Pulse is relied on by two thirds of Fortune 100 companies to inform their physical and cybersecurity operations. Every day, the Dataminr multi-modal AI platform analyzes billions of public data inputs in 105 languages from over 500K global sources including the deep and dark web, enabling you to:

Gain real-time visibility into deep and dark web sources including markets, forums, paste sites, and ransomware group sites.
Get first notice on emerging attacks impacting your network and third parties affecting your business.
Detect risk at a global scale and track the emergence and global spread of vulnerabilities so you can proactively mitigate risk.
Identify new ransomware groups and track attacks as they happen, giving you visibility of attacks impacting your or third party risk perspective.

Pulse for Cyber Risk Key Use Cases

Cyber-Physical Convergence: Gain real-time intelligence on converged cyber and physical threats, including physical threats to IT and OT infrastructure, network and power outages, disasters, and emerging geopolitical risks.
Vulnerability Prioritization: Prioritize patching with visibility to the entire lifecycle of a vulnerability, from pre-CVE to exploitation, while surfacing relevant vulnerabilities in your infrastructure.
External Attack Intelligence: Mitigate risk by tracking threats to your company, subsidiaries, and 3rd parties across ransomware, APT groups, leaks, breaches, DDoS, defacement, and malware activity.
Digital Risk Detection: Get early warnings of risk to digital assets, including leaked credentials and data, account and domain impersonation, and mentions across the surface deep and dark web.

Accelerate and Enrich SOC Workflows

Accelerate, enrich and trigger triage with contextual intelligence
Activate playbooks
Improve incident investigation and response
Support analysis and threat hunting workflows
Determine threat identification, scoring and classification by type, severity and status

Use cases

Alert Ingestion

Fetches the Dataminr Alerts as an XSOAR Incident based on the configuration parameters. This will have three filters available in place.
1) Watchlist Names
2) Query
3) Alert type (severity)
Alert Enrichment

Use playbook Retrieve Alerts For IOCs - Dataminr Pulse to enrich XSOAR incidents using Dataminr Alerts.
- This playbook requires three parameters:
  1) Text to enrich
  2) Number of alerts to retrieve for each indicator
  3) A boolean to use configured watchlist names
- This playbook will extract indicators from given text (default will be entire incident context).
- After that it will retrieve alerts for each indicator and will store those alerts into context with key RetrievedDataminrAlerts.

Configure Dataminr Pulse - ReGenAI in Cortex

Navigate to Settings > Integrations > Servers & Services.
Search for Dataminr Pulse - ReGenAI.
Click Add instance to create and configure a new integration instance.

Parameter	Description	Required
Client ID	The Client ID required to authenticate to the service.	True
Client Secret	The Client Secret required to authenticate to the service.	True
Watchlist Names	Provide the watchlist names from which to fetch the alerts. If not provided, alerts will be fetched from all available watchlists on the platform.	False
Query	Terms to search within Dataminr Alerts.	False
Alert Type	Filters the incoming alerts with the provided alert type. Default All.	False
Max Fetch	The maximum number of alerts to fetch each time. If the value is greater than 100, it will be considered as 100. The maximum is 100.	False
Source Reliability	Reliability of the source providing the intelligence data.	False
Create relationships	Create relationships between indicators as part of enrichment.	False
Trust any certificate (not secure)	Indicates whether to allow connections without verifying the SSL certificate’s validity.	False
Use system proxy settings	Indicates whether to use XSOAR’s system proxy settings to connect to the API.	False
Incident type		False
Fetch incidents		False
Incidents Fetch Interval	The incident fetch interval.	False
First Fetch Time (not supported)	This parameter is not supported as Dataminr Pulse API doesn’t have time based filtering for fetching of alerts.	False

Click Test to validate the URLs, token, and connection.

(Optional) Set up Google Maps in Cortex XSOAR to Display Alert Locations in the Incident Layout

In Google Cloud Platform, do the following:
- Create a Google Cloud Project.
- Enable APIs and Services (API & Services>Dashboard> ENABLE APIS AND SERVICES).
- Enable Maps JavaScript API.
- Create the Maps JavaScript API key ( Credentials> CREATE CREDENTIALS>API key).
- Copy the Maps JavaScript API key.

Add the Maps JavaScript API key to Cortex XSOAR.

For XSOAR 6: Select Settings > ABOUT > Troubleshooting > Add Server Configuration.
For XSOAR 8: Select Settings & Info > Settings > Server Settings > Add Server Configuration.

Add the following key and value:

Key	Value
`ui.google.api.key`	`<Maps JavaScript API key>`

Click Save.

Note

If you detach the out-of-the-box mapper and make changes to it, the pack does not automatically get updates.
- If you are using a custom incident type, you also need to create custom corresponding incoming mappers.

Troubleshooting

Known Issue: Custom CVE Indicators being overridden by the default CVE Type in XSOAR 8

We created a custom indicator type “Dataminr Pulse Vulnerability Indicator” similar to “CVE” so we can show the additional fields in our customized layout.
These indicators are extracted from Dataminr Pulse ReGenAI Alerts, but some of them are still being assigned the default “CVE” indicator type instead of our custom “Dataminr Pulse Vulnerability Indicator”.

Tips for Handling the Issue

Manually edit the indicators type from CVE to Dataminr Pulse Vulnerability Indicator that were enriched by Dataminr Pulse ReGenAI Alert.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

dataminrpulse-watchlists-get

Retrieves the Watchlists configured on the Dataminr platform.

Base Command

dataminrpulse-watchlists-get

Input

There are no input arguments for this command.

Context Output

Path	Type	Description
DataminrPulse.WatchLists.id	Number	An unique identifier for an individual list. This ID is needed to retrieve alerts for a given list.
DataminrPulse.WatchLists.type	String	The type of list. Can be one of the Topic, Company, or Custom.
DataminrPulse.WatchLists.name	String	The name of list as specified in Dataminr platform.
DataminrPulse.WatchLists.subType	String	The sub type of list as specified in Dataminr platform.

Command example


#### Context Example

```json
{
    "DataminrPulse": {
        "WatchLists": [
            {
               "id": 1,
               "name": "Attack Vendor",
               "type": "TOPIC",
               "subType": "CYBER"
            },
            {
               "id": 2,
               "name": "Cyber-Physical",
               "type": "TOPIC",
               "subType": "VULNERABILITY"
            }
        ]
    }
}

Human Readable Output

Watchlists

Watchlist ID Watchlist Name Watchlist Type Watchlist Sub Type

1 Attack Vendor TOPIC CYBER

2 Cyber-Physical TOPIC VULNERABILITY

Watchlist ID	Watchlist Name	Watchlist Type	Watchlist Sub Type
1	Attack Vendor	TOPIC	CYBER
2	Cyber-Physical	TOPIC	VULNERABILITY

dataminrpulse-alerts-get

Retrieves the alerts as per the provided watchlist_ids or query or configured watchlist_names parameter in integration.

Note: The “from” and “to” arguments should not be included on the first execution, there will not be any “from” or “to” cursor to reference. Only subsequent calls should contain those parameters.

Base Command

dataminrpulse-alerts-get

Input

Argument Name	Description	Required
watchlist_ids	Comma-separated set of watchlist IDs.	Optional
query	Terms to search within Dataminr Alerts.	Optional
from	It points to a cursor that you want any alerts after. Note that only one of “from” or “to” can be included per request.	Optional
to	It points to a cursor that you want any alerts before. Note that only one of “from” and “to” can be included per request.	Optional
num	Maximum number of alerts to return. 100 is maximum value. Default is 40.	Optional
use_configured_watchlist_names	A Boolean indicating that If user does not provide watchlist IDs then it should use configured watchlist names with query parameter. Possible values are: yes, no. Default is yes.	Optional

Context Output

Path	Type	Description
DataminrPulse.Alerts.alertId	String	The unique identifier of the alert.
DataminrPulse.Alerts.alertTimestamp	String	The timestamp when the alert was generated.
DataminrPulse.Alerts.alertType.name	String	The type of alert.
DataminrPulse.Alerts.alertTopics.id	String	The topic ID associated with the alert.
DataminrPulse.Alerts.alertTopics.name	String	The topic name associated with the alert.
DataminrPulse.Alerts.alertCompanies.name	String	The company name is related to the alert.
DataminrPulse.Alerts.alertCompanies.ticker	String	The stock ticker symbol of the company.
DataminrPulse.Alerts.alertSectors.name	String	The sector name associated with the alert.
DataminrPulse.Alerts.headline	String	The main headline or summary of the alert.
DataminrPulse.Alerts.subHeadline.title	String	The subheadline title.
DataminrPulse.Alerts.subHeadline.content	String	The subheadline detailed content.
DataminrPulse.Alerts.publicPost.timestamp	String	The timestamp of the original public post.
DataminrPulse.Alerts.publicPost.href	String	The source URL of the public post.
DataminrPulse.Alerts.publicPost.text	String	The text of the public post.
DataminrPulse.Alerts.publicPost.channels	String	The channels or platforms where the post appeared.
DataminrPulse.Alerts.publicPost.media.type	String	The type of attached media.
DataminrPulse.Alerts.publicPost.media.href	String	The media hyperlink.
DataminrPulse.Alerts.publicPost.englishText	String	The english text of the public post.
DataminrPulse.Alerts.eventCorroboration.timestamp	String	The timestamp of the event corroboration.
DataminrPulse.Alerts.eventCorroboration.summary.title	String	The title of the event corroboration summary.
DataminrPulse.Alerts.eventCorroboration.summary.content	String	The content of the event corroboration summary.
DataminrPulse.Alerts.estimatedEventLocation.name	String	The estimated name or location of the event.
DataminrPulse.Alerts.estimatedEventLocation.coordinates	Number	The coordinates of the estimated event location.
DataminrPulse.Alerts.estimatedEventLocation.probabilityRadius	Number	The probability radius of the estimated location.
DataminrPulse.Alerts.assetsMatched.locationAssets.name	String	The name of the customer location asset.
DataminrPulse.Alerts.assetsMatched.locationAssets.lng	Number	The longitude of the asset.
DataminrPulse.Alerts.assetsMatched.locationAssets.lat	Number	The latitude of the asset.
DataminrPulse.Alerts.assetsMatched.locationAssets.distanceFromEventLocation	Number	The distance between the asset and the alert’s estimated event location.
DataminrPulse.Alerts.assetsMatched.locationAssets.locationGroups.name	String	The name of the location group.
DataminrPulse.Alerts.assetsMatched.thirdPartyAssets.name	String	The name of the third-party asset.
DataminrPulse.Alerts.assetsMatched.thirdPartyAssets.customerProvidedId	String	The customer-provided unique ID for the asset.
DataminrPulse.Alerts.assetsMatched.travelSegments.name	String	The name of the travel segment location or asset.
DataminrPulse.Alerts.assetsMatched.travelSegments.lng	Number	The longitude of the asset.
DataminrPulse.Alerts.assetsMatched.travelSegments.lat	Number	The latitude of the asset.
DataminrPulse.Alerts.assetsMatched.travelSegments.distanceFromEventLocation	Number	The distance between the asset and the alert’s estimated event location.
DataminrPulse.Alerts.assetsMatched.travelSegments.travelType	String	The category of travel segment, such as HOTEL or FLIGHT.
DataminrPulse.Alerts.intelAgents.summary.type	String	The type of the intelligence agent summary.
DataminrPulse.Alerts.intelAgents.summary.title	String	The title of the intelligence agent summary.
DataminrPulse.Alerts.intelAgents.summary.content	String	The content of the intelligence agent summary.
DataminrPulse.Alerts.intelAgents.version	String	The version of the intelligence agent.
DataminrPulse.Alerts.intelAgents.timestamp	String	The timestamp of the intelligence agent.
DataminrPulse.Alerts.intelAgents.discoveredEntities.name	String	The name of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.type	String	The type of discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.summary	String	The summary of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.publishedDate	String	The published date of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.products.productName	String	The product name of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.products.productVendor	String	The product vendor of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.products.productVersion	String	The product version of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.knownExploitedDate	String	The known exploited date of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.epssScore	String	The EPSS score of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.cvss	String	The CVSS score of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.exploitable	String	The exploitability of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.exploitPocLinks	String	The exploit proof of concept links of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.affectedOperatingSystems	String	The affected operating systems of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.yaraRules	String	The YARA rules of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.aliases	String	The aliases of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.topLevelTechniqueName	String	The top-level technique name of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.techniqueName	String	The technique name of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.techniqueId	String	The technique ID of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.tacticName	String	The tactic name of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.countryOfOrigin	String	The country of origin of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.threatActors	String	The threat actors related to malware of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.websiteUrl	String	The website URL associated with the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.locations.address	String	The address of the location associated with the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.industry	String	The industry in which the discovered entity operates.
DataminrPulse.Alerts.intelAgents.discoveredEntities.primaryLocation.address	String	The primary address of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.organizationType	String	The type of organization associated with the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.headOfOrganization	String	The individual who heads the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.executives	String	The executives associated with the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.operatingRegions	String	The regions in which the discovered entity operates.
DataminrPulse.Alerts.intelAgents.discoveredEntities.address	String	The address information of the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.ownedBy	String	The entity or individual that owns the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.operatedBy	String	The entity or individual that operates the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.country	String	The country in which the discovered entity is located.
DataminrPulse.Alerts.intelAgents.discoveredEntities.timezone.utcOffsetSeconds	Number	The UTC offset in seconds for the entity’s timezone.
DataminrPulse.Alerts.intelAgents.discoveredEntities.timezone.displayName	String	The display name of the entity’s timezone.
DataminrPulse.Alerts.intelAgents.discoveredEntities.stateOrProvince	String	The state or province where the discovered entity is located.
DataminrPulse.Alerts.intelAgents.discoveredEntities.population	String	The population associated with the discovered entity’s location.
DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.issuingCountry	String	The country issuing the travel advisory.
DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.issuedDate	String	The date when the travel advisory was issued.
DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.issuedCountry	String	The country for which the travel advisory was issued.
DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.advisoryText	String	The text content of the travel advisory.
DataminrPulse.Alerts.intelAgents.discoveredEntities.president	String	The president associated with the discovered entity’s country or organization.
DataminrPulse.Alerts.intelAgents.discoveredEntities.officialLanguages	String	The official languages spoken in the entity’s location.
DataminrPulse.Alerts.intelAgents.discoveredEntities.capital	String	The capital city associated with the discovered entity’s country.
DataminrPulse.Alerts.intelAgents.discoveredEntities.locationType	String	The type of location represented by the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.managedBy	String	The entity or individual responsible for managing the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.nationalities	String	The nationalities associated with the discovered entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.pastRoles.tenureStartDate	String	The start date of the entity’s past role.
DataminrPulse.Alerts.intelAgents.discoveredEntities.pastRoles.tenureEndDate	String	The end date of the entity’s past role.
DataminrPulse.Alerts.intelAgents.discoveredEntities.pastRoles.roleName	String	The name of the past role associated with the entity.
DataminrPulse.Alerts.intelAgents.discoveredEntities.currentRoles.tenureStartDate	String	The start date of the entity’s current role.
DataminrPulse.Alerts.intelAgents.discoveredEntities.currentRoles.roleName	String	The name of the current role associated with the entity.
DataminrPulse.Alerts.liveBrief.summary	String	The live brief summary.
DataminrPulse.Alerts.liveBrief.version	String	The live brief version.
DataminrPulse.Alerts.liveBrief.timestamp	String	The live brief timestamp.
DataminrPulse.Alerts.dataminrAlertUrl	String	The Dataminr alert detail URL.
DataminrPulse.Alerts.alertReferenceTerms.text	String	The reference keywords or terms for the alert.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.id	String	The vulnerability ID.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.publishedDate	String	The published date of the vulnerability.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.knownExploitedDate	String	The known exploited date of the vulnerability.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.epssScore	String	The EPSS score of the vulnerability.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.cvss	Number	The CVSS score of the vulnerability.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.products.productName	String	The vulnerable product name.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.products.productVendor	String	The vulnerable product vendor.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.products.productVersion	String	The vulnerable product version.
DataminrPulse.Alerts.metadata.cyber.vulnerabilities.exploitPocLinks	String	The exploit PoC links for the vulnerability.
DataminrPulse.Alerts.metadata.cyber.URL.name	String	The related URL name.
DataminrPulse.Alerts.metadata.cyber.addresses.ip	String	The IP address involved.
DataminrPulse.Alerts.metadata.cyber.addresses.port	Number	The port number involved.
DataminrPulse.Alerts.metadata.cyber.addresses.version	String	The protocol or software version of the address.
DataminrPulse.Alerts.metadata.cyber.addresses.type	String	The type of the address.
DataminrPulse.Alerts.metadata.cyber.malware.name	String	The malware name.
DataminrPulse.Alerts.metadata.cyber.malware.affectedOperatingSystems	String	The affected operating systems.
DataminrPulse.Alerts.metadata.cyber.threatActors.name	String	The threat actor name.
DataminrPulse.Alerts.metadata.cyber.threatActors.aliases	String	The threat actor aliases.
DataminrPulse.Alerts.metadata.cyber.threatActors.countriesOfOrigin	String	The countries of origin of the threat actor.
DataminrPulse.Alerts.metadata.cyber.asOrgs.asn	String	The autonomous system number.
DataminrPulse.Alerts.metadata.cyber.asOrgs.asOrg	String	The autonomous system organization.
DataminrPulse.Alerts.metadata.cyber.hashValues.value	String	The hash value.
DataminrPulse.Alerts.metadata.cyber.hashValues.type	String	The hash type.
DataminrPulse.Alerts.listsMatched.id	String	The matched list ID.
DataminrPulse.Alerts.listsMatched.name	String	The matched list name.
DataminrPulse.Alerts.listsMatched.subType	String	The subtype of the matched list.
DataminrPulse.Alerts.listsMatched.topicIds	String	The topic IDs of the matched list.
DataminrPulse.Alerts.linkedAlerts.count	Number	The count of linked alerts.
DataminrPulse.Alerts.linkedAlerts.parentAlertId	String	The parent alert ID of the linked alert.
DataminrPulse.Cursor.from	String	The “from” points to a cursor that specifies the alerts you want after it.
DataminrPulse.Cursor.to	String	The “to” points to a cursor that specifies the alerts you want before it.

Command example

!dataminrpulse-alerts-get num=1

Context Example

{
    "DataminrPulse": {
        "Alerts": [
            {
                "alertId": "DUMMY_ALERT_ID",
                "alertTimestamp": "2025-07-07T19:19:00.397Z",
                "alertType": {
                    "name": "Alert"
                },
                "alertTopics": [
                    {
                        "id": "DUMMY_TOPIC_ID",
                        "name": "DUMMY_TOPIC_NAME"
                    }
                ],
                "alertCompanies": [
                    {
                        "name": "DUMMY_COMPANY",
                        "ticker": "DUMMY_TICKER"
                    }
                ],
                "alertSectors": [
                    {
                        "name": "DUMMY_SECTOR"
                    }
                ],
                "headline": "Spike detected in discussion related to threat actor DUMMY_ACTOR.",
                "subHeadline": {
                    "title": "DUMMY_TITLE",
                    "content": [
                        "DUMMY_CONTENT"
                    ]
                },
                "publicPost": {
                    "timestamp": "2025-01-01T00:00:00.000Z",
                    "href": "DUMMY_URL",
                    "channels": [
                        "DUMMY_CHANNEL"
                    ],
                    "media": [
                        {
                            "type": "photo",
                            "href": "DUMMY_IMAGE_URL"
                        }
                    ]
                },
                "estimatedEventLocation": {
                    "name": "DUMMY_LOCATION",
                    "coordinates": [
                        0,
                        0
                    ],
                    "probabilityRadius": 0
                },
                "intelAgents": [
                    {
                        "summary": [
                            {
                                "type": [
                                    "CYBER"
                                ],
                                "title": "Background Information",
                                "content": [
                                    "This is a placeholder description for background information related to the issue."
                                ]
                            },
                            {
                                "type": [
                                    "CYBER"
                                ],
                                "title": "Current Status",
                                "content": [
                                    "This is a placeholder description for the current status of the issue."
                                ]
                            },
                            {
                                "type": [
                                    "CYBER"
                                ],
                                "title": "Impact",
                                "content": [
                                    "This is a placeholder description for the potential impact of the issue."
                                ]
                            }
                        ],
                        "version": "prior",
                        "timestamp": "2025-01-01T00:00:00.000Z",
                        "discoveredEntities": [
                            {
                                "name": "DUMMY_ENTITY",
                                "type": "threatActor",
                                "aliases": [
                                    "DUMMY_ALIAS"
                                ]
                            },
                            {
                                "name": "DUMMY_ENTITY02",
                                "type": "malware",
                                "affectedOperatingSystems": [
                                    "DUMMY_OS"
                                ]
                            },
                            {
                                "name": "DUMMY_ENTITY03",
                                "type": "vulnerability",
                                "publishedDate": "2025-01-01T00:00:00.000Z",
                                "epssScore": 2.0,
                                "cvss": 2.5,
                                "products": [
                                    {
                                        "productName": "DUMMY_PRODUCT",
                                        "productVendor": "DUMMY_VENDOR",
                                        "productVersion": "DUMMY_VERSION"
                                    }
                                ],
                                "exploitPocLinks": [
                                    "DUMMY_LINK"
                                ]
                            }
                        ]
                    }
                ],
                "liveBrief": [
                    {
                        "summary": "DUMMY_LIVEBRIEF",
                        "version": "prior",
                        "timestamp": "2025-01-01T00:00:00.000Z"
                    }
                ],
                "dataminrAlertUrl": "https://app.dataminr.com/#alertDetail/DUMMY",
                "alertReferenceTerms": [
                    {
                        "text": "DUMMY_REF_TERM"
                    }
                ],
                "metadata": {
                    "cyber": {
                        "vulnerabilities": [
                            {
                                "id": "DUMMY_VULN",
                                "publishedDate": "2025-01-01T00:00:00.000Z",
                                "epssScore": 2.0,
                                "cvss": 2.5,
                                "products": [
                                    {
                                        "productName": "DUMMY_PRODUCT",
                                        "productVendor": "DUMMY_VENDOR",
                                        "productVersion": "DUMMY_VERSION"
                                    }
                                ],
                                "exploitPocLinks": [
                                    "DUMMY_LINK"
                                ]
                            }
                        ],
                        "URL": [
                            {
                                "name": "DUMMY_URL"
                            }
                        ],
                        "addresses": [
                            {
                                "ip": "0.0.0.0",
                                "port": 22,
                                "version": "DUMMY_VERSION"
                            }
                        ],
                        "malware": [
                            {
                                "name": "DUMMY_MALWARE"
                            }
                        ],
                        "threatActors": [
                            {
                                "name": "DUMMY_ACTOR"
                            }
                        ],
                        "asOrgs": [
                            {
                                "asn": "DUMMY_ASN",
                                "asOrg": "DUMMY_ORG"
                            }
                        ],
                        "hashValues": [
                            {
                                "value": "DUMMY_HASH",
                                "type": "DUMMY_HASH_TYPE"
                            }
                        ]
                    }
                },
                "listsMatched": [
                    {
                        "id": 3,
                        "name": "Data Security",
                        "subType": "CYBER",
                        "topicIds": [
                            "DUMMY_TOPIC_ID"
                        ]
                    }
                ],
                "linkedAlerts": [
                    {
                        "count": 4,
                        "parentAlertId": "DUMMY_PARENT_ID"
                    }
                ]
            }
        ],
        "Cursor": {
            "from": "DUMMY_CURSOR02",
            "to": "DUMMY_CURSOR01"
        }
    }
}

Human Readable Output

Alerts

Alert Type Alert ID Alert Name Intel Agents Summary Intel Agents Discovered Entities Live Brief Watchlist Name Alert Time Alert Location Post Link Alert Topics

Alert DUMMY_ALERT_ID Spike detected in discussion related to threat actor DUMMY_ACTOR. - type: CYBER
title: Background Information
content: This is a placeholder description for background information related to the issue.
- type: CYBER
title: Current Status
content: This is a placeholder description for the current status of the issue.
- type: CYBER
title: Impact
content: This is a placeholder description for the potential impact of the issue. - name: DUMMY_ENTITY
type: threatActor
aliases: DUMMY_ALIAS
- name: DUMMY_ENTITY02
type: malware
affectedOperatingSystems: DUMMY_OS
- name: DUMMY_ENTITY03
type: vulnerability
publishedDate: 2025-01-01T00:00:00.000Z
epssScore: 2.0
cvss: 2.5
products:
- productName: DUMMY_PRODUCT
productVendor: DUMMY_VENDOR
productVersion: DUMMY_VERSION
exploitPocLinks: DUMMY_LINK - summary: DUMMY_LIVEBRIEF
version: prior
timestamp: 2025-01-01T00:00:00.000Z Data Security 2025-07-07T19:19:00.397Z DUMMY_LOCATION DUMMY_URL - id: DUMMY_TOPIC_ID
name: DUMMY_TOPIC_NAME

Alert Type	Alert ID	Alert Name	Intel Agents Summary	Intel Agents Discovered Entities	Live Brief	Watchlist Name	Alert Time	Alert Location	Post Link	Alert Topics
Alert	DUMMY_ALERT_ID	Spike detected in discussion related to threat actor DUMMY_ACTOR.	- *type: CYBER title: Background Information content: This is a placeholder description for background information related to the issue. - type: CYBER title: Current Status content: This is a placeholder description for the current status of the issue. - type: CYBER title: Impact content*: This is a placeholder description for the potential impact of the issue.	- *name: DUMMY_ENTITY type: threatActor aliases: DUMMY_ALIAS - name: DUMMY_ENTITY02 type: malware affectedOperatingSystems: DUMMY_OS - name: DUMMY_ENTITY03 type: vulnerability publishedDate: 2025-01-01T00:00:00.000Z epssScore: 2.0 cvss: 2.5 products: - productName: DUMMY_PRODUCT productVendor: DUMMY_VENDOR productVersion: DUMMY_VERSION exploitPocLinks*: DUMMY_LINK	- *summary: DUMMY_LIVEBRIEF version: prior timestamp*: 2025-01-01T00:00:00.000Z	Data Security	2025-07-07T19:19:00.397Z	DUMMY_LOCATION	DUMMY_URL	- id: DUMMY_TOPIC_ID *name*: DUMMY_TOPIC_NAME

Cursor for pagination

from to

DUMMY_CURSOR02 DUMMY_CURSOR01

from	to
DUMMY_CURSOR02	DUMMY_CURSOR01

Migration Guide

Migrated Commands

Below is the list of commands that have been migrated from the “Dataminr Pulse” integration to the “Dataminr Pulse - ReGenAI” integration.

dataminrpulse-alerts-get
dataminrpulse-watchlists-get

Deprecated Commands

The following command from the previous integration has been deprecated from the Dataminr Pulse API side with no replacement.

dataminrpulse-related-alerts-get

Configuration parameters

credentials — Client ID (required)
watchlist_names — Watchlist Names
query — Query
alert_type — Alert Type
max_fetch — Max Fetch
integrationReliability — Source Reliability
create_relationships — Create relationships
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
incidentType — Incident type
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
first_fetch — First Fetch Time (not supported)

Commands (5)

dataminrpulse-alerts-get
Retrieves the alerts as per the provided watchlist_ids or query or configured watchlist_names parameter in integration. Note: The "from" and "to" arguments should not be included on the first execution, there will not be any "from" or "to" cursor to reference. Only subsequent calls should contain those parameters.
dataminrpulse-malware-enrich
Enrich the "Dataminr Pulse Malware Indicator" custom indicator with relevant data.
dataminrpulse-threat-actor-enrich
Enrich the "Dataminr Pulse Threat Actor Indicator" custom indicator with relevant data.
dataminrpulse-vulnerability-enrich
Enrich the "Dataminr Pulse Vulnerability Indicator" custom indicator with relevant data.
dataminrpulse-watchlists-get
Retrieves the Watchlists configured on the Dataminr platform.

Source

DataminrPulseReGenAI.py DataminrPulseReGenAI_test.py DataminrPulseReGenAI.yml DataminrPulseReGenAI_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Dataminr
sectionorder:
- Connect
- Collect
commonfields:
  id: Dataminr Pulse ReGenAI
  version: -1
configuration:
- display: Client ID
  displaypassword: Client Secret
  name: credentials
  type: 9
  required: true
  section: Connect
- additionalinfo: Provide the watchlist names from which to fetch the alerts. If not provided, alerts will be fetched from all available watchlists on the platform.
  display: Watchlist Names
  name: watchlist_names
  type: 16
  required: false
  section: Collect
- additionalinfo: Terms to search within Dataminr Alerts.
  display: Query
  name: query
  type: 0
  required: false
  section: Collect
- additionalinfo: Filters the incoming alerts with the provided alert type. Default All.
  defaultvalue: All
  display: Alert Type
  name: alert_type
  options:
  - All
  - Alert
  - Urgent
  - Flash
  type: 15
  required: false
  section: Collect
- additionalinfo: The maximum number of alerts to fetch each time. If the value is greater than 100, it will be considered as 100. The maximum is 100.
  defaultvalue: "40"
  display: Max Fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: integrationReliability
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  type: 15
  required: false
  section: Collect
- defaultvalue: 'true'
  additionalinfo: Create relationships between indicators as part of enrichment.
  display: Create relationships
  name: create_relationships
  type: 8
  required: false
  section: Collect
- additionalinfo: Indicates whether to allow connections without verifying the SSL certificate's validity.
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- additionalinfo: Indicates whether to use XSOAR's system proxy settings to connect to the API.
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Incident type
  defaultvalue: Dataminr Pulse ReGenAI Alert
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Collect
- additionalinfo: The incident fetch interval.
  defaultvalue: '5'
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: This parameter is not supported as Dataminr Pulse API doesn't have time based filtering for fetching of alerts.
  defaultvalue: 0 seconds
  display: First Fetch Time (not supported)
  hidden: true
  name: first_fetch
  type: 0
  required: false
  section: Collect
description: Dataminr Pulse's AI-powered, real-time intelligence integrates into Cortex XSOAR workflows for faster detection and response.
display: Dataminr Pulse - ReGenAI
name: Dataminr Pulse ReGenAI
script:
  commands:
  - description: Retrieves the Watchlists configured on the Dataminr platform.
    name: dataminrpulse-watchlists-get
    outputs:
    - contextPath: DataminrPulse.WatchLists.id
      description: An unique identifier for an individual list. This ID is needed to retrieve alerts for a given list.
      type: Number
    - contextPath: DataminrPulse.WatchLists.type
      description: The type of list. Can be one of the Topic, Company, or Custom.
      type: String
    - contextPath: DataminrPulse.WatchLists.name
      description: The name of list as specified in Dataminr platform.
      type: String
    - contextPath: DataminrPulse.WatchLists.subType
      description: The sub type of list as specified in Dataminr platform.
      type: String
  - arguments:
    - description: Comma-separated set of watchlist IDs.
      isArray: true
      name: watchlist_ids
    - description: Terms to search within Dataminr Alerts.
      name: query
    - description: It points to a cursor that you want any alerts after. Note that only one of "from" or "to" can be included per request.
      name: from
    - description: It points to a cursor that you want any alerts before. Note that only one of "from" and "to" can be included per request.
      name: to
    - defaultValue: "40"
      description: Maximum number of alerts to return. 100 is maximum value.
      name: num
    - auto: PREDEFINED
      defaultValue: "yes"
      description: A Boolean indicating that If user does not provide watchlist IDs then it should use configured watchlist names with query parameter.
      name: use_configured_watchlist_names
      predefined:
      - yes
      - no
    description: "Retrieves the alerts as per the provided watchlist_ids or query or configured watchlist_names parameter in integration.\n\nNote: The \"from\" and \"to\" arguments should not be included on the first execution, there will not be any \"from\" or \"to\" cursor to reference. Only subsequent calls should contain those parameters."
    name: dataminrpulse-alerts-get
    outputs:
    - contextPath: DataminrPulse.Alerts.alertId
      description: The unique identifier of the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.alertTimestamp
      description: The timestamp when the alert was generated.
      type: String
    - contextPath: DataminrPulse.Alerts.alertType.name
      description: The type of alert.
      type: String
    - contextPath: DataminrPulse.Alerts.alertTopics.id
      description: The topic ID associated with the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.alertTopics.name
      description: The topic name associated with the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.alertCompanies.name
      description: The company name is related to the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.alertCompanies.ticker
      description: The stock ticker symbol of the company.
      type: String
    - contextPath: DataminrPulse.Alerts.alertSectors.name
      description: The sector name associated with the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.headline
      description: The main headline or summary of the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.subHeadline.title
      description: The subheadline title.
      type: String
    - contextPath: DataminrPulse.Alerts.subHeadline.content
      description: The subheadline detailed content.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.timestamp
      description: The timestamp of the original public post.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.href
      description: The source URL of the public post.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.text
      description: The text of the public post.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.channels
      description: The channels or platforms where the post appeared.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.media.type
      description: The type of attached media.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.media.href
      description: The media hyperlink.
      type: String
    - contextPath: DataminrPulse.Alerts.publicPost.englishText
      description: The english text of the public post.
      type: String
    - contextPath: DataminrPulse.Alerts.eventCorroboration.timestamp
      description: The timestamp of the event corroboration.
      type: String
    - contextPath: DataminrPulse.Alerts.eventCorroboration.summary.title
      description: The title of the event corroboration summary.
      type: String
    - contextPath: DataminrPulse.Alerts.eventCorroboration.summary.content
      description: The content of the event corroboration summary.
      type: String
    - contextPath: DataminrPulse.Alerts.estimatedEventLocation.name
      description: The estimated name or location of the event.
      type: String
    - contextPath: DataminrPulse.Alerts.estimatedEventLocation.coordinates
      description: The coordinates of the estimated event location.
      type: Number
    - contextPath: DataminrPulse.Alerts.estimatedEventLocation.probabilityRadius
      description: The probability radius of the estimated location.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.locationAssets.name
      description: The name of the customer location asset.
      type: String
    - contextPath: DataminrPulse.Alerts.assetsMatched.locationAssets.lng
      description: The longitude of the asset.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.locationAssets.lat
      description: The latitude of the asset.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.locationAssets.distanceFromEventLocation
      description: The distance between the asset and the alert's estimated event location.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.locationAssets.locationGroups.name
      description: The name of the location group.
      type: String
    - contextPath: DataminrPulse.Alerts.assetsMatched.thirdPartyAssets.name
      description: The name of the third-party asset.
      type: String
    - contextPath: DataminrPulse.Alerts.assetsMatched.thirdPartyAssets.customerProvidedId
      description: The customer-provided unique ID for the asset.
      type: String
    - contextPath: DataminrPulse.Alerts.assetsMatched.travelSegments.name
      description: The name of the travel segment location or asset.
      type: String
    - contextPath: DataminrPulse.Alerts.assetsMatched.travelSegments.lng
      description: The longitude of the asset.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.travelSegments.lat
      description: The latitude of the asset.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.travelSegments.distanceFromEventLocation
      description: The distance between the asset and the alert's estimated event location.
      type: Number
    - contextPath: DataminrPulse.Alerts.assetsMatched.travelSegments.travelType
      description: The category of travel segment, such as HOTEL or FLIGHT.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.summary.type
      description: The type of the intelligence agent summary.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.summary.title
      description: The title of the intelligence agent summary.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.summary.content
      description: The content of the intelligence agent summary.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.version
      description: The version of the intelligence agent.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.timestamp
      description: The timestamp of the intelligence agent.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.name
      description: The name of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.type
      description: The type of discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.summary
      description: The summary of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.publishedDate
      description: The published date of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.products.productName
      description: The product name of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.products.productVendor
      description: The product vendor of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.products.productVersion
      description: The product version of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.knownExploitedDate
      description: The known exploited date of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.epssScore
      description: The EPSS score of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.cvss
      description: The CVSS score of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.exploitable
      description: The exploitability of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.exploitPocLinks
      description: The exploit proof of concept links of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.affectedOperatingSystems
      description: The affected operating systems of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.yaraRules
      description: The YARA rules of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.aliases
      description: The aliases of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.topLevelTechniqueName
      description: The top-level technique name of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.techniqueName
      description: The technique name of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.techniqueId
      description: The technique ID of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.ttps.tacticName
      description: The tactic name of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.countryOfOrigin
      description: The country of origin of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.threatActors
      description: The threat actors related to malware of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.websiteUrl
      description: The website URL associated with the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.locations.address
      description: The address of the location associated with the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.industry
      description: The industry in which the discovered entity operates.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.primaryLocation.address
      description: The primary address of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.organizationType
      description: The type of organization associated with the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.headOfOrganization
      description: The individual who heads the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.executives
      description: The executives associated with the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.operatingRegions
      description: The regions in which the discovered entity operates.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.address
      description: The address information of the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.ownedBy
      description: The entity or individual that owns the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.operatedBy
      description: The entity or individual that operates the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.country
      description: The country in which the discovered entity is located.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.timezone.utcOffsetSeconds
      description: The UTC offset in seconds for the entity's timezone.
      type: Number
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.timezone.displayName
      description: The display name of the entity's timezone.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.stateOrProvince
      description: The state or province where the discovered entity is located.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.population
      description: The population associated with the discovered entity's location.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.issuingCountry
      description: The country issuing the travel advisory.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.issuedDate
      description: The date when the travel advisory was issued.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.issuedCountry
      description: The country for which the travel advisory was issued.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.travelAdvisories.advisoryText
      description: The text content of the travel advisory.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.president
      description: The president associated with the discovered entity's country or organization.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.officialLanguages
      description: The official languages spoken in the entity's location.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.capital
      description: The capital city associated with the discovered entity's country.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.locationType
      description: The type of location represented by the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.managedBy
      description: The entity or individual responsible for managing the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.nationalities
      description: The nationalities associated with the discovered entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.pastRoles.tenureStartDate
      description: The start date of the entity's past role.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.pastRoles.tenureEndDate
      description: The end date of the entity's past role.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.pastRoles.roleName
      description: The name of the past role associated with the entity.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.currentRoles.tenureStartDate
      description: The start date of the entity's current role.
      type: String
    - contextPath: DataminrPulse.Alerts.intelAgents.discoveredEntities.currentRoles.roleName
      description: The name of the current role associated with the entity.
      type: String
    - contextPath: DataminrPulse.Alerts.liveBrief.summary
      description: The live brief summary.
      type: String
    - contextPath: DataminrPulse.Alerts.liveBrief.version
      description: The live brief version.
      type: String
    - contextPath: DataminrPulse.Alerts.liveBrief.timestamp
      description: The live brief timestamp.
      type: String
    - contextPath: DataminrPulse.Alerts.dataminrAlertUrl
      description: The Dataminr alert detail URL.
      type: String
    - contextPath: DataminrPulse.Alerts.alertReferenceTerms.text
      description: The reference keywords or terms for the alert.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.id
      description: The vulnerability ID.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.publishedDate
      description: The published date of the vulnerability.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.knownExploitedDate
      description: The known exploited date of the vulnerability.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.epssScore
      description: The EPSS score of the vulnerability.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.cvss
      description: The CVSS score of the vulnerability.
      type: Number
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.products.productName
      description: The vulnerable product name.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.products.productVendor
      description: The vulnerable product vendor.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.products.productVersion
      description: The vulnerable product version.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.vulnerabilities.exploitPocLinks
      description: The exploit PoC links for the vulnerability.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.URL.name
      description: The related URL name.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.addresses.ip
      description: The IP address involved.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.addresses.port
      description: The port number involved.
      type: Number
    - contextPath: DataminrPulse.Alerts.metadata.cyber.addresses.version
      description: The protocol or software version of the address.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.addresses.type
      description: The type of the address.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.malware.name
      description: The malware name.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.malware.affectedOperatingSystems
      description: The affected operating systems.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.threatActors.name
      description: The threat actor name.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.threatActors.aliases
      description: The threat actor aliases.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.threatActors.countriesOfOrigin
      description: The countries of origin of the threat actor.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.asOrgs.asn
      description: The autonomous system number.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.asOrgs.asOrg
      description: The autonomous system organization.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.hashValues.value
      description: The hash value.
      type: String
    - contextPath: DataminrPulse.Alerts.metadata.cyber.hashValues.type
      description: The hash type.
      type: String
    - contextPath: DataminrPulse.Alerts.listsMatched.id
      description: The matched list ID.
      type: String
    - contextPath: DataminrPulse.Alerts.listsMatched.name
      description: The matched list name.
      type: String
    - contextPath: DataminrPulse.Alerts.listsMatched.subType
      description: The subtype of the matched list.
      type: String
    - contextPath: DataminrPulse.Alerts.listsMatched.topicIds
      description: The topic IDs of the matched list.
      type: String
    - contextPath: DataminrPulse.Alerts.linkedAlerts.count
      description: The count of linked alerts.
      type: Number
    - contextPath: DataminrPulse.Alerts.linkedAlerts.parentAlertId
      description: The parent alert ID of the linked alert.
      type: String
    - contextPath: DataminrPulse.Cursor.from
      description: The "from" points to a cursor that specifies the alerts you want after it.
      type: String
    - contextPath: DataminrPulse.Cursor.to
      description: The "to" points to a cursor that specifies the alerts you want before it.
      type: String
  - description: Enrich the "Dataminr Pulse Vulnerability Indicator" custom indicator with relevant data.
    name: dataminrpulse-vulnerability-enrich
    hidden: true
    arguments:
    - description: Raw response of the “vulnerabilities” coming through the “dataminrpulse-alerts-get” command.
      required: true
      name: vulnerability_json_data
    outputs:
    - contextPath: DataminrPulse.Vulnerability.id
      description: The vulnerability ID.
      type: String
    - contextPath: DataminrPulse.Vulnerability.cvss
      description: The CVSS score of the vulnerability.
      type: Number
    - contextPath: DataminrPulse.Vulnerability.epssScore
      description: The EPSS score of the vulnerability.
      type: Number
    - contextPath: DataminrPulse.Vulnerability.products.productName
      description: The vulnerable product name.
      type: String
    - contextPath: DataminrPulse.Vulnerability.products.productVendor
      description: The vulnerable product vendor.
      type: String
    - contextPath: DataminrPulse.Vulnerability.products.productVersion
      description: The vulnerable product version.
      type: String
    - contextPath: DataminrPulse.Vulnerability.exploitPocLinks
      description: The exploit PoC links for the vulnerability.
      type: String
    - contextPath: DataminrPulse.Vulnerability.summary
      description: The summary of the vulnerability.
      type: String
    - contextPath: DataminrPulse.Vulnerability.type
      description: The type of the indicator.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.value
      description: The value of the indicator.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.type
      description: The type of the indicator.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.cvss
      description: The CVSS score of the vulnerability.
      type: Number
    - contextPath: DataminrPulseVulnerabilityIndicator.epssScore
      description: The EPSS score of the vulnerability.
      type: Number
    - contextPath: DataminrPulseVulnerabilityIndicator.products.productName
      description: The vulnerable product name.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.products.productVendor
      description: The vulnerable product vendor.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.products.productVersion
      description: The vulnerable product version.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.exploitPocLinks
      description: The exploit PoC links for the vulnerability.
      type: String
    - contextPath: DataminrPulseVulnerabilityIndicator.summary
      description: The summary of the vulnerability.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Reliability
      description: The reliability of the vendor.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
  - description: Enrich the "Dataminr Pulse Malware Indicator" custom indicator with relevant data.
    name: dataminrpulse-malware-enrich
    hidden: true
    arguments:
    - description: Raw response of the “malware” coming through the “dataminrpulse-alerts-get” command.
      required: true
      name: malware_json_data
    outputs:
    - contextPath: DataminrPulse.Malware.name
      description: The malware name.
      type: String
    - contextPath: DataminrPulse.Malware.type
      description: The type of the indicator.
      type: String
    - contextPath: DataminrPulse.Malware.affectedOperatingSystems
      description: The affected operating systems.
      type: String
    - contextPath: DataminrPulse.Malware.summary
      description: The summary of the malware.
      type: String
    - contextPath: DataminrPulse.Malware.yaraRules
      description: The YARA rules for the malware.
      type: String
    - contextPath: DataminrPulseMalwareIndicator.value
      description: The value of the indicator.
      type: String
    - contextPath: DataminrPulseMalwareIndicator.type
      description: The type of the indicator.
      type: String
    - contextPath: DataminrPulseMalwareIndicator.affectedOperatingSystems
      description: The affected operating systems.
      type: String
    - contextPath: DataminrPulseMalwareIndicator.yaraRules
      description: The YARA rules for the malware.
      type: String
    - contextPath: DataminrPulseMalwareIndicator.summary
      description: The summary of the malware.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Reliability
      description: The reliability of the vendor.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
  - description: Enrich the "Dataminr Pulse Threat Actor Indicator" custom indicator with relevant data.
    name: dataminrpulse-threat-actor-enrich
    hidden: true
    arguments:
    - description: Raw response of the “threat actor” coming through the “dataminrpulse-alerts-get” command.
      required: true
      name: threat_actor_json_data
    outputs:
    - contextPath: DataminrPulse.ThreatActor.name
      description: The threat actor name.
      type: String
    - contextPath: DataminrPulse.ThreatActor.type
      description: The type of the indicator.
      type: String
    - contextPath: DataminrPulse.ThreatActor.summary
      description: The summary of the threat actor.
      type: String
    - contextPath: DataminrPulse.ThreatActor.aliases
      description: The aliases of the threat actor.
      type: String
    - contextPath: DataminrPulse.ThreatActor.ttps
      description: The TTPs of the threat actor.
      type: String
    - contextPath: DataminrPulse.ThreatActor.countryOfOrigin
      description: The country of origin of the threat actor.
      type: String
    - contextPath: DataminrPulseThreatActorIndicator.value
      description: The value of the indicator.
      type: String
    - contextPath: DataminrPulseThreatActorIndicator.type
      description: The type of the indicator.
      type: String
    - contextPath: DataminrPulseThreatActorIndicator.aliases
      description: The aliases of the threat actor.
      type: String
    - contextPath: DataminrPulseThreatActorIndicator.ttps
      description: The TTPs of the threat actor.
      type: String
    - contextPath: DataminrPulseThreatActorIndicator.countryOfOrigin
      description: The country of origin of the threat actor.
      type: String
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Reliability
      description: The reliability of the vendor.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
marketplaces:
- xsoar
- marketplacev2
- platform
tests:
- No tests (auto formatted)
defaultmapperin: Dataminr Pulse - Incoming Mapper

Dataminr Pulse ReGenAI

Details

README

Overview

Swiftly Close The Loop From Insight to Response

Broad Global Threat Coverage at Unmatched AI Speed

Pulse for Cyber Risk Key Use Cases

Accelerate and Enrich SOC Workflows

Use cases

Alert Ingestion

Alert Enrichment

Configure Dataminr Pulse - ReGenAI in Cortex

(Optional) Set up Google Maps in Cortex XSOAR to Display Alert Locations in the Incident Layout

Note

Troubleshooting

Known Issue: Custom CVE Indicators being overridden by the default CVE Type in XSOAR 8

Tips for Handling the Issue

Commands

dataminrpulse-watchlists-get

Base Command

Input

Context Output

Command example

Human Readable Output

Watchlists

dataminrpulse-alerts-get

Base Command

Input

Context Output

Command example

Context Example

Human Readable Output

Alerts

Cursor for pagination

Migration Guide

Migrated Commands

Deprecated Commands

Configuration parameters

Commands (5)

Source