Pulsedive

Enrich and analyze any domain, URL, or IP. Pivot to search on data points and linked indicators to investigate risky properties.

Data Enrichment & Threat Intelligence · Pulsedive

Details

IDPulsedive
ProviderPulsedive LLC
CategoryData Enrichment & Threat Intelligence
From Version6.0.0
Docker Imagedemisto/python3:3.12.8.3296088
Supported ModulesAgentix XSIAM

README

Enrich and analyze any domain, URL, or IP. Pivot to search on data points and linked indicators to investigate risky properties.
This integration was integrated and tested with version 5.1.15 of Pulsedive

Configure Pulsedive in Cortex

Parameter Description Required
API Key   True
Minimum severity of alerts to fetch   True
Trust any certificate (not secure)   False
Use system proxy settings   False
Fetch indicators   False
Indicator Reputation Indicators from this integration instance will be marked with this reputation False
Source Reliability Reliability of the source providing the intelligence data True
    False
    False
Feed Fetch Interval   False
Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Return IP information and reputation

Base Command

ip

Input

Argument Name Description Required
ip List of IPs. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
Pulsedive.IP.asn String The autonomous system name for the IP address.
Pulsedive.IP.asn_cidr String The ASN CIDR.
Pulsedive.IP.asn_country_code String The ASN country code.
Pulsedive.IP.asn_date Date The date on which the ASN was assigned.
Pulsedive.IP.asn_description String The ASN description.
Pulsedive.IP.asn_registry String The registry the ASN belongs to.
Pulsedive.IP.entities String Entities associated to the IP.
Pulsedive.IP.ip String The actual IP address.
Pulsedive.IP.network.cidr String Network CIDR for the IP address.
Pulsedive.IP.network.country Unknown The country of the IP address.
Pulsedive.IP.network.end_address String The last IP address of the CIDR.
Pulsedive.IP.network.events.action String The action that happened on the event.
Pulsedive.IP.network.events.actor Unknown The actor that performed the action on the event.
Pulsedive.IP.network.events.timestamp String The timestamp when the event occurred.
Pulsedive.IP.network.handle String The handle of the network.
Pulsedive.IP.network.ip_version String The IP address version.
Pulsedive.IP.network.links String Links associated to the IP address.
Pulsedive.IP.network.name String The name of the network.
Pulsedive.IP.network.notices.description String The description of the notice.
Pulsedive.IP.network.notices.links Unknown Links associated with the notice.
Pulsedive.IP.network.notices.title String Title of the notice.
Pulsedive.IP.network.parent_handle String Handle of the parent network.
Pulsedive.IP.network.raw Unknown Additional raw data for the network.
Pulsedive.IP.network.remarks Unknown Additional remarks for the network.
Pulsedive.IP.network.start_address String The first IP address of the CIDR.
Pulsedive.IP.network.status String Status of the network.
Pulsedive.IP.network.type String The type of the network.
Pulsedive.IP.query String IP address that was queried.
Pulsedive.IP.raw Unknown Additional raw data for the IP address.
Pulsedive.IP.score Number Reputation score from HelloWorld for this IP (0 to 100, where higher is worse).
IP.Address String IP address.
IP.Malicious.Vendor String The vendor reporting the IP address as malicious.
IP.Malicious.Description String A description explaining why the IP address was reported as malicious.
IP.ASN String The autonomous system name for the IP address.

domain

Returns Domain information and reputation.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name Description Required
domain List of Domains. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor String The vendor used to calculate the score.
Domain.Name String The domain name.
Domain.Malicious.Vendor String The vendor reporting the domain as malicious.
Domain.Malicious.Description String A description explaining why the domain was reported as malicious.
Domain.Registrant.Name String The name of the registrant.
Domain.Registrant.Country String The country of the registrant.
Domain.Organization String The organization of the domain.
Domain.CreationDate Date The creation date of the domain. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.ExpirationDate Date The expiration date of the domain. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.UpdatedDate Date The date when the domain was last updated. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.NameServers String Name servers of the domain.
Domain.WHOIS.NameServers String A CSV string of name servers, for example ‘ns1.bla.com, ns2.bla.com’.
Domain.WHOIS.CreationDate Date The creation date of the domain. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.WHOIS.UpdatedDate Date The date when the domain was last updated. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.WHOIS.ExpirationDate Date The expiration date of the domain.
Domain.WHOIS.Registrar.Name String The name of the registrar, for example ‘GoDaddy’
IP.ASN String The autonomous system name for the IP address.
Pulsedive.Domain.address String Domain admin address.
Pulsedive.Domain.city String Domain admin city.
Pulsedive.Domain.country String Domain admin country.
Pulsedive.Domain.creation_date Date Domain creation date. Format is ISO8601.
Pulsedive.Domain.dnssec String DNSSEC status.
Pulsedive.Domain.domain String The domain name.
Pulsedive.Domain.domain_name String Domain name options.
Pulsedive.Domain.emails String Contact emails.
Pulsedive.Domain.expiration_date Date Expiration date. Format is ISO8601.
Pulsedive.Domain.name String Domain admin name.
Pulsedive.Domain.name_servers String Name server.
Pulsedive.Domain.org String Domain organization.
Pulsedive.Domain.referral_url Unknown Referral URL.
Pulsedive.Domain.registrar String Domain registrar.
Pulsedive.Domain.score Number Reputation score from HelloWorld for this domain (0 to 100, where higher is worse).
Pulsedive.Domain.state String Domain admin state.
Pulsedive.Domain.status String Domain status.
Pulsedive.Domain.updated_date Date Updated date. Format is ISO8601.
Pulsedive.Domain.whois_server String WHOIS server.
Pulsedive.Domain.zipcode Unknown Domain admin zipcode.

url

Returns URL information and reputation.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name Description Required
url List of Urls. Required

Context Output

Path Type Description
URL.Data string The URL.
URL.Malicious.Vendor string The vendor reporting the URL as malicious.
URL.Malicious.Description string A description of the malicious URL.
DBotScore.Indicator string The indicator that was tested.
DBotScore.Type string The indicator type.
DBotScore.Vendor string The vendor used to calculate the score.
DBotScore.Score number The actual score.
URL.DetectionEngines string The total number of engines that checked the indicator.
URL.PositiveDetections string The number of engines that positively detected the indicator as malicious.

pulsedive-scan

Scan an indicator (IP/URL/Domain)

Base Command

pulsedive-scan

Input

Argument Name Description Required
value The value to scan. Required
scan_type You can choose between passive and active scanning. Passive scans fetch data without reaching out directly to the indicator, including performing WHOIS and DNS requests. Active scans are more noisy; we’ll do a quick port scan and reach out to the indicator with a web browser. Possible values are: active, passiv. Default is active. Optional

Context Output

Path Type Description
Pulsedive.Scan.qid Number QID of the scan.
Pulsedive.Scan.value string The value which was scanned.
Pulsedive.Scan.success string The success message.

pulsedive-scan-result

Retrieve the Result

Base Command

pulsedive-scan-result

Input

Argument Name Description Required
qid QID recieved from scan command. Required

Context Output

Path Type Description
DBotScore.Indicator String The indicator that was tested.
DBotScore.Score Number The actual score.
DBotScore.Type String The indicator type.
DBotScore.Vendor unknown The vendor used to calculate the score.
Pulsedive.ScanResult Unknown Complete data returned from the scan.
Domain.Name String The domain name.
Domain.DomainStatus String The status of the domain.
Domain.NameServers String Name servers of the domain.
Domain.WHOIS.NameServers String A CSV string of name servers, for example ‘ns1.bla.com, ns2.bla.com’.
Pulsedive.Scan.success string The success message.
IP.Address String IP address.
IP.Geo.Country String The country in which the IP address is located.
IP.Port String Ports that are associated with the IP.
IP.ASN String The autonomous system name for the URL, for example: ‘AS8948’.
URL.DATA String The URL.

Configuration parameters

  • apikey — API Key (required)
  • min_severity — Minimum severity of alerts to fetch (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • feedExpirationPolicy —
  • feedExpirationInterval —
  • feedFetchInterval — Feed Fetch Interval
  • feedBypassExclusionList — Bypass exclusion list

Commands (5)

  • domain

    Returns Domain information and reputation.

  • ip

    Return IP information and reputation

  • pulsedive-scan

    Scan an indicator (IP/URL/Domain)

  • pulsedive-scan-result

    Retrieve the Result

  • url

    Returns URL information and reputation.

Source

Pulsedive.py Pulsedive.yml Pulsedive_description.md
Download History Raw 
category: Data Enrichment & Threat Intelligence
provider: Pulsedive LLC
commonfields:
  id: Pulsedive
  version: -1
configuration:
- display: API Key
  name: apikey
  required: true
  type: 4
- defaultvalue: Low
  display: Minimum severity of alerts to fetch
  name: min_severity
  options:
  - Low
  - Medium
  - High
  - Critical
  required: true
  type: 15
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Fetch indicators
  name: feed
  type: 8
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: F - Reliability cannot be judged
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
- defaultvalue: indicatorType
  display: ''
  name: feedExpirationPolicy
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
- defaultvalue: '240'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
description: Enrich and analyze any domain, URL, or IP. Pivot to search on data points and linked indicators to investigate risky properties.
display: Pulsedive
name: Pulsedive
script:
  commands:
  - arguments:
    - default: true
      description: List of IPs.
      isArray: true
      name: ip
      required: true
    description: Return IP information and reputation
    name: ip
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: Pulsedive.IP.asn
      description: The autonomous system name for the IP address.
      type: String
    - contextPath: Pulsedive.IP.asn_cidr
      description: The ASN CIDR.
      type: String
    - contextPath: Pulsedive.IP.asn_country_code
      description: The ASN country code.
      type: String
    - contextPath: Pulsedive.IP.asn_date
      description: The date on which the ASN was assigned.
      type: Date
    - contextPath: Pulsedive.IP.asn_description
      description: The ASN description.
      type: String
    - contextPath: Pulsedive.IP.asn_registry
      description: The registry the ASN belongs to.
      type: String
    - contextPath: Pulsedive.IP.entities
      description: Entities associated to the IP.
      type: String
    - contextPath: Pulsedive.IP.ip
      description: The actual IP address.
      type: String
    - contextPath: Pulsedive.IP.network.cidr
      description: Network CIDR for the IP address.
      type: String
    - contextPath: Pulsedive.IP.network.country
      description: The country of the IP address.
      type: Unknown
    - contextPath: Pulsedive.IP.network.end_address
      description: The last IP address of the CIDR.
      type: String
    - contextPath: Pulsedive.IP.network.events.action
      description: The action that happened on the event.
      type: String
    - contextPath: Pulsedive.IP.network.events.actor
      description: The actor that performed the action on the event.
      type: Unknown
    - contextPath: Pulsedive.IP.network.events.timestamp
      description: The timestamp when the event occurred.
      type: String
    - contextPath: Pulsedive.IP.network.handle
      description: The handle of the network.
      type: String
    - contextPath: Pulsedive.IP.network.ip_version
      description: The IP address version.
      type: String
    - contextPath: Pulsedive.IP.network.links
      description: Links associated to the IP address.
      type: String
    - contextPath: Pulsedive.IP.network.name
      description: The name of the network.
      type: String
    - contextPath: Pulsedive.IP.network.notices.description
      description: The description of the notice.
      type: String
    - contextPath: Pulsedive.IP.network.notices.links
      description: Links associated with the notice.
      type: Unknown
    - contextPath: Pulsedive.IP.network.notices.title
      description: Title of the notice.
      type: String
    - contextPath: Pulsedive.IP.network.parent_handle
      description: Handle of the parent network.
      type: String
    - contextPath: Pulsedive.IP.network.raw
      description: Additional raw data for the network.
      type: Unknown
    - contextPath: Pulsedive.IP.network.remarks
      description: Additional remarks for the network.
      type: Unknown
    - contextPath: Pulsedive.IP.network.start_address
      description: The first IP address of the CIDR.
      type: String
    - contextPath: Pulsedive.IP.network.status
      description: Status of the network.
      type: String
    - contextPath: Pulsedive.IP.network.type
      description: The type of the network.
      type: String
    - contextPath: Pulsedive.IP.query
      description: IP address that was queried.
      type: String
    - contextPath: Pulsedive.IP.raw
      description: Additional raw data for the IP address.
      type: Unknown
    - contextPath: Pulsedive.IP.score
      description: Reputation score from HelloWorld for this IP (0 to 100, where higher is worse).
      type: Number
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Malicious.Vendor
      description: The vendor reporting the IP address as malicious.
      type: String
    - contextPath: IP.Malicious.Description
      description: A description explaining why the IP address was reported as malicious.
      type: String
    - contextPath: IP.ASN
      description: The autonomous system name for the IP address.
      type: String
  - arguments:
    - default: true
      description: List of Domains.
      isArray: true
      name: domain
      required: true
    description: Returns Domain information and reputation.
    name: domain
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: Domain.Malicious.Vendor
      description: The vendor reporting the domain as malicious.
      type: String
    - contextPath: Domain.Malicious.Description
      description: A description explaining why the domain was reported as malicious.
      type: String
    - contextPath: Domain.Registrant.Name
      description: The name of the registrant.
      type: String
    - contextPath: Domain.Registrant.Country
      description: The country of the registrant.
      type: String
    - contextPath: Domain.Organization
      description: The organization of the domain.
      type: String
    - contextPath: Domain.CreationDate
      description: The creation date of the domain. Format is ISO8601 (i.e. '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.ExpirationDate
      description: The expiration date of the domain. Format is ISO8601 (i.e. '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.UpdatedDate
      description: The date when the domain was last updated. Format is ISO8601 (i.e. '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.NameServers
      description: Name servers of the domain.
      type: String
    - contextPath: Domain.WHOIS.NameServers
      description: A CSV string of name servers, for example 'ns1.bla.com, ns2.bla.com'.
      type: String
    - contextPath: Domain.WHOIS.CreationDate
      description: The creation date of the domain. Format is ISO8601 (i.e. '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.WHOIS.UpdatedDate
      description: The date when the domain was last updated. Format is ISO8601 (i.e. '2020-04-30T10:35:00.000Z').
      type: Date
    - contextPath: Domain.WHOIS.ExpirationDate
      description: The expiration date of the domain.
      type: Date
    - contextPath: Domain.WHOIS.Registrar.Name
      description: The name of the registrar, for example 'GoDaddy'.
      type: String
    - contextPath: IP.ASN
      description: The autonomous system name for the IP address.
      type: String
    - contextPath: Pulsedive.Domain.address
      description: Domain admin address.
      type: String
    - contextPath: Pulsedive.Domain.city
      description: Domain admin city.
      type: String
    - contextPath: Pulsedive.Domain.country
      description: Domain admin country.
      type: String
    - contextPath: Pulsedive.Domain.creation_date
      description: Domain creation date. Format is ISO8601.
      type: Date
    - contextPath: Pulsedive.Domain.dnssec
      description: DNSSEC status.
      type: String
    - contextPath: Pulsedive.Domain.domain
      description: The domain name.
      type: String
    - contextPath: Pulsedive.Domain.domain_name
      description: Domain name options.
      type: String
    - contextPath: Pulsedive.Domain.emails
      description: Contact emails.
      type: String
    - contextPath: Pulsedive.Domain.expiration_date
      description: Expiration date. Format is ISO8601.
      type: Date
    - contextPath: Pulsedive.Domain.name
      description: Domain admin name.
      type: String
    - contextPath: Pulsedive.Domain.name_servers
      description: Name server.
      type: String
    - contextPath: Pulsedive.Domain.org
      description: Domain organization.
      type: String
    - contextPath: Pulsedive.Domain.referral_url
      description: Referral URL.
      type: Unknown
    - contextPath: Pulsedive.Domain.registrar
      description: Domain registrar.
      type: String
    - contextPath: Pulsedive.Domain.score
      description: Reputation score from HelloWorld for this domain (0 to 100, where higher is worse).
      type: Number
    - contextPath: Pulsedive.Domain.state
      description: Domain admin state.
      type: String
    - contextPath: Pulsedive.Domain.status
      description: Domain status.
      type: String
    - contextPath: Pulsedive.Domain.updated_date
      description: Updated date. Format is ISO8601.
      type: Date
    - contextPath: Pulsedive.Domain.whois_server
      description: WHOIS server.
      type: String
    - contextPath: Pulsedive.Domain.zipcode
      description: Domain admin zipcode.
      type: Unknown
  - arguments:
    - default: true
      description: List of Urls.
      isArray: true
      name: url
      required: true
    description: Returns URL information and reputation.
    name: url
    outputs:
    - contextPath: URL.Data
      description: The URL.
      type: string
    - contextPath: URL.Malicious.Vendor
      description: The vendor reporting the URL as malicious.
      type: string
    - contextPath: URL.Malicious.Description
      description: A description of the malicious URL.
      type: string
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: string
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: string
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: string
    - contextPath: DBotScore.Score
      description: The actual score.
      type: number
    - contextPath: URL.DetectionEngines
      description: The total number of engines that checked the indicator.
      type: string
    - contextPath: URL.PositiveDetections
      description: The number of engines that positively detected the indicator as malicious.
      type: string
  - arguments:
    - description: The value to scan.
      name: value
      required: true
    - auto: PREDEFINED
      default: true
      defaultValue: active
      description: You can choose between passive and active scanning. Passive scans fetch data without reaching out directly to the indicator, including performing WHOIS and DNS requests. Active scans are more noisy; we'll do a quick port scan and reach out to the indicator with a web browser.
      name: scan_type
      predefined:
      - active
      - passiv
    description: Scan an indicator (IP/URL/Domain)
    name: pulsedive-scan
    outputs:
    - contextPath: Pulsedive.Scan.qid
      description: QID of the scan.
      type: Number
    - contextPath: Pulsedive.Scan.value
      description: The value which was scanned.
      type: string
    - contextPath: Pulsedive.Scan.success
      description: The success message.
      type: string
  - arguments:
    - description: QID recieved from scan command.
      name: qid
      required: true
    description: Retrieve the Result
    name: pulsedive-scan-result
    outputs:
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
    - contextPath: Pulsedive.ScanResult
      description: Complete data returned from the scan.
      type: Unknown
    - contextPath: Domain.Name
      description: The domain name.
      type: String
    - contextPath: Domain.DomainStatus
      description: The status of the domain.
      type: String
    - contextPath: Domain.NameServers
      description: Name servers of the domain.
      type: String
    - contextPath: Domain.WHOIS.NameServers
      description: A CSV string of name servers, for example 'ns1.bla.com, ns2.bla.com'.
      type: String
    - contextPath: Pulsedive.Scan.success
      description: The success message.
      type: string
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: IP.Port
      description: Ports that are associated with the IP.
      type: String
    - contextPath: IP.ASN
      description: "The autonomous system name for the URL, for example: 'AS8948'."
      type: String
    - contextPath: URL.DATA
      description: The URL.
      type: String
  dockerimage: demisto/python3:3.12.8.3296088
  script: ''
  subtype: python3
  type: python
  runonce: false
fromversion: 6.0.0
tests:
- No tests (auto formatted)