Pulsedive

Details

ID	`Pulsedive`
Provider	Pulsedive LLC
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.8.3296088`
Supported Modules	Agentix XSIAM

README

Enrich and analyze any domain, URL, or IP. Pivot to search on data points and linked indicators to investigate risky properties.
This integration was integrated and tested with version 5.1.15 of Pulsedive

Configure Pulsedive in Cortex

Parameter	Description	Required
API Key		True
Minimum severity of alerts to fetch		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation	False
Source Reliability	Reliability of the source providing the intelligence data	True
		False
		False
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

ip

Return IP information and reputation

Base Command

ip

Input

Argument Name	Description	Required
ip	List of IPs.	Required

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
Pulsedive.IP.asn	String	The autonomous system name for the IP address.
Pulsedive.IP.asn_cidr	String	The ASN CIDR.
Pulsedive.IP.asn_country_code	String	The ASN country code.
Pulsedive.IP.asn_date	Date	The date on which the ASN was assigned.
Pulsedive.IP.asn_description	String	The ASN description.
Pulsedive.IP.asn_registry	String	The registry the ASN belongs to.
Pulsedive.IP.entities	String	Entities associated to the IP.
Pulsedive.IP.ip	String	The actual IP address.
Pulsedive.IP.network.cidr	String	Network CIDR for the IP address.
Pulsedive.IP.network.country	Unknown	The country of the IP address.
Pulsedive.IP.network.end_address	String	The last IP address of the CIDR.
Pulsedive.IP.network.events.action	String	The action that happened on the event.
Pulsedive.IP.network.events.actor	Unknown	The actor that performed the action on the event.
Pulsedive.IP.network.events.timestamp	String	The timestamp when the event occurred.
Pulsedive.IP.network.handle	String	The handle of the network.
Pulsedive.IP.network.ip_version	String	The IP address version.
Pulsedive.IP.network.links	String	Links associated to the IP address.
Pulsedive.IP.network.name	String	The name of the network.
Pulsedive.IP.network.notices.description	String	The description of the notice.
Pulsedive.IP.network.notices.links	Unknown	Links associated with the notice.
Pulsedive.IP.network.notices.title	String	Title of the notice.
Pulsedive.IP.network.parent_handle	String	Handle of the parent network.
Pulsedive.IP.network.raw	Unknown	Additional raw data for the network.
Pulsedive.IP.network.remarks	Unknown	Additional remarks for the network.
Pulsedive.IP.network.start_address	String	The first IP address of the CIDR.
Pulsedive.IP.network.status	String	Status of the network.
Pulsedive.IP.network.type	String	The type of the network.
Pulsedive.IP.query	String	IP address that was queried.
Pulsedive.IP.raw	Unknown	Additional raw data for the IP address.
Pulsedive.IP.score	Number	Reputation score from HelloWorld for this IP (0 to 100, where higher is worse).
IP.Address	String	IP address.
IP.Malicious.Vendor	String	The vendor reporting the IP address as malicious.
IP.Malicious.Description	String	A description explaining why the IP address was reported as malicious.
IP.ASN	String	The autonomous system name for the IP address.

domain

Returns Domain information and reputation.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

domain

Input

Argument Name	Description	Required
domain	List of Domains.	Required

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
Domain.Name	String	The domain name.
Domain.Malicious.Vendor	String	The vendor reporting the domain as malicious.
Domain.Malicious.Description	String	A description explaining why the domain was reported as malicious.
Domain.Registrant.Name	String	The name of the registrant.
Domain.Registrant.Country	String	The country of the registrant.
Domain.Organization	String	The organization of the domain.
Domain.CreationDate	Date	The creation date of the domain. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.ExpirationDate	Date	The expiration date of the domain. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.UpdatedDate	Date	The date when the domain was last updated. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.NameServers	String	Name servers of the domain.
Domain.WHOIS.NameServers	String	A CSV string of name servers, for example ‘ns1.bla.com, ns2.bla.com’.
Domain.WHOIS.CreationDate	Date	The creation date of the domain. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.WHOIS.UpdatedDate	Date	The date when the domain was last updated. Format is ISO8601 (i.e. ‘2020-04-30T10:35:00.000Z’).
Domain.WHOIS.ExpirationDate	Date	The expiration date of the domain.
Domain.WHOIS.Registrar.Name	String	The name of the registrar, for example ‘GoDaddy’
IP.ASN	String	The autonomous system name for the IP address.
Pulsedive.Domain.address	String	Domain admin address.
Pulsedive.Domain.city	String	Domain admin city.
Pulsedive.Domain.country	String	Domain admin country.
Pulsedive.Domain.creation_date	Date	Domain creation date. Format is ISO8601.
Pulsedive.Domain.dnssec	String	DNSSEC status.
Pulsedive.Domain.domain	String	The domain name.
Pulsedive.Domain.domain_name	String	Domain name options.
Pulsedive.Domain.emails	String	Contact emails.
Pulsedive.Domain.expiration_date	Date	Expiration date. Format is ISO8601.
Pulsedive.Domain.name	String	Domain admin name.
Pulsedive.Domain.name_servers	String	Name server.
Pulsedive.Domain.org	String	Domain organization.
Pulsedive.Domain.referral_url	Unknown	Referral URL.
Pulsedive.Domain.registrar	String	Domain registrar.
Pulsedive.Domain.score	Number	Reputation score from HelloWorld for this domain (0 to 100, where higher is worse).
Pulsedive.Domain.state	String	Domain admin state.
Pulsedive.Domain.status	String	Domain status.
Pulsedive.Domain.updated_date	Date	Updated date. Format is ISO8601.
Pulsedive.Domain.whois_server	String	WHOIS server.
Pulsedive.Domain.zipcode	Unknown	Domain admin zipcode.

url

Returns URL information and reputation.

Notice: Submitting indicators using this command might make the indicator data publicly available. See the vendor’s documentation for more details.

Base Command

url

Input

Argument Name	Description	Required
url	List of Urls.	Required

Context Output

Path	Type	Description
URL.Data	string	The URL.
URL.Malicious.Vendor	string	The vendor reporting the URL as malicious.
URL.Malicious.Description	string	A description of the malicious URL.
DBotScore.Indicator	string	The indicator that was tested.
DBotScore.Type	string	The indicator type.
DBotScore.Vendor	string	The vendor used to calculate the score.
DBotScore.Score	number	The actual score.
URL.DetectionEngines	string	The total number of engines that checked the indicator.
URL.PositiveDetections	string	The number of engines that positively detected the indicator as malicious.

pulsedive-scan

Scan an indicator (IP/URL/Domain)

Base Command

pulsedive-scan

Input

Argument Name	Description	Required
value	The value to scan.	Required
scan_type	You can choose between passive and active scanning. Passive scans fetch data without reaching out directly to the indicator, including performing WHOIS and DNS requests. Active scans are more noisy; we’ll do a quick port scan and reach out to the indicator with a web browser. Possible values are: active, passiv. Default is active.	Optional

Context Output

Path	Type	Description
Pulsedive.Scan.qid	Number	QID of the scan.
Pulsedive.Scan.value	string	The value which was scanned.
Pulsedive.Scan.success	string	The success message.

pulsedive-scan-result

Retrieve the Result

Base Command

pulsedive-scan-result

Input

Argument Name	Description	Required
qid	QID recieved from scan command.	Required

Context Output

Path	Type	Description
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	unknown	The vendor used to calculate the score.
Pulsedive.ScanResult	Unknown	Complete data returned from the scan.
Domain.Name	String	The domain name.
Domain.DomainStatus	String	The status of the domain.
Domain.NameServers	String	Name servers of the domain.
Domain.WHOIS.NameServers	String	A CSV string of name servers, for example ‘ns1.bla.com, ns2.bla.com’.
Pulsedive.Scan.success	string	The success message.
IP.Address	String	IP address.
IP.Geo.Country	String	The country in which the IP address is located.
IP.Port	String	Ports that are associated with the IP.
IP.ASN	String	The autonomous system name for the URL, for example: ‘AS8948’.
URL.DATA	String	The URL.

Configuration parameters

apikey — API Key (required)
min_severity — Minimum severity of alerts to fetch (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list

Commands (5)

domain
Returns Domain information and reputation.
ip
Return IP information and reputation
pulsedive-scan
Scan an indicator (IP/URL/Domain)
pulsedive-scan-result
Retrieve the Result
url
Returns URL information and reputation.

Source

Pulsedive.py Pulsedive.yml Pulsedive_description.md

Download History Raw

## Pulsedive
Leverage Pulsedive threat intelligence in Cortex XSOAR to enrich any domain, URL, or IP. Retrieve risk scores and factors, investigate contextual data, pivot on any data point, and investigate potential threats.

Register Free: https://pulsedive.com/login
About: https://pulsedive.com/about/
Contact: mailto:support@pulsedive.com

Notice: Submitting indicators using the following commands of this integration might make the indicator data publicly available.
- ***url***
- ***domain***
See the vendor’s documentation for more details.