feat(pulsedive): new Pulsedive enrichment integration

4 commands: indicator lookup, scan submission, scan-result retrieval.
API-key auth, stdlib-only.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-07-11 22:39:28 +02:00
parent 419f891267
commit ac6a52cecd
5 changed files with 226 additions and 0 deletions
+53
View File
@@ -0,0 +1,53 @@
id: pulsedive
name: Pulsedive
version: 1.0.0
description: "Pulsedive (API) — reputation and threat context for any indicator (IP, domain, URL or hash), plus on-demand scanning and scan-result retrieval. API-key authentication; stdlib-only, no extra Python dependencies."
changelog: "1.0.0 — Initial release: indicator lookup, scan submission and scan-result retrieval."
category: enrichment
config_schema:
properties:
api_key:
type: string
description: "Pulsedive API key"
x-soar-sensitive: true
required:
- api_key
commands:
- id: lookup_indicator
name: pulsedive-lookup-indicator
description: "Look up the reputation and threat context of an indicator (IP, domain, URL or hash)."
risk: read
inputs_schema:
properties:
indicator: { type: string, description: "Indicator value (IP, domain, URL or hash)" }
required: [indicator]
outputs_schema: { properties: {} }
- id: scan
name: pulsedive-scan
description: "Submit an indicator for an on-demand scan. Returns a qid; retrieve the report with pulsedive-scan-result once it finishes."
inputs_schema:
properties:
value: { type: string, description: "Indicator to scan (IP, domain or URL)" }
probe: { type: boolean, description: "Actively probe the indicator (default true)" }
required: [value]
outputs_schema: { properties: {} }
- id: scan_result
name: pulsedive-scan-result
description: "Retrieve the result of a scan by its qid."
risk: read
inputs_schema:
properties:
qid: { type: string, description: "Scan qid (from pulsedive-scan)" }
required: [qid]
outputs_schema: { properties: {} }
- id: test_connection
name: pulsedive-test-connection
description: "Verify the API key (used by the Test button)."
risk: read
inputs_schema:
properties: {}
required: []
outputs_schema: { properties: {} }