Skip to main content

Data Source

Follow the instructions below to create a new data flow that ingests data from a Pulsedive source in Nexla.
pulsedive_api.png

Pulsedive

Create a New Data Flow​

  1. To create a new data flow, navigate to the Integrate section, and click the New Data Flow button. Then, select the desired flow type from the list, and click the Create button.

  2. Select the Pulsedive connector tile from the list of available connectors. Then, select the credential that will be used to connect to your Pulsedive account, and click Next; or, create a new Pulsedive credential for use in this flow.

  3. In Nexla, Pulsedive data sources can be created using pre-built endpoint templates, which expedite source setup for common Pulsedive endpoints. Each template is designed specifically for the corresponding Pulsedive endpoint, making source configuration easy and efficient.
    • To configure this source using a template, follow the instructions in Configure Using a Template.

    Pulsedive sources can also be configured manually, allowing you to ingest data from Pulsedive endpoints not included in the pre-built templates or apply further customizations to exactly suit your needs.
    • To configure this source manually, follow the instructions in Configure Manually.

Configure Using a Template​

Nexla provides pre-built templates that can be used to rapidly configure data sources to ingest data from common Pulsedive endpoints. Each template is designed specifically for the corresponding Pulsedive endpoint, making data source setup easy and efficient.

Endpoint Settings​

  • Select the endpoint from which this source will fetch data from the Endpoint pulldown menu. Available endpoint templates are listed in the expandable boxes below. Click on an endpoint to see more information about it and how to configure your data source for this endpoint.

    Get Threat Info by ID

    This endpoint template retrieves Pulsedive threat information about one threat by its ID. Use this template when you need to retrieve detailed threat intelligence information for a specific threat ID, including threat details, risk scores, and other threat metadata.

    • Enter the threat ID in the Threat ID field. This should be the unique identifier of the threat you want to retrieve information for. The threat ID determines which threat's information will be retrieved.

    This endpoint returns Pulsedive threat information about one threat by its ID, including threat details, risk scores, and other threat metadata. The endpoint returns a single threat's information.

    For detailed information about threat intelligence, API response structures, and available threat data, see the Pulsedive API documentation.

    Get Threat Info by Name

    This endpoint template retrieves Pulsedive threat information about one threat by its name. Use this template when you need to retrieve detailed threat intelligence information for a specific threat name, including threat details, risk scores, and other threat metadata.

    • Enter the threat name in the Threat Name field. This should be the name of the threat you want to retrieve information for. The threat name determines which threat's information will be retrieved.

    This endpoint returns Pulsedive threat information about one threat by its name, including threat details, risk scores, and other threat metadata. The endpoint returns a single threat's information.

    For detailed information about threat intelligence, API response structures, and available threat data, see the Pulsedive API documentation.

    Get Threat Indicator Summary

    This endpoint template retrieves Pulsedive detailed information with indicator counts split by risk about one threat. Use this template when you need to retrieve comprehensive threat intelligence summaries, including indicator counts and risk breakdowns for a specific threat.

    • Enter the threat ID in the Threat ID field. This should be the unique identifier of the threat you want to retrieve summary information for. The threat ID determines which threat's summary information will be retrieved.

    This endpoint returns Pulsedive detailed information with indicator counts split by risk about one threat, including comprehensive threat intelligence summaries and risk breakdowns. The endpoint returns a single threat's summary information.

    For detailed information about threat summaries, API response structures, and available threat data, see the Pulsedive API documentation.

    Get Threat Linked Indicators

    This endpoint template retrieves all linked indicators for a threat from your Pulsedive account. Use this template when you need to retrieve all indicators associated with a specific threat, including indicator IDs, types, and other indicator metadata.

    • Enter the threat ID in the Threat ID field. This should be the unique identifier of the threat you want to retrieve linked indicators for. The threat ID determines which threat's linked indicators will be retrieved.

    This endpoint returns all linked indicators for a threat from your Pulsedive account, including indicator IDs, types, and other indicator metadata. The endpoint uses incrementing page-based pagination to handle large datasets efficiently. Nexla will automatically fetch subsequent pages of data by incrementing the page number.

    For detailed information about threat indicators, API response structures, pagination, and available indicator data, see the Pulsedive API documentation.

Endpoint Testing​

Once the selected endpoint template has been configured, Nexla can retrieve a sample of the data that will be fetched according to the current settings. This allows users to verify that the source is configured correctly before saving.

  • To test the current endpoint configuration, click the Test button to the right of the endpoint selection menu. Sample data will be fetched & displayed in the Endpoint Test Result panel on the right.

  • If the sample data is not as expected, review the selected endpoint and associated settings, and make any necessary adjustments. Then, click the Test button again, and check the sample data to ensure that the correct information is displayed.

Configure Manually​

Pulsedive data sources can be manually configured to ingest data from any valid Pulsedive API endpoint. Manual configuration provides maximum flexibility for accessing endpoints not covered by pre-built templates or when you need custom API configurations.

With manual configuration, you can also create more complex Pulsedive sources, such as sources that use chained API calls to fetch related data or sources that require custom query parameters or filters.

API Method​

  1. To manually configure this source, select the Advanced tab at the top of the configuration screen.

  2. Select the API method that will be used for calls to the Pulsedive API from the Method pulldown menu. Pulsedive API typically uses GET method for retrieving data from endpoints.

API Endpoint URL​

  1. Enter the URL of the Pulsedive API endpoint from which this source will fetch data in the Set API URL field. This should be the complete URL to your Pulsedive endpoint (e.g., https://pulsedive.com/api/info.php?tid={threat_id}&key={api_key}). Include any required query parameters in the URL, including the key parameter with your API key.

Ensure the API endpoint URL is correct and accessible with your current credentials. The Pulsedive API uses query parameters for authentication (the key parameter). The endpoint URL should include all required query parameters. You can test the endpoint using the Test button after configuring the URL.

Response Data Path​

  1. Enter the JSONPath expression in the Response Data Path field to specify which part of the API response should be treated as the relevant data by Nexla. For Pulsedive API responses, use $ to extract the entire response for single record endpoints, or $.results[*] to extract all items from the results array for list endpoints, depending on your endpoint.

The JSONPath expression must correctly reference the structure of your Pulsedive API response. Pulsedive API responses may have different structures depending on the endpoint. Ensure your JSONPath expression matches the structure returned by your specific endpoint. The JSONPath expression determines which data will be extracted and processed by Nexla.

Pagination (if applicable)​

  1. If your endpoint supports pagination, configure the pagination settings in the Pagination section. Pulsedive API uses incrementing page-based pagination with page for some endpoints. Select the pagination type that matches your endpoint's pagination mechanism.

  2. Configure the pagination parameters based on your selected pagination type. For incrementing page-based pagination, specify the page parameter name (page) and the starting page value (0).

Save the Data Source​

  1. Once all of the relevant steps in the above sections have been completed, click the Next button to proceed with the rest of the data flow configuration, or click Save to save the data source configuration for later use.