- Home
- Threat Intelligence Platforms
- Pulse Intelligence
Pulse Intelligence
What it is
Pulse Intelligence is a free, open-source, self-hosted threat intelligence workspace for analysts, junior CTI teams, and SOC teams. It tracks threat actors, aliases, campaigns, indicators, reports, sources, CVEs, and ATT&CK mappings. The platform ingests public feeds from CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs, and security news, and enriches indicators through OTX, AbuseIPDB, and VirusTotal with Redis-backed quota controls. Users can save hunts across indicator fields, get alerts for new matches, and export filtered indicators as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts, and feed health. A read-only public API with scoped keys supports scripts, SOAR playbooks, and internal tools. Its default limit is 120 requests per API key per 60-second window, with indicator pages capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys, and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or a compatible PostgreSQL database, and a Redis-compatible server.
For and against
For
- Ingests multiple public threat data feeds.
- Exports indicators in CSV, STIX 2.1, and MISP JSON.
- Supports saved hunts and alerts for new matches.
- Offers native and Docker Compose deployment paths.
Against
- Requires Node.js 20.9+, PostgreSQL, and Redis-compatible service.
- API defaults to 120 requests per key per 60 seconds.
- Indicator API pages are capped at 500.
- Project README says hardening remains in phase 8.
The verdict
Pulse Intelligence combines threat data tracking, enrichment, hunts, exports, and scheduled reporting in a self-hosted project. Deployment has defined software requirements, and its README says hardening and deeper security review remain planned work.
Who it suits
It suits analysts and SOC or junior CTI teams that want a self-hosted workspace for threat data, hunting, and reporting. Teams integrating through the API should account for its request and page limits.
Plans and prices
Open-source self-hosted
Self-hosted; requires Node.js 20.9+, PostgreSQL 17, and a Redis-compatible server
Read 8 Oct 2026 · github.com
On the record
- API
- The public API is read-only, supports scoped API keys, and is intended for analyst scripts, SOAR playbooks, internal tools, and integrations.github.com · read 8 Oct 2026
- API limits
- The API defaults to 120 requests per API key per 60-second window, and indicator page size is capped at 500.github.com · read 8 Oct 2026
- API rate limit
- API routes default to 120 requests per API key per 60-second window, configurable by environment variables.github.com · read 8 Oct 2026
- Audience
- The project describes its users as analysts, junior CTI teams, and SOC teams.github.com · read 8 Oct 2026
- Data handling
- Whitelisted indicators are excluded from API responses and exports, and expired indicators are excluded from API results.github.com · read 8 Oct 2026
- Deployment
- The maker documents direct Node deployment and a Docker Compose full-stack deployment, with both the web app and worker kept running.github.com · read 8 Oct 2026
- Deployment requirements
- Deployment requires Node.js 20.9+, PostgreSQL 17, and a Redis-compatible server; the project documents native and Docker deployment paths.github.com · read 8 Oct 2026
- Enrichment
- It enriches indicators through OTX, AbuseIPDB, and VirusTotal, with Redis-backed quota controls.github.com · read 8 Oct 2026
- Exports
- Filtered IOCs can be exported as CSV, STIX 2.1, MISP JSON, and Snort or Suricata rules.github.com · read 8 Oct 2026
- Feeds
- It ingests public feeds from CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs, and security news.github.com · read 8 Oct 2026
- Hunting
- Users can create saved hunts over indicator fields, receive alerts for new matches, and export hunt matches.github.com · read 8 Oct 2026
- Integrations
- Its public read-only API supports scoped keys and integrations such as analyst scripts, SOAR playbooks, and internal tools.github.com · read 8 Oct 2026
- IOC safeguards
- Whitelisted indicators are never returned by public API or export routes, and expired indicators are also excluded from the API.github.com · read 8 Oct 2026
- Product
- Pulse Intelligence is an open-source, self-hosted threat intelligence platform for analyst workflows.github.com · read 8 Oct 2026
- Project status
- The README says phases 1–7 of 8 are implemented and phase 8 covers hardening, large-table partitioning, and deeper security review.github.com · read 8 Oct 2026
- Purpose
- Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analysts and junior CTI teams.github.com · read 8 Oct 2026
- Reports
- The platform can generate scheduled Markdown reports from new indicators, KEV additions, hunt alerts, and feed health.github.com · read 8 Oct 2026
- Requirements
- The documented deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server.github.com · read 8 Oct 2026
