Skip to content
SPECIFICTION
Get listed

Pulse Intelligence

github.com

Free plan WebWindowsmacOSLinuxAPISelf-hosted
Visit github.com
Spec score 8.4 #3 of 32 in Threat Intelligence Platforms

What it is

Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.

Spec sheet

Purpose
Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analysts and junior CTI teams.Read 8 Oct 2026 · github.com
Product
Pulse Intelligence is an open-source, self-hosted threat intelligence platform for analyst workflows.Read 8 Oct 2026 · github.com
Audience
The project describes its users as analysts, junior CTI teams, and SOC teams.Read 8 Oct 2026 · github.com
Deployment
The maker documents direct Node deployment and a Docker Compose full-stack deployment, with both the web app and worker kept running.Read 8 Oct 2026 · github.com
API
The public API is read-only, supports scoped API keys, and is intended for analyst scripts, SOAR playbooks, internal tools, and integrations.Read 8 Oct 2026 · github.com
Integrations
Its public read-only API supports scoped keys and integrations such as analyst scripts, SOAR playbooks, and internal tools.Read 8 Oct 2026 · github.com
Security
The repository lists Argon2id passwords, database-backed session cookies, hashed API keys, and an admin-only audit log.Read 8 Oct 2026 · github.com
API limits
The API defaults to 120 requests per API key per 60-second window, and indicator page size is capped at 500.Read 8 Oct 2026 · github.com
API rate limit
API routes default to 120 requests per API key per 60-second window, configurable by environment variables.Read 8 Oct 2026 · github.com
Data handling
Whitelisted indicators are excluded from API responses and exports, and expired indicators are excluded from API results.Read 8 Oct 2026 · github.com
Deployment requirements
Deployment requires Node.js 20.9+, PostgreSQL 17, and a Redis-compatible server; the project documents native and Docker deployment paths.Read 8 Oct 2026 · github.com
Enrichment
It enriches indicators through OTX, AbuseIPDB, and VirusTotal, with Redis-backed quota controls.Read 8 Oct 2026 · github.com
Exports
Filtered IOCs can be exported as CSV, STIX 2.1, MISP JSON, and Snort or Suricata rules.Read 8 Oct 2026 · github.com
Feeds
It ingests public feeds from CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs, and security news.Read 8 Oct 2026 · github.com
Hunting
Users can create saved hunts over indicator fields, receive alerts for new matches, and export hunt matches.Read 8 Oct 2026 · github.com
IOC safeguards
Whitelisted indicators are never returned by public API or export routes, and expired indicators are also excluded from the API.Read 8 Oct 2026 · github.com
Project status
The README says phases 1–7 of 8 are implemented and phase 8 covers hardening, large-table partitioning, and deeper security review.Read 8 Oct 2026 · github.com
Reports
The platform can generate scheduled Markdown reports from new indicators, KEV additions, hunt alerts, and feed health.Read 8 Oct 2026 · github.com
Requirements
The documented deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server.Read 8 Oct 2026 · github.com
Security controls
The README lists Argon2id passwords, database-backed session cookies, hashed API keys, and an admin-only audit log.Read 8 Oct 2026 · github.com
Threat data
It tracks threat actors, aliases, campaigns, indicators, reports, sources, CVEs, and ATT&CK mappings.Read 8 Oct 2026 · github.com
Threat tracking
It tracks threat actors, aliases, campaigns, indicators, reports, sources, CVEs, and ATT&CK mappings.Read 8 Oct 2026 · github.com

Plans and prices

Open-source self-hosted Free Self-hosted; requires Node.js 20.9+, PostgreSQL 17, and a Redis-compatible server Read 8 Oct 2026 · github.com

Every Pulse Intelligence plan and price →

Strong points and limits

Strong points

  • Ingests public feeds from multiple security sources.
  • Enriches indicators through OTX, AbuseIPDB and VirusTotal.
  • Exports filtered indicators in several formats.
  • Scheduled reports cover feed health and hunt alerts.

Limits

  • Self-hosted deployment requires Node.js 20.9+.
  • Deployment requires PostgreSQL 17 or compatible PostgreSQL.
  • Deployment requires a Redis-compatible server.
  • API defaults to 120 requests per key per 60 seconds.

Who it suits

Pulse Intelligence suits analysts, junior CTI teams and SOC teams seeking a self-hosted threat intelligence workspace. Its documented deployment requirements call for Node.js, PostgreSQL and a Redis-compatible server.

Verdict

Pulse Intelligence brings feed ingestion, enrichment, hunting, exports and reporting into a self-hosted analyst workspace. Its documented prerequisites and API limits are worth accounting for before deployment.

Where Specifiction places it

Alternatives to Pulse IntelligenceAll alternatives →

MISP From €0.61/mo · Free plan 9.0 Visit