Pulse Intelligence vs SOCRadar Extended Threat Intelligence Platform

Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.

SOCRadar Extended Threat Intelligence Platform (XTI) combines threat intelligence with external attack surface management, brand protection, and dark web monitoring. It monitors dark web and other sources for threats aimed at organizations, including impersonating domains and social-media brand abuse. Its intelligence covers vulnerabilities, attack methods, sectoral and regional campaigns, supply-chain attacks, and threat actor groups. SOCRadar says the platform detects brand impersonations, phishing domains, and vulnerabilities before they affect operations. XTI is a cloud-based SaaS service accessed online, without software installation or endpoint setup. Listed integrations span SIEM, SOAR, EDR, firewalls, team management, ticketing, vulnerability management, intelligence sharing, MDR, XDR, and threat intelligence categories. SOCRadar states that it holds ISO 27001 certification and completed SOC 2 Type I and Type II reports. It describes TLS 1.2 or higher for data in transit and AES-256 encryption for stored data. A free plan and seven-day trial are listed. Paid examples include Advanced Dark Web Monitoring Essential at $600.00 per month and External Attack Surface Management Essential at $10500.00 per year. The platforms listed are web and API.