Pulse Intelligence vs Threat Intelligence Platform
Pulse Intelligence
github.comThreat Intelligence Platform
threatintelligenceplatform.comSide by side
| Figure | Pulse Intelligence | Threat Intelligence Platform |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Threat Intelligence Platforms | 8.4 (#3) | 7.2 (#19) |
| API rate limit | API routes default to 120 requests per API key per 60-second window, configurable by environment variables. | API documentation states that each user is limited to 100 requests per minute. |
| Integrations | Its public read-only API supports scoped keys and integrations such as analyst scripts, SOAR playbooks, and internal tools. | The maker describes the APIs as integrable with cybersecurity products including CTI platforms, SIEM solutions and DRP solutions. |
| Purpose | Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analysts and junior CTI teams. | The platform combines threat intelligence feeds with in-house databases to analyze threat hosts and attack infrastructure in real time. |
Plans
In their own words
Pulse Intelligence
Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.
Threat Intelligence Platform
Threat Intelligence Platform combines threat intelligence feeds with in-house databases to analyze threat hosts and attack infrastructure in real time. Its web interface provides details about a host and its underlying infrastructure. The Domain Infrastructure Analysis API returns web, mail, and name servers, known subdomains, IP addresses, geolocation, and subnet information. The Domain Reputation API assesses domains and IPv4 addresses against more than 120 parameters to calculate a reputation score. Other APIs cover SSL certificate chains, SSL configuration, malware checks, and connected domains. The APIs are presented for integration with cybersecurity products such as CTI platforms, SIEM solutions, and DRP solutions, and for enriching systems or examining indicators of compromise, third-party digital assets, and attack-surface exposure. The service is available on the web and through APIs, with cloud deployment. A free, fully functional trial requires no credit card or company information. The free subscription provides 100 credits after sign-up; web analysis costs 10 credits per request, and API requests cost 1–3 credits each. API use is limited to 100 requests per minute.