Skip to content
SPECIFICTION
Get listed

Pulse Intelligence vs Threat Intelligence Platform

Pulse Intelligence

github.com

Threat Intelligence Platform

threatintelligenceplatform.com

Side by side

FigurePulse IntelligenceThreat Intelligence Platform
Price fromFreeFree
Free planYesYes
Free trial—Yes
Open source——
WebYesYes
WindowsYes—
macOSYes—
LinuxYes—
APIYesYes
Self-hostedYes—
Plans published11
Spec score · Threat Intelligence Platforms8.4 (#3)7.2 (#19)
API rate limitAPI routes default to 120 requests per API key per 60-second window, configurable by environment variables.API documentation states that each user is limited to 100 requests per minute.
IntegrationsIts public read-only API supports scoped keys and integrations such as analyst scripts, SOAR playbooks, and internal tools.The maker describes the APIs as integrable with cybersecurity products including CTI platforms, SIEM solutions and DRP solutions.
PurposePulse Intelligence is an open-source, self-hosted threat intelligence workspace for analysts and junior CTI teams.The platform combines threat intelligence feeds with in-house databases to analyze threat hosts and attack infrastructure in real time.

Plans

Pulse Intelligence

  • Open-source self-hostedFree

Pulse Intelligence pricing →

Threat Intelligence Platform

  • Free subscription planFree

Threat Intelligence Platform pricing →

In their own words

Pulse Intelligence

Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.

Visit github.com

Threat Intelligence Platform

Threat Intelligence Platform combines threat intelligence feeds with in-house databases to analyze threat hosts and attack infrastructure in real time. Its web interface provides details about a host and its underlying infrastructure. The Domain Infrastructure Analysis API returns web, mail, and name servers, known subdomains, IP addresses, geolocation, and subnet information. The Domain Reputation API assesses domains and IPv4 addresses against more than 120 parameters to calculate a reputation score. Other APIs cover SSL certificate chains, SSL configuration, malware checks, and connected domains. The APIs are presented for integration with cybersecurity products such as CTI platforms, SIEM solutions, and DRP solutions, and for enriching systems or examining indicators of compromise, third-party digital assets, and attack-surface exposure. The service is available on the web and through APIs, with cloud deployment. A free, fully functional trial requires no credit card or company information. The free subscription provides 100 credits after sign-up; web analysis costs 10 credits per request, and API requests cost 1–3 credits each. API use is limited to 100 requests per minute.

Visit threatintelligenceplatform.com