Pulse Intelligence vs Threatnote
Pulse Intelligence
github.comThreatnote
morado.ioSide by side
| Figure | Pulse Intelligence | Threatnote |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | — |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Threat Intelligence Platforms | 8.4 (#3) | 7.0 (#23) |
| API | The public API is read-only, supports scoped API keys, and is intended for analyst scripts, SOAR playbooks, internal tools, and integrations. | Morado describes its partner integration approach as API-first and offers dedicated technical support to integration partners. |
| Integrations | Its public read-only API supports scoped keys and integrations such as analyst scripts, SOAR playbooks, and internal tools. | Threatnote 2.4 lists new integrations for Snowflake, ServiceNow, Tenable Nessus, and Tenable Vulnerability Management, plus updated Splunk and Microsoft Defender integrations. |
| Product | Pulse Intelligence is an open-source, self-hosted threat intelligence platform for analyst workflows. | Threatnote is an AI-powered Unified Threat Management Platform that turns raw threat data into actionable intelligence for enterprise security teams and MSSPs. |
Plans
In their own words
Pulse Intelligence
Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.