Pulse Intelligence

Overview

Pulse Intelligence brings threat data and analyst workflows into a self-hosted workspace. It is aimed at analysts and junior CTI or SOC teams, particularly those that want to manage their own deployment and shape intelligence into hunts, exports, and reports. Its broad workflow coverage is a strong fit for that audience, but operating its web app and worker alongside a database and Redis-compatible service is a real commitment.

Key features

The workspace covers threat actors and aliases, campaigns, indicators, reports, sources, CVEs, and ATT&CK mappings. It pulls in public material from CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs, and security news, giving teams several kinds of intelligence to correlate rather than limiting them to one feed type.

Indicator enrichment uses OTX, AbuseIPDB, and VirusTotal, with Redis-backed quota controls. Saved hunts can search indicator fields, alert on new matches, and export results. Filtered IOCs can also be exported as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Together, these options make the platform useful for teams that need to move findings into analysis and detection workflows; teams seeking a managed service should look elsewhere.

Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts, and feed health. A read-only API with scoped keys supports scripts, SOAR playbooks, and internal tools. Its default limit is 120 requests per API key in a 60-second window, configurable through environment variables, and indicator page size is capped at 500. The listed safeguards include Argon2id passwords, database-backed session cookies, hashed API keys, and an admin-only audit log. Whitelisted indicators are excluded from API responses and exports; expired indicators are excluded from API results.

Pricing

The Open-source self-hosted plan costs nothing. It includes the self-hosted software, with no free trial; the trade-off is that teams must provide the deployment environment and keep both the web app and worker running. There are no paid tiers to weigh against the free plan in this offering.

Platforms

Pulse Intelligence supports API, Linux, macOS, web, Windows, and self-hosted use. Deployment requires Node.js 20.9 or later, PostgreSQL 17 or a compatible PostgreSQL service, and a Redis-compatible server. The project documents both direct Node deployment and a Docker Compose full-stack option, but neither removes the need to operate the supporting components. The project describes phases 1–7 of 8 as implemented, with the final phase covering hardening, large-table partitioning, and deeper security review.

Who it's for

Analysts and junior CTI teams that want a self-managed place to ingest feeds, enrich indicators, save hunts, and produce reports are the clearest fit. SOC teams can also make use of the API and detection-oriented export formats. The technical requirements and ongoing app-and-worker operation make it a poor match for organizations that want a turnkey hosted workspace or lack capacity to manage its dependencies.

Pros and cons

• Pros: Broad threat tracking and multiple public feed sources give analysts a wider base for investigations.
• Pros: Enrichment, alerting saved hunts, scheduled reports, and several IOC export formats support work beyond simply collecting indicators.
• Pros: Scoped read-only API keys and explicit indicator safeguards give teams useful integration and handling controls.
• Cons: Node.js, PostgreSQL, and Redis-compatible infrastructure, plus a continuously running worker, add operational overhead.
• Cons: API throughput is bounded by the default 120 requests per key per 60 seconds, and indicator pages cannot exceed 500 entries.
• Cons: The project still has a final hardening phase underway, so teams seeking a fully mature security review should take that status into account.

Alternatives

Choose OpenAEV instead if attack simulation and tabletop exercises are the priority: its free Community Edition is on-premise and centers on those capabilities. IBM X-Force Exchange offers a freemium web portal, but its free tier does not include X-Force API access. IntelOwl is another free, open-source self-hosted option for teams comparing intelligence tools.

Kaspersky Threat Intelligence Portal may suit teams looking for curated portal access, though its free access limits features and the number of suspicious files and URLs for Cloud Sandbox. MISP is a free open-source alternative under AGPL; a yearly support contract is also offered. ThreatForge has an open-source Community Edition and a commercial Enterprise Edition. Threat Intelligence Platform is a freemium web and API option whose free subscription uses credits for analysis and API requests. Security Vision TIP is a paid option with individually calculated pricing.

Browse more options in Threat Intelligence Platforms; Container Monitoring is a separate category for teams evaluating that kind of software.

Verdict

Pulse Intelligence is a strong choice for analyst and junior CTI teams that want an open-source, self-hosted workspace spanning feed ingestion, enrichment, saved hunts, exports, and scheduled reporting. Its breadth is the main reason to choose it; the need to deploy and maintain Node.js, PostgreSQL, Redis-compatible infrastructure, and a running worker is the main reason to look elsewhere.