Pulse Intelligence

Overview

Pulse Intelligence is a self-hosted, open-source workspace for collecting and working with threat intelligence. It is best suited to analysts and junior CTI or SOC teams that can operate its supporting services. Its breadth of tracking, enrichment, hunting, and export tools is appealing, but running both the web app and worker means it is not a turnkey hosted service.

Key features

The platform brings threat actors, aliases, campaigns, indicators, reports, sources, CVEs, and ATT&CK mappings into one workspace. It ingests public data from CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs, and security news, giving teams several types of intelligence to work with rather than a single feed.

Indicator enrichment through OTX, AbuseIPDB, and VirusTotal can add context to investigations; Redis-backed quota controls help manage usage. Analysts can save hunts over indicator fields, get alerts when new matches appear, and export those matches. Filtered IOCs can also be exported as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules, making the outputs useful across different analysis and detection workflows.

Scheduled Markdown reports can draw on new indicators, KEV additions, hunt alerts, and feed health. A public read-only API with scoped keys supports analyst scripts, SOAR playbooks, and internal tools. Its default limit is 120 requests per API key per 60-second window, configurable through environment variables, and indicator pages are capped at 500. That is a practical boundary for integrations to account for, not an unrestricted data pipeline.

The repository describes Argon2id passwords, database-backed session cookies, hashed API keys, and an admin-only audit log. Whitelisted indicators are excluded from API responses and exports, while expired indicators are excluded from API results. These safeguards are relevant to teams handling IOC data, though the project says phase 8—covering hardening, large-table partitioning, and deeper security review—remains ahead.

Pricing

Open-source self-hosted: free. The plan is free and open source, with no free trial. There are no paid tiers or seat and quota terms described for the plan; API usage does have the configurable default limit above. The trade-off is operational: teams supply and maintain the deployment environment rather than paying for a hosted option.

Pulse Intelligence requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. The maker documents both direct Node deployment and Docker Compose, and says the web app and worker must both remain running. That is a reasonable fit for teams already able to run these components, but a substantial prerequisite for anyone seeking a quick, managed setup.

Platforms

Pulse Intelligence supports API, Linux, macOS, self-hosted, web, and Windows. These labels describe its reach, not a lower-maintenance hosted deployment: the documented setup still depends on Node.js, PostgreSQL, and Redis, with the app and worker kept running.

Who it's for

Analysts, junior CTI teams, and SOC teams are the clearest fit, especially those that want to combine feed intake, indicator enrichment, saved hunts, and exports in an environment they operate themselves. Teams that need scheduled reports or a read-only API for scripts and internal integrations also have useful workflow components in one place.

It is a weaker choice for organizations that cannot maintain the required services, need a finished deployment with no operating burden, or require a project whose stated implementation work is complete. The README says phases 1–7 of 8 are implemented, with hardening and deeper security review still in phase 8.

Pros and cons

• Pro: Feed ingestion, enrichment, hunting, reporting, and multiple IOC export formats cover a useful span of analyst work in one self-hosted workspace.
• Pro: Scoped API keys and exclusions for whitelisted and expired indicators give integrations defined access and data-handling boundaries.
• Con: Node.js, PostgreSQL, Redis, and continuously running web and worker processes create real deployment and maintenance work.
• Con: The project's own phase plan leaves hardening and deeper security review for phase 8, a relevant caveat for teams assessing operational risk.
• Con: The API's default rate limit and 500-item page cap may constrain high-volume integrations unless teams configure around the limit where possible.

Alternatives

Choose OpenAEV if attack simulation and tabletop exercises are the priority; its free Community Edition is on-premise and includes community support. IBM X-Force Exchange has a free portal tier, but that tier does not include X-Force API access.

IntelOwl is another free, open-source self-hosted option for teams comparing intelligence tools. Kaspersky Threat Intelligence Portal offers free access to curated features, with limits on suspicious files and URLs for Cloud Sandbox. Pick MISP if you want its open-source software released under AGPL; it also offers a yearly support contract at €7.31 a year.

ThreatForge offers a free AGPL-3.0-or-later Community Edition and an Enterprise Edition with a 90-day trial. Security Vision TIP is a paid option with individual pricing calculated through sales. Threat Intelligence Platform has a free subscription with 100 credits after sign-up, where web analysis costs 10 credits per request and API requests cost 1–3 credits.

Browse the Threat Intelligence Platforms list for more options. The Container Monitoring list covers a different category.

Verdict

Pulse Intelligence is a strong candidate for analyst and junior CTI or SOC teams that want an open-source threat-intelligence workspace they can run and integrate themselves. Its combination of feed ingestion, enrichment, hunts, exports, and reporting is the main reason to choose it. Look elsewhere if operating Node.js, PostgreSQL, and Redis is not feasible, or if phase-8 hardening and security review still being in progress is a blocker.