Dataminr Pulse CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

Dataminr Pulse Alerts

The Dataminr Pulse Alerts feed ingests Dataminr Pulse Alerts into the ThreatQ platform as events.  

GET https://gateway.dataminr.com/account/2/get_lists

The feed retrieves all the IDs (.watchlists.{{CATEGORY}}.id) for the lists configured in Dataminr Portal. The IDs are sent to the supplemental feeds Dataminr Get Next Alerts, Dataminr Get Previous Alerts to get the needed alerts.

Sample Response:

{
  "watchlists": {
    "TOPIC": [
      {
        "id": 4153708,
        "properties": {
          "watchlistColor": "darkblue"
        },
        "name": "Government",
        "description": "",
        "type": "TOPIC"
      }
    ],
    "COMPANY": [
      {
        "name": "Top Companies",
        "companies": [
          {
            "id": "e7a463003d6229c750586f8a263ec4e0",
            "name": "YUM! Brands, Inc."
          }
        ],
        "description": "",
        "type": "COMPANY",
        "id": 4153722,
        "properties": {
          "watchlistColor": "darkblue"
        }
      }
    ],
    "CUSTOM": [
      {
        "id": 4177550,
        "properties": {
          "watchlistColor": "darkblue"
        },
        "name": "Exploits",
        "description": "",
        "type": "CUSTOM"
      }
    ]
  }
}

Dataminr Supplemental Feeds

The integration utilizes three supplemental feeds: Dataminr Get Next Alerts, Dataminr Get Previous Alerts, Dataminr Get Related Alerts.

The Dataminr API has a cursor based implementation. Dataminr Get Next Alerts retrieves the alerts that Dataminr considers as new alerts for the user. Dataminr Get Previous Alerts retrieves the alerts that are considered old/read. If user config Ingest related alerts is enabled, the feed Dataminr Get Related Alerts ingested the related alerts for each entry.

Dataminr Get Next Alerts, Dataminr Get Previous Alerts - GET https://gateway.dataminr.com/api/3/alerts

Dataminr Get Related Alerts - GET https://gateway.dataminr.com/alerts/2/get_related?id={{ALERT_ID}}

Sample Response:

{
  "data": {
    "alerts": [
      {
        "alertId": "1407810963-1701783539058-3",
        "alertType": {
          "id": "urgent",
          "name": "Urgent",
          "color": "FFBB05"
        },
        "watchlistsMatchedByType": [
          {
            "id": "4177550",
            "type": "CUSTOM",
            "name": "Exploits",
            "externalTopicIds": [],
            "userProperties": {
              "omnilist": "true"
            }
          }
        ],
        "availableRelatedAlerts": 0,
        "eventTime": 1701783733823,
        "eventVolume": 0,
        "metadata": {
          "cyber": {
            "vulnerabilities": [
              {
                "id": "CVE-2023-49105",
                "cvss": 9.8,
                "products": [
                  {
                    "productName": "owncloud",
                    "productVersion": " ",
                    "productVendor": "owncloud"
                  }
                ],
                "exploitPocLinks": []
              }
            ],
            "URLs": [
              "ambionics.io"
            ],
            "addresses": [
              {
                "ip": "148.72.164.186",
                "port": "80"
              }
            ],
            "asns": [],
            "orgs": [],
            "hashes": [],
            "products": [],
            "malwares": [],
            "threats": [],
            "asOrgs": [
              {
                "asn": "AS13335",
                "asOrg": "Cloudflare"
              }
            ],
            "hashValues": []
          }
        },
        "caption": "CVE-2023-49105 referenced on X (formerly Twitter)",
        "subCaption": {
          "bullets": {
            "content": "Philip Morris mentioned in headline\nSampoerna and Philip Morris International mentioned in article",
            "source": "According to Capital Romanian"
          }
        },
        "companies": [
          {
            "name": "Apple Inc.",
            "topicType": "company",
            "id": "2adac6e9b077021a8c4e5de1a3aa057b",
            "idStr": "2adac6e9b077021a8c4e5de1a3aa057b",
            "ticker": "\"apple+\"",
            "retired": false
          }
        ],
        "categories": [
          {
            "name": "Cybersecurity",
            "topicType": "category",
            "id": "124022",
            "idStr": "124022",
            "path": "/TOPIC/EXT/CS/124022",
            "retired": false
          }
        ],
        "eventLocation": {
          "coordinates": [
            37.3318598,
            -122.0302485
          ],
          "name": "Apple Inc. HQ, Cupertino, CA, USA",
          "places": [
            "8e51ba12f754ae46a6ec7816d6e7a617",
            "f66b10a1b6d5d260b3ddb7e7518aa5ac",
            "2f7245ea29c7d5a90bfd48512f971ef0",
            "0a269a52d33a19cd680c4d33aef9a4af",
            "4e9ea3cb3310c59405b5cd3844856d12"
          ],
          "probability": 0.0,
          "radius": 0.1
        },
        "sectors": [],
        "headerColor": "FFFFAD",
        "publisherCategory": {
          "id": "chatter",
          "name": "Chatter",
          "color": "A24512",
          "shortName": "CTR"
        },
        "expandAlertURL": "https://app.dataminr.com/#alertDetail/5/1407810963-1701783539058-3",
        "expandUserURL": "https://app.dataminr.com/#userDetail/@ambionics",
        "relatedTerms": [
          {
            "text": "exploit",
            "url": "https://app.dataminr.com/app/core/corporate/search-popup.html#search/%7B%22history%22%3A%5B%7B%22displayTitle%22%3A%22exploit%22%2C%22elements%22%3A%5B%7B%22topicName%22%3A%22exploit%22%2C%22type%22%3A%22string%22%2C%22topicId%22%3A-1%2C%22equitySymbol%22%3A%22%22%7D%5D%2C%22target%22%3A%22searchinput%22%2C%22type%22%3A%22complex%22%2C%22isEquity%22%3Afalse%2C%22topicId%22%3A-1%2C%22text%22%3A%22%22%7D%5D%7D/location/%7B%22center%22%3A%7B%22lat%22%3A14.43468021529728%2C%22lng%22%3A-65.91796875%2C%22zoom%22%3A2%7D%2C%22zoom%22%3A2%2C%22extent%22%3A%7B%22north%22%3A73.42842364106818%2C%22east%22%3A48.1640625%2C%22south%22%3A-62.91523303947613%2C%22west%22%3A-179.6484375%7D%7D"
          },
          {
            "text": "referenced",
            "url": "https://app.dataminr.com/app/core/corporate/search-popup.html#search/%7B%22history%22%3A%5B%7B%22displayTitle%22%3A%22referenced%22%2C%22elements%22%3A%5B%7B%22topicName%22%3A%22referenced%22%2C%22type%22%3A%22string%22%2C%22topicId%22%3A-1%2C%22equitySymbol%22%3A%22%22%7D%5D%2C%22target%22%3A%22searchinput%22%2C%22type%22%3A%22complex%22%2C%22isEquity%22%3Afalse%2C%22topicId%22%3A-1%2C%22text%22%3A%22%22%7D%5D%7D/location/%7B%22center%22%3A%7B%22lat%22%3A14.43468021529728%2C%22lng%22%3A-65.91796875%2C%22zoom%22%3A2%7D%2C%22zoom%22%3A2%2C%22extent%22%3A%7B%22north%22%3A73.42842364106818%2C%22east%22%3A48.1640625%2C%22south%22%3A-62.91523303947613%2C%22west%22%3A-179.6484375%7D%7D"
          }
        ],
        "relatedTermsQueryURL": "https://app.dataminr.com/#search-popup/search/%7B%22history%22%3A%5B%7B%22displayTitle%22%3A%22blogpost,cve,cyber exploits,exploit,referenced%22%2C%22elements%22%3A%5B%7B%22topicName%22%3A%22blogpost,cve,cyber exploits,exploit,referenced%22%2C%22type%22%3A%22string%22%2C%22topicId%22%3A-1%2C%22equitySymbol%22%3A%22%22%7D%5D%2C%22target%22%3A%22searchinput%22%2C%22type%22%3A%22complex%22%2C%22isEquity%22%3Afalse%2C%22topicId%22%3A-1%2C%22text%22%3A%22%22%7D%5D%7D/location/%7B%22center%22%3A%7B%22lat%22%3A14.43468021529728%2C%22lng%22%3A-65.91796875%2C%22zoom%22%3A2%7D%2C%22zoom%22%3A2%2C%22extent%22%3A%7B%22north%22%3A73.42842364106818%2C%22east%22%3A48.1640625%2C%22south%22%3A-62.91523303947613%2C%22west%22%3A-179.6484375%7D%7D",
        "userRecentImages": [],
        "userTopHashtags": [],
        "post": {
          "timestamp": 1701788203472,
          "languages": [],
          "media": [],
          "link": "https://www.axios.com/2023/12/05/us-israeli-settler-west-bank-visa-ban-plan"
        },
        "source": {
          "verified": false,
          "displayName": "Axios",
          "channels": [
            "news"
          ]
        }
      }
    ]
  }
}

ThreatQuotient provides the following default mapping for this feed:

PDF Guides