sig pulse
Indicator graph for threat research

How it works

Six stages: collect, normalize, resolve, suggest links, graph, use. Only stage four involves a model.

Collect

Sig Pulse polls TAXII 2.1 collections and MISP instances on a schedule you set (five minutes by default). It accepts sandbox reports as JSON and takes CSV or plain-text lists by upload or from a storage bucket. It reads DNS and proxy logs so it can tell you which indicators have actually touched your network. The full list is on the sources page.

Normalize

Shared intel is messy. Before anything is stored, Sig Pulse:

  • refangs values (hxxps://bad[.]example becomes https://bad.example)
  • lowercases domains and decodes punycode, keeping the original form as well
  • splits URLs into host, path and query so you can pivot on any part
  • drops private and reserved IP ranges unless you ask to keep them
  • records the source, the time it was received, and the source’s own confidence and TLP marking

Resolve

Each distinct value becomes one node. If a second source reports the same value, it’s added as another source on the existing node. Enrichment runs on new nodes: passive DNS, WHOIS and RDAP, certificate transparency logs, and the IP-to-ASN mapping. Enrichment results are stored as edges with their own source and timestamps, so you can tell “seen in a feed” apart from “looked up by Sig Pulse”.

Suggested links

This is the part that uses machine learning, and it’s deliberately narrow. A model looks at pairs of nodes that aren’t directly connected and estimates how likely it is that the same operator set them up. Some of the signals it uses:

  • certificate reuse, or certificates issued minutes apart with matching subject patterns
  • registration timing, registrar and name server pairs
  • TLS server fingerprints and HTTP response similarity
  • URL path structure and kit file names
  • hosting overlap in small ASNs

Each suggestion appears in the review queue with its score and the specific shared features behind it. Pairs scoring below 0.6 aren’t shown. Accepting a suggestion adds an edge marked as analyst-confirmed, and rejecting it stops it from coming back. With your permission, your team’s accept and reject decisions are used to tune the model for your workspace only. They never train models used by other customers.

Query

The graph is available in the UI, through a REST API, and through openCypher. For example, to find other domains that shared an IP with a known phishing domain in the last 30 days:

MATCH (d:Domain {value: "portal-sso-check.example"})-[:RESOLVES_TO]->(ip:IPv4)
      <-[r:RESOLVES_TO]-(other:Domain)
WHERE r.last_seen > datetime() - duration('P30D')
RETURN other.value, ip.value, r.first_seen
ORDER BY r.first_seen DESC

Export

You can export STIX 2.1 bundles with the source information kept, plain blocklists for firewalls and DNS filters, or CSV. Webhooks fire when a new node connects to an existing case, which is usually the moment someone wants to know about.

What it doesn’t do

Sig Pulse doesn’t attribute activity to named threat actors. Clusters get IDs, and your team decides what to call them. It doesn’t scan or touch the infrastructure it tracks. It doesn’t replace your SIEM, and it reads a copy of your logs instead of sitting inline.