Supported sources

Source	Format	Notes
TAXII 2.1 servers	STIX 2.1	Poll interval per collection. TLP and confidence carried through.
MISP	REST API	Events, attributes and tags. Sightings are synced back if you allow it.
Sandbox reports	JSON	Field mapping for common report layouts, or write your own in YAML.
Lists	CSV, TXT	Upload, or point at an S3 or GCS bucket. Defanged values are fine.
Passive DNS	Provider API	Bring your own key. Lookups are cached per workspace.
Certificate transparency	Built in	Every domain node gets its certificate history.
WHOIS / RDAP	Built in	Privacy-redacted records are stored as redacted, not dropped.
DNS and proxy logs	Syslog, S3, or a SIEM export	Used to answer “has this touched us?”. Never shared outside your workspace.

Indicator types

Indicator types: domains and URLs, IP addresses and CIDR ranges, file hashes, TLS certificates, ASNs and hosting, clusters

Domains, hostnames, URLs, IPv4 and IPv6 addresses, CIDR ranges, ASNs, file hashes (MD5, SHA-1, SHA-256), TLS certificates, TLS server fingerprints, email addresses, and registrant details where they’re available.

Your data

What you upload stays in your workspace. Values you mark as TLP:RED are never sent to a third-party enrichment service, so they get only the enrichment Sig Pulse can do locally. You can delete a source, along with every node and edge that only that source reported, from the source’s settings page.