Ninja Pulse — the social-signal manual
Pulse watches public social feeds — Bluesky, Mastodon, Reddit — and turns them into threat intelligence: it extracts indicators with regex, runs budget-capped LLM extraction for actors and malware, and scores everything by confidence. Most of Pulse is public; this manual walks the firehose and each browser.
What Pulse is
A standalone social-signal threat-intel platform. Pulse ingests public posts, pulls out IOCs for
free with regex, and — only on candidate posts, under a budget cap — runs LLM named-entity
extraction for threat actors, malware and campaigns. Every node and edge carries a confidence
score and a source_type: social tag.
/admin/* dashboards are gated.The firehose
The landing page: a live feed of incoming social posts, sweeping roughly every 60 seconds. It's the raw material — watch threat chatter arrive from Bluesky, Mastodon and Reddit in real time.
Indicators
Every indicator Pulse extracted, for free, with regex: CVEs, IPv4 addresses, domains, MD5/SHA1/SHA256 hashes, Bitcoin addresses and ATT&CK technique IDs. Pivot from an indicator to the posts and entities around it.
Actors & Malware
The LLM-extracted layer: threat actors and malware families named from the social stream, each with detail pages and confidence. This is where the budget-capped NER earns its keep — turning chatter into named, scored entities.
Sources & Search
Sources lists the ingestion feeds and their health. Search runs
across posts, IOCs, actors and malware in one query, so you can pivot from any mention to
everything Pulse knows about it. New here? The /welcome page explains the whole thing.
Admin dashboards
The only login-gated surface: source health and the LLM-spend dashboard that tracks the extraction budget. Access needs an ecosystem SSO cookie; everything else in Pulse is open.