Threat Pulse: Threat Intelligence Feed Aggregator
Overview
Threat Pulse is a threat intelligence aggregator that lets you look up IPs, domains, and file hashes against multiple open intel sources from a single interface. Instead of bouncing between AbuseIPDB, AlienVault OTX, and VirusTotal in separate tabs, you search once and get a consolidated view with verdict, confidence score, source breakdown, and historical context.
I built this because indicator lookups are one of the most repetitive tasks in security operations. Every analyst has five tabs open doing the same search across different platforms. This tool puts all of that into one place with a layout designed for the way SOC work actually flows.
How it works
The interface is built like a monitoring panel. The left sidebar handles search input, sample indicators, and a running history of everything you’ve looked up during the session. The main area shows results in a dense data table that you can click to expand, not a stack of cards you have to scroll through. There’s a status bar at the top tracking your lookup count and how many came back malicious.
Search an indicator and it auto-detects whether it’s an IP, domain, or hash. You can also manually set the type if the auto-detection doesn’t fit. Results come back with a verdict (malicious, suspicious, clean, unknown), a confidence percentage, report count, first and last seen dates, categories, and a per-source breakdown showing exactly what each intel provider returned.
The Threat Feed tab shows a timeline of recent threat intelligence items, formatted the way you’d actually read them during a shift: timestamp on the left, description in the middle, severity on the right. No extra clicks needed.
What it pulls from
The aggregation layer consolidates data from three open threat intelligence sources:
- AbuseIPDB for IP reputation scoring and abuse report counts
- AlienVault OTX for pulse data, community-contributed indicators, and tagging
- VirusTotal for multi-engine detection ratios on domains, IPs, and file hashes
In the current version, the tool runs on demo data so you can see the full flow without needing API keys. The Next.js build routes API calls through server-side functions so your keys never touch the browser.
Why I built it this way
The SOC panel layout was a deliberate choice. Most threat intel tools I’ve used feel like they were designed for a blog post, not for someone sitting at a desk running through a queue of alerts. The sidebar keeps your search history visible so you’re not retyping indicators you already checked. The data table format lets you scan results faster than clicking through individual cards.
I kept the demo data realistic. The sample indicators include a known Tor exit node, a Google DNS address, a simulated C2 domain, and the EICAR test file hash. These are the kinds of lookups you’d actually run during triage, not random data.
Tech stack
- Next.js (React framework)
- Supabase (database for persistent history in production)
- AbuseIPDB, AlienVault OTX, VirusTotal free-tier APIs
- Deployed on Vercel
What’s next
The production build will connect to the actual APIs through Next.js server-side routes, add persistent search history backed by Supabase, and support bulk indicator uploads for batch lookups. I also want to add exportable reports so you can pull a summary of your findings and attach it to a ticket.
Stack: Next.js, Supabase, Vercel