Extracting Domains Not from URL

[michaelsysec242]

Hello Live Comm,

I am working on a use-case that allows us to extract indicators from specific reports and then pushes them to monitoring systems. 

We have seen that using the built-in Extract Indicator command causes domains to be extracted from URLs. Is there a way to allow only domains that are not in a URL to be extracted? I can see that you cant detach the indicator type or edit its Regex property.

For example:

github.com/malicious/repo is extracting github.com. This can cause a lot of havoc as many FP alerts can be encountered from this generally legitimate domain. 

Many thanks,

MR

Cortex XSOAR 

[jfernandes1]

Hi @michaelsysec242, I don't think there is a way to ignore the domains without modifying the regex. I use the below method. 

1. Run the extractIndicators command (This will generate the list of URLs and Domains under the ExtractedIndicators key, the list of domains also contain domain-only IOCs)

2. Run the extractIndicators command on the ExtractedIndicators.URL key. You'll need to run the command with some DT to extract the domains. (Note, the list of domains added to domainfromURL key are domains extracted from URLs only)

!extractIndicators text=${ExtractedIndicators.URL} ignore-outputs=true extend-context=domainfromURL=.=JSON.parse(val).Domain[0]

3. Then run the set function with a filter to ignore Domains that are in the domainfromURL list. Example below.

I hope this helps.