Extracting Domains Not from URL

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Extracting Domains Not from URL

L3 Networker

Hello Live Comm,

I am working on a use-case that allows us to extract indicators from specific reports and then pushes them to monitoring systems. 

We have seen that using the built-in Extract Indicator command causes domains to be extracted from URLs. Is there a way to allow only domains that are not in a URL to be extracted? I can see that you cant detach the indicator type or edit its Regex property.

For example:

github.com/malicious/repo is extracting github.com. This can cause a lot of havoc as many FP alerts can be encountered from this generally legitimate domain. 

Many thanks,

MR

Cortex XSOAR 

1 REPLY 1

L5 Sessionator

Hi @michaelsysec242, I don't think there is a way to ignore the domains without modifying the regex. I use the below method. 

 

1. Run the extractIndicators command (This will generate the list of URLs and Domains under the ExtractedIndicators key, the list of domains also contain domain-only IOCs)

2. Run the extractIndicators command on the ExtractedIndicators.URL key. You'll need to run the command with some DT to extract the domains. (Note, the list of domains added to domainfromURL key are domains extracted from URLs only)

!extractIndicators text=${ExtractedIndicators.URL} ignore-outputs=true extend-context=domainfromURL=.=JSON.parse(val).Domain[0]

3. Then run the set function with a filter to ignore Domains that are in the domainfromURL list. Example below.

example_of_set_function.png

 

I hope this helps. 

  • 626 Views
  • 1 replies
  • 0 Likes
  • 31 Subscriptions
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!