03-15-2023 01:41 AM
when I extract indicators from body of an email (the body of the email is in html format). I don't get the URLs, only the domains inside the URLs are extracted but the URLs itself not extracted.
what I understand in extracting domains, that it works to extract emails and URLs then extract domains from it.
Kindly find the attachment to show you the issue.
any support is highly appreciated.
03-16-2023 12:59 AM - edited 03-16-2023 01:40 AM
So you are using first the URL indicator extraction on the html File https://xsoar.pan.dev/docs/indicators/url-extraction ? If you are first using https://xsoar.pan.dev/docs/reference/scripts/extract-email-v2 it may not work.
Also you can see https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/need-help-on-extract-indicators-from-e... as the principles are the same.
Also nice clip about indicators by palo alto https://www.youtube.com/watch?v=DVGWeYJMDQQ&t=375s
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
