Extract Domains from Text
LAST UPDATED: AUG 07, 2024
Extracts all domains from the input Text. This command may extract false positives. Use the Extensions parameter to filter out extensions that are false positives.
Implementation | Python |
Command Category | Cyber Utility |
Tags | CONDITIOIN ARTIFACT DOMAIN |
Inputs
Parameter Name | Required/Optional | Description | Sample Data |
---|---|---|---|
Text Input | Required | The text to extract Domains from |
CODE
|
Extensions | Required | List of extensions to exclude from the domain search. Extensions already included: .txt, .sql, .ps1, .pdf, .jpg, .png, .gif, .heif, .heic, .jpeg, .psd, .svg, .tif, .doc, .docx, .ppt, .pptx, .xls, .xlsx, .mp3, .wav, .mp4, .mov, .dll, .ini, .zip, .rar, .bat, .exe, .html, .css |
CODE
|
Output
Remote Command API
The D3 command API allows you to send requests to D3 SOAR to execute this utility command via REST API.
Request
POST
https:/{base_url}/{api_namespace}/api/Command/ExtractDomainFromContent
Headers
Please refer to the page Webhook Configuration Guide - Authentication Method: API Keys for more details.
Request Body
{
"Username": <Username here>,
"Site": <Site here>,
"CommandParams": {
"Text Input": <Text Input here>,
"Extensions": [
<Extension 1 here>,
<Extension 2 here>
]
}
}
Body Parameters
Parameter Name | Type | Required/Optional | Description |
---|---|---|---|
Username |
| Required | The username of your D3 SOAR account. |
Site |
| Required | The D3 SOAR site to run the remote command. |
Text Input |
| Required | The text to extract Domains from |
Extensions |
| Required | List of extensions to exclude from the domain search. Extensions already included: .txt, .sql, .ps1, .pdf, .jpg, .png, .gif, .heif, .heic, .jpeg, .psd, .svg, .tif, .doc, .docx, .ppt, .pptx, .xls, .xlsx, .mp3, .wav, .mp4, .mov, .dll, .ini, .zip, .rar, .bat, .exe, .html, .css |
Sample Request
SAMPLE DATA
{
"Username": "Admin",
"Site": "Security Operations",
"CommandParams": {
"Text Input": "MIME-Version: 1\r\nDate: Wed, 27 May 2020 21:45:53 -0700\r\nSubject: Welcome to use SOAR30\r\nFrom: J Zhan jzhan@d3security.com\r\nTo: J Zhan zhan@d3security.com\r\nHi All,\r\nWelcome to use D3 SOAR30.\r\nThank you.\r\nD3 Security\r\n",
"Extensions": [
".js",
".py"
]
}
}
Response
Response Fields
Field Name | Type | Description |
---|---|---|
error |
| The error message if the API request has failed. |
returnData |
| The return data from the API request. |
Sample Response
{
"error": "",
"returnData": {
"Status": "Successful",
"Data": [
"d3security.com"
]
}
}