Domain extraction ↗
The Cortex XSIAM domain indicator type is built using regular expression and a formatting script. The following describes the domain extraction components and what output you should expect when extracting indicators of type domain.
Cortex XSIAM domain indicator extraction components
There are two components when extracting domain indicators:
- Regular expression
- Formatting script
Domain indicator regular expression
When text is given, a domain regular expression will try to catch a valid domain based on the following characteristics:
- A domain with ASCII and non-ASCII characters
- Escaped and unescaped domains
The regular expression can extract domains from one of the following:
- Explicit domain
- URL
- Email address
Format extracted domain indicators
After extracting the domain using a regular expression, an ExtractDomainAndFQDNFromUrlAndEmail formatting script iterates on each given domain and does the following:
-
Replaces "[.]" with ".".
For example:
www[.]example.com --> www.example.com -
Validate the Top-Level-Domain to avoid file extension false positives.
Excludes ‘.zip’ Top-Level-Domain by default.
-
Returns the formatted domain.
Supported domain indicator structures
example.comwww.example.comxn--t1e2s3t4.comwww.xn--t1e2s3t4.comwww.example.co.ukexample.co.uksubtest.example.comwww.example.example.comöexample.comexampleö.comwww.exampleö.comwww.examöle.com
For more information, see Indicator extraction.