IsInternalDomainName

This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains. If the tested subdomain is in one of the main domains, the result will be true. For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.

python · Common Scripts

Details

IDIsInternalDomainName
Languagepython
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10404775
TagsUtility

README

This script accepts multiple values for both arguments and will iterate through each of the domains to check if the specified subdomains are located in at least one of the specified main domains.
If the tested subdomain is in one of the main domains, the result will be true.

For example, if the domain_to_check values are apps.paloaltonetworks.com and apps.paloaltonetworks.bla and the domains_to_compare values are paloaltonetworks.com and demisto.com, the result for apps.paloaltonetworks.com will be true since it is a part of the paloaltonetworks.com domain. The result for apps.paloaltonetworks.bla will be false since it is not a part of the paloaltonetworks.com or demisto.com domain.

Script Data

Name Description
Script Type python3
Tags Utility
Cortex XSOAR Version 5.0.0

Inputs

Argument Name Description
main_domains A comma-separated list of main domains. The subdomains will be compared to this list of main domains. For example, google.com.
possible_sub_domains_to_test A comma-separated list of subdomains. These subdomains will be compared to the list of main domains.

Outputs

Path Description Type
IsInternalDomain.DomainToTest The subdomain that was checked to see if it is part of the specified domains. String
IsInternalDomain.IsInternal True, if the subdomain is part of one of the specified domains. Otherwise, false. Boolean
IsInternalDomain.DomainToCompare The names of the main domains that were used to compare the subdomains to. String

Source

IsInternalDomainName.py IsInternalDomainName_test.py IsInternalDomainName.yml
Download History Raw 
import pytest
from IsInternalDomainName import check_sub_domains_in_domain, is_sub_domain_contained


@pytest.mark.parametrize(
    "domain_name, domain_to_check,  expected_output",
    [
        # domain valid
        (
            ["paloaltonetworks.com", "paloaltonetworkss.coms"],
            ["paloaltonetworks.com", "apps.paloaltonetworks.com", "a.paloaltonetworkss.coms"],
            [
                ("paloaltonetworks.com", ["paloaltonetworks.com", "paloaltonetworkss.coms"], True),
                ("apps.paloaltonetworks.com", ["paloaltonetworks.com", "paloaltonetworkss.coms"], True),
                ("a.paloaltonetworkss.coms", ["paloaltonetworks.com", "paloaltonetworkss.coms"], True),
            ],
        ),
        # domain NOT valid
        (
            ["ppaloaltonetworks.com", "bla.com"],
            ["paloaltonetworks.com", "paloaltonetworkss.com", "apps.paloaltonetworks.com"],
            [
                ("paloaltonetworks.com", ["ppaloaltonetworks.com", "bla.com"], False),
                ("paloaltonetworkss.com", ["ppaloaltonetworks.com", "bla.com"], False),
                ("apps.paloaltonetworks.com", ["ppaloaltonetworks.com", "bla.com"], False),
            ],
        ),
        (
            ["paloaltonetworks.com"],
            ["paloaltonetworks.com", "paloaltonetworkss.com", "apps.paloaltonetworks.com"],
            [
                ("paloaltonetworks.com", ["paloaltonetworks.com"], True),
                ("paloaltonetworkss.com", ["paloaltonetworks.com"], False),
                ("apps.paloaltonetworks.com", ["paloaltonetworks.com"], True),
            ],
        ),
        (["cig.eu"], ["abcdcig.eu"], [("abcdcig.eu", ["cig.eu"], False)]),
        (["cd.com"], ["ab-cd.com"], [("ab-cd.com", ["cd.com"], False)]),
        (["ab-cd.com"], ["zz.ab-cd.com"], [("zz.ab-cd.com", ["ab-cd.com"], True)]),
    ],
)
def test_check_in_domain(domain_name, domain_to_check, expected_output):
    """
    Given:
        - domain name and a list of domains to check

    When:
        - running the script

    Then:
        - returns for each sub domain if it is a sub domain of given domainName or not

    """
    result = check_sub_domains_in_domain(domain_name, domain_to_check)
    for index, sub_domain in enumerate(result.outputs["IsInternalDomain"]):
        assert sub_domain["DomainToTest"] == expected_output[index][0]
        assert sub_domain["DomainToCompare"] == expected_output[index][1]
        assert sub_domain["IsInternal"] == expected_output[index][2]


@pytest.mark.parametrize(
    "main_domain, sub_domain, expected_output",
    [
        ("paloaltonetworks.com", "apps.paloaltonetworks.com", True),
        ("cd.com", "ab-cd.com", False),
        ("cig.eu", "abcdcig.eu", False),
    ],
)
def test_extract_main_domain(main_domain, sub_domain, expected_output):
    """
    Given:
        - A main domain and a sub domain
    When:
        - Checking if the main_domain contains the sub_domain
    Then:
        - Return True if the main_domain contains the sub_domain, False otherwise
    """
    assert is_sub_domain_contained(main_domain, sub_domain) == expected_output