ParseHTMLIndicators

This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.

python · Common Scripts

Details

ID	`ParseHTMLIndicators`
Language	python
From Version	5.5.0
Docker Image	`demisto/bs4-tld:1.0.0.10133006`

README

This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.

Script Data

Name	Description
Script Type	python3
Tags
Cortex XSOAR Version	5.5.0

Used In

This script is used in the following playbooks and scripts.

Kaseya VSA 0-day - REvil Ransomware Supply Chain Attack

Inputs

Argument Name	Description
url	The full URL of the blog
exclude_indicators	The indicators to be excluded from the results.
exclude_TLD	Top-Level-Domain to be excluded from domain indicators.
unescape_domain	Whether to remove brackets [] from the domain regex extraction. Can result in higher false positives for file extensions.

Outputs

Path	Description	Type
http.parsedBlog.indicators	The extracted indicators	Unknown
http.parsedBlog.sourceLink	The link for the source of the indicators	Unknown

Source

ParseHTMLIndicators.py ParseHTMLIndicators.yml

Download History Raw

commonfields:
  id: ParseHTMLIndicators
  version: -1
contentitemexportablefields:
  contentitemfields:
    fromServerVersion: ""
name: ParseHTMLIndicators
script: ''
type: python
tags: []
comment: This script will extract indicators from given HTML and will handle bad top-level domains to avoid false positives caused by file extensions.
enabled: true
system: true
args:
- name: url
  required: true
  description: The full URL of the blog.
- name: exclude_indicators
  description: The indicators to be excluded from the results.
  isArray: true
- name: exclude_TLD
  description: Top-Level-Domain to be excluded from domain indicators.
  isArray: true
  defaultValue: zip
- name: unescape_domain
  auto: PREDEFINED
  predefined:
  - "False"
  - "True"
  description: Whether to remove brackets [] from the domain regex extraction. Can result in higher false positives for file extensions.
  defaultValue: "False"
outputs:
- contextPath: http.parsedBlog.indicators
  description: The extracted indicators.
- contextPath: http.parsedBlog.sourceLink
  description: The link for the source of the indicators.
scripttarget: 0
subtype: python3
dockerimage: demisto/bs4-tld:1.0.0.10133006
runas: DBotWeakRole
fromversion: 5.5.0
tests:
- ParseHTMLIndicators-Test