UnEscapeURLs

Extract URLs redirected by security tools like Proofpoint. Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com.

javascript · Common Scripts

Details

ID	`UnEscapeURLs`
Language	javascript
From Version	5.0.0
Tags	indicator-format

README

Extracts URLs redirected by security tools like Proofpoint, and changes “https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html”
Also, this will un-escape URLs that are escaped for safety with formats such as “hxxps://www[.]demisto[.]com”.

Script Data

Name	Description
Script Type	javascript
Tags	indicator-format

Inputs

Argument Name	Description
input	The URL(s) to process.

Outputs

There are no outputs for this script.

Source

UnEscapeURLs.js UnEscapeURLs.yml

Download History Raw

commonfields:
  id: UnEscapeURLs
  version: -1
name: UnEscapeURLs
script: ''
type: javascript
tags:
- indicator-format
comment: |-
  Extract URLs redirected by security tools like Proofpoint.
  Changes https://urldefense.proofpoint.com/v2/url?u=https-3A__example.com_something.html -> https://example.com/something.html
  Also, un-escape URLs that are escaped for safety with formats like hxxps://www[.]demisto[.]com.
enabled: true
args:
- name: input
  description: The URL(s) to process.
  isArray: true
scripttarget: 0
runas: DBotWeakRole
tests:
- UnEscapeURL-Test
fromversion: 5.0.0