Fang URLs

Description

This operation takes a 'defanged' URL and 'fangs' it, meaning, it removes the alterations that render it useless so that it can be used again.

---

Data types

These are the input/output expected data types for this operation:

Input data

- URLs you want to fang.

Output data

- Valid URLs.

---

Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a *):

Escape Dots*

Set this parameter to true if you want to restore . in the URL domains. For example, example[.]com becomes example.com.

Escape HTTP*

Set this parameter to true if you want to restore hxxp or hxxps and make them http or https, respectively.

Escape ://*

Set this parameter to true if you want to restore the :// separator in your URLs.

Process Type*

Choose one of the following options:

• Valid domains and full URLs - Processes both complete URLs (like https://example.com) and standalone domain names (like example.com).

• Only full URLs - Processes only fully qualified URLs, ignoring standalone domain names.

• Everything - Processes all potential URLs, domain names, or anything resembling a URL in the text.

---

Example

Suppose you want to fang a series of events that represent URLs:

1. In your Pipeline, open the required Action configuration and select the input Field.
2. In the Operation field, choose Fang URL.

3. Set Escape Dots to true.

4. Set Escape HTTP to true.

5. Set Escape ://* to false.

6. Set Process Type to Everything.

7. Give your Output field a name and click Save. The URLs in your input field will be made valid. For example:

hxxps://example[.]com -> hxxps://example.com

You can try out operations with specific values using the Input field above the operation. You can enter the value in the example above and check the result in the Output field.