Suricata http logs - user path to domain

[hegga]

Hi,

I'm trying to create a search which can be used to identify what "path" users has taken when they land on an interesting domain through the suricata http logs. I plan on presenting the results with a table and through a sankey diagram. However the search below is not working for me. Basically I try to identify if there are any relations between the domain field and the domain in the http_referer field.

So if example.com is the interesting domain, I'd like to identify how the user got there, for example:

bing.com ==> otherdomain.com ==> thirddomain.com ==> example.com

The search I've got so far is as following:

base search
| rex field=http_referer "//(?<referer_domain>.*?\.\w+)($|/)" 
| eval related_domains="example.com"
| streamstats current=f global=f window=1 values(related_domains) as last_related_domains
| eval related_domains=if(mvcount(last_related_domains) > mvcount(related_domains), last_related_domains, related_domains)
| eval related=if(domain IN(related_domains) OR referer_domain IN(related_domains), 1, 0)
| eval related_domains=if(related==1, mvdedup(mvappend(related_domains, last_related_domains, referer_domain, domain)), related_domains)
| streamstats current=f global=f window=1 values(related_domains) as last_related_domains
| table _time, host, http_status, http_method, domain, url, http_referer, referer_domain, related, related_domains, last_related_domains

I have to present the results both using the full url and by domains, but I've chosen to use the domains to establish relationship between domains, or that's at least what I'm trying to do. Can anyone help establish relationship between domains in a domain chain as described above?