Splunk Search

Regex in Playbook

chandraprathi
Explorer

I have required where the CEF comes as URL and I need just a part of the URL to pass as input(ARTIFACT.CEF.URL) to action in Splunk phantom. I am using the phantom version 4.8. Can someone suggest me an idea on How I can just pass the part of the URL instead of the complete URL?

Labels (3)
Tags (2)
0 Karma
1 Solution

chandraprathi
Explorer
0 Karma

chandraprathi
Explorer

Thank you for your reply @sam_splunk. I have fixed it by extracting the portion of the URL which I need and forgot to mention it here.

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

Did you end up doing the extraction on the Splunk side?

0 Karma

chandraprathi
Explorer

yes @sam_splunk 

0 Karma

sam_splunk
Splunk Employee
Splunk Employee

So you've got an artifact (e.g. souceAddress = "https://www.somedomain.com") and you want to trim out a portion of it (e.g. somedomain.com) to make available for downstream blocks?

0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...