security_content/playbooks/custom_functions/url_parse.json at develop · splunk/security_content · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
{
    "create_time": "2023-01-04T19:35:48.275812+00:00",
    "custom_function_id": "0c42d4fafd7f8d2313721a1f1619b10a34ee656e",
    "description": "Separate a URL into its components using urlparse() from the urllib module of Python 3.",
    "draft_mode": false,
    "inputs": [
        {
            "contains_type": [
                "url"
            ],
            "description": "The URL to parse",
            "input_type": "item",
            "name": "input_url",
            "placeholder": "artifact:*.cef.requestUrl"
        }
    ],
    "outputs": [
        {
            "contains_type": [],
            "data_path": "scheme",
            "description": "The scheme of the URL, such as HTTP, HTTPS, or FTP."
        },
        {
            "contains_type": [],
            "data_path": "netloc",
            "description": "The network location part of the URL."
        },
        {
            "contains_type": [
                ""
            ],
            "data_path": "path",
            "description": "The path to the resource after the first slash in the URL, such as \"en_us/software/splunk-security-orchestration-and-automation.html\"."
        },
        {
            "contains_type": [],
            "data_path": "params",
            "description": "The parameters in the URL after the semicolon."
        },
        {
            "contains_type": [
                ""
            ],
            "data_path": "query",
            "description": "The query string of the URL after the question mark. Multiple parameters are not separated from each other."
        },
        {
            "contains_type": [],
            "data_path": "fragment",
            "description": "The subcomponent of the resource which is identified after the hash sign."
        },
        {
            "contains_type": [
                "url"
            ],
            "data_path": "output_url",
            "description": "Passthrough of the original url"
        },
        {
            "contains_type": [
                "hostname"
            ],
            "data_path": "hostname",
            "description": "The host name of the url"
        },
        {
            "contains_type": [
                "port"
            ],
            "data_path": "port",
            "description": "The port number, if one is used"
        }
    ],
    "outputs_type": "item",
    "platform_version": "5.5.0.108488",
    "python_version": "3.13"
}