AnsweredAssumed Answered

URL as a feed/indicator

Question asked by Jay Watson on May 10, 2018
Latest reply on May 17, 2018 by Dion Stempfley

I would like to add a custom feed that focuses on URL as an indicator. Using domain and mapping them to alias.host does not seem to be overly beneficial as it creates a lot noise and triggers on potentially a non-indicator. As I do not see URL as being indexed I can only think that this would be a problem and would not work as expected. Does anyone have a clever way of pulling in a feed focusing on a list of specific URLs rather then purely IPs and domains?

 

'http://www.example1234.com/content-access/article.html'

or

'http://www.example1234.com/content-access/eng/access-in/index.html'

vs.

'www.example1234.com'

Outcomes