What it can do
- Find URLs inside surrounding text
- Sort and deduplicate findings
- Defang schemes, separators, and dots
How the recipe works
Extract URLs
Extract complete URLs and remove duplicates.
Defang URL
Rewrite active-looking indicators into report-safe form.
Demonstration
Sample input
Alert: https://example.test/login and http://updates.example.test/a.exeExpected result
hxxps[://]example[.]test/loginWhen to use it
- Threat reports
- Incident tickets
- Indicator-sharing notes
Adapt it
Change Defang URL to process domains as well when your input contains bare hostnames.
Source and verification
Adapted from mattnotmax CyberChef recipes. The explanation and sample are written for Serialize, use synthetic or documentation-safe data, and are checked against the current operation catalogue. The workflow runs locally without an external API call.