From bc460dc02fadba94aa2dceb3e0b86ee58eca8967 Mon Sep 17 00:00:00 2001
From: LenaigKaliou <lenaigk@protonmail.com>
Date: Wed, 11 Dec 2024 11:38:21 +0100
Subject: [PATCH] Fix for url with no http header

---
 Cisco/cisco-esa/ingest/parser.yml           | 2 +-
 Cisco/cisco-esa/tests/test_ingest_log5.json | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/Cisco/cisco-esa/ingest/parser.yml b/Cisco/cisco-esa/ingest/parser.yml
index ea082905c..06a4f7dec 100644
--- a/Cisco/cisco-esa/ingest/parser.yml
+++ b/Cisco/cisco-esa/ingest/parser.yml
@@ -211,7 +211,7 @@ stages:
             {%- endfor %}]
           cisco.esa.url_domain: >-
             [{% for url, details in json_event_url_details.message.items() %}
-              {% if details.get('ExpandedUrl') is not none %}"{{url.split('/')[2]}}", "{{ details.ExpandedUrl.split('/')[2] }}"{% else %}"{{ url.split('/')[2] }}"{% endif %}
+              {% if details.get('ExpandedUrl') is not none %}"{{url.replace('https://','').replace('http://','').split('/')[0]}}", "{{ details.ExpandedUrl.replace('https://','').replace('http://','').split('/')[0] }}"{% else %}"{{ url.replace('https://','').replace('http://','').split('/')[0] }}"{% endif %}
               {% if not loop.last %},{% endif %}
             {% endfor %}]
           cisco.esa.url: >-
diff --git a/Cisco/cisco-esa/tests/test_ingest_log5.json b/Cisco/cisco-esa/tests/test_ingest_log5.json
index 6bc9470fd..46ca9ebb4 100644
--- a/Cisco/cisco-esa/tests/test_ingest_log5.json
+++ b/Cisco/cisco-esa/tests/test_ingest_log5.json
@@ -59,10 +59,10 @@
           "www.twitter.com"
         ],
         "url_domain": [
-          "",
           "facebook.com",
           "tiktok.com",
-          "tinyurl.es"
+          "tinyurl.es",
+          "www.twitter.com"
         ]
       }
     },