Post Gmail Phishing Alerts to Slack/Microsoft Teams

[midhun_kumar]

Hi Folks,

We’ve encountered a challenge in our current workflow due to our security gateway rewriting URLs in the emails we receive. Specifically, the URLs now look like this: “https://protect-eu.mimecast.com/s/CbnZCAQMmIJ9OwzSG9CQz?domain==abc.com”.

We’re seeking advice on how to extract only the domain part (“abc.com”) while omitting everything preceding it, including the “domain==” string.

[darrick_hall1 (Darrick Hall)]

You can use the Pattern Match Step to achieve your desired results. In my example below I defined two new variables “NotDomain” to pull out the domain==, and “Domain” to capture abc.com. There might be more efficient way, but this way worked for me. Here is the input for the pattern section {{NotDomain:/(?:domain==)/}}{{Domain:/([^&\s]+)/}}

[midhun_kumar]

Thank You Darrick. Let me try the same in our env and let you know.

[midhun_kumar]

Thank you Darrick. Provided regex did the wonder!!!