About the connector
URL Expander is a service using which you can find out the destination of a shortened URL before you click and visit that link. By examining the link before clicking, you will have a better chance of avoiding phishing, malware, and viruses, from entering your network.
This document provides information about the URL Expander connector, which facilitates automated interactions with URL Expander using FortiSOAR™ playbooks. Add the URL Expander connector as a step in FortiSOAR™ playbooks and perform automated operations, such as converting any URL that has been shortened or masked using any URL shortening service, to its original (expanded) form.
Version information
Connector Version: 1.0.0
FortiSOAR™ Version Tested on: 4.11.0-1161
Authored By: Fortinet
Certified: Yes
Installing the connector
All connectors provided by FortiSOAR™ are delivered using a FortiSOAR™ repository. Therefore, you must set up your FortiSOAR™ repository and use the yum command to install connectors:
yum install cyops-connector-url-expander
For the detailed procedure to install a connector, click here.
Prerequisites to configuring the connector
- You must have the URL of the URL Expander server to which you will connect and perform automated operations.
- To access the FortiSOAR™ UI, ensure that port 443 is open through the firewall for the FortiSOAR™ instance.
Configuring the connector
For the procedure to configure a connector, click here.
Configuration parameters
In FortiSOAR™, on the Connectors page, click the URL Expander connector row, and in the Configuration tab enter the required configuration details.
| Parameter |
Description |
| Server URL |
URL of the URL Expander server to which you will connect and perform the automated operations. |
Actions supported by the connector
The following automated operations can be included in playbooks, and you can also use the annotations to access operations from FortiSOAR™ release 4.10.0 onwards:
| Function |
Description |
Annotation and Category |
| Expand URL |
Retrieves the original (expanded) form of the URL that you have specified, which has been shortened or masked using any URL shortening service, from URL Expander. |
expand_url
Investigation |
operation: Expand URL
Input parameters
| Parameter |
Description |
| Shortened URL |
URL that has been shortened or masked using any URL shortening service whose original URL you want to retrieve from URL Expander. |
Output
The output contains the following populated JSON schema, which contains the original or expanded form of the URL for the shortened URL you have specified, retrieved from URL Expander.
{
"original":"",
"expanded":""
}
Included playbooks
The Sample - URL Expander - 1.0.0 playbook collection comes bundled with the URL Expander connector. This playbook contains steps using which you can perform all supported actions. You can see the bundled playbooks in the Automation > Playbooks section in FortiSOAR™ after importing the URL Expander connector.
Note: If you are planning to use any of the sample playbooks in your environment, ensure that you clone those playbooks and move them to a different collection since the sample playbook collection gets deleted during connector upgrade and delete.
