[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-07-14 UTC."],[[["\u003cp\u003eThe \u003ccode\u003estrings.extract_domain\u003c/code\u003e function extracts the domain from a given string, which is commonly a URL.\u003c/p\u003e\n"],["\u003cp\u003eThis function does not perform Unicode normalization and treats private domains as part of the public suffix, based on data from publicsuffix.org.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns an empty string if the input is an empty string, a random string, contains multiple backslashes, is a URI without a domain, or contains certain special characters.\u003c/p\u003e\n"],["\u003cp\u003eThe function can handle non-alphabet characters and multiple characters before the actual URL, returning the appropriate domain.\u003c/p\u003e\n"],["\u003cp\u003eThe output of the function may change over time due to updates in the public suffix data.\u003c/p\u003e\n"]]],[],null,["### strings.extract_domain\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.extract_domain(url_string)\n\n#### Description\n\nExtracts the domain from a string.\n| **Note:** The function does not perform Unicode normalization.\n| **Note:** The public suffix data at publicsuffix.org also contains private domains. This function does not treat a private domain as a public suffix. For example, if us.com is a private domain in the public suffix data, (\"foo.us.com\") returns us.com (the public suffix com plus the preceding label us) rather than foo.us.com (the private domain us.com plus the preceding label foo).\n| **Note:** The public suffix data might change over time. Consequently, input that produces default empty value now may produce a non-empty value in the future.\n\n#### Param data types\n\n`STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nThis example shows an empty string \n\n strings.extract_domain(\"\") = \"\"\n\n##### Example 2\n\nrandom string, not a URL \n\n strings.extract_domain(\"1234\") = \"\"\n\n##### Example 3\n\nmultiple backslaches \n\n strings.extract_domain(\"\\\\\\\\\") = \"\"\n\n##### Example 4\n\nnon-alphabet characters handled gracefully \n\n strings.extract_domain(\"http://例子.卷筒纸.中国\") = \"卷筒纸.中国\"\n\n##### Example 5\n\nhandling URIs \n\n strings.extract_domain(\"mailto:?to=&subject=&body=\") = \"\"\n\n##### Example 6\n\nmultiple characters before actual URL \n\n strings.extract_domain(\" \\t !$5*^)&dahgsdfs;http://www.google.com\") = \"google.com\"\n\n##### Example 7\n\nspecial characters in URI `#` \n\n strings.extract_domain(\"test#@google.com\") = \"\"\n\n##### Example 8\n\nspecial characters in URL `#` \n\n strings.extract_domain(\"https://test#@google.com\") = \"\"\n\n##### Example 9\n\npositive test case \n\n strings.extract_domain(\"https://google.co.in\") = \"google.co.in\""]]
