[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-29 (世界標準時間)。"],[[["\u003cp\u003eThe \u003ccode\u003estrings.extract_domain\u003c/code\u003e function extracts the domain from a given string, which is commonly a URL.\u003c/p\u003e\n"],["\u003cp\u003eThis function does not perform Unicode normalization and treats private domains as part of the public suffix, based on data from publicsuffix.org.\u003c/p\u003e\n"],["\u003cp\u003eThe function returns an empty string if the input is an empty string, a random string, contains multiple backslashes, is a URI without a domain, or contains certain special characters.\u003c/p\u003e\n"],["\u003cp\u003eThe function can handle non-alphabet characters and multiple characters before the actual URL, returning the appropriate domain.\u003c/p\u003e\n"],["\u003cp\u003eThe output of the function may change over time due to updates in the public suffix data.\u003c/p\u003e\n"]]],[],null,["### strings.extract_domain\n\nSupported in: \n[Rules](/chronicle/docs/detection/default-rules) [Search](/chronicle/docs/investigation/udm-search) \n\n strings.extract_domain(url_string)\n\n#### Description\n\nExtracts the domain from a string.\n| **Note:** The function does not perform Unicode normalization.\n| **Note:** The public suffix data at publicsuffix.org also contains private domains. This function does not treat a private domain as a public suffix. For example, if us.com is a private domain in the public suffix data, (\"foo.us.com\") returns us.com (the public suffix com plus the preceding label us) rather than foo.us.com (the private domain us.com plus the preceding label foo).\n| **Note:** The public suffix data might change over time. Consequently, input that produces default empty value now may produce a non-empty value in the future.\n\n#### Param data types\n\n`STRING`\n\n#### Return type\n\n`STRING`\n\n#### Code samples\n\n##### Example 1\n\nThis example shows an empty string \n\n strings.extract_domain(\"\") = \"\"\n\n##### Example 2\n\nrandom string, not a URL \n\n strings.extract_domain(\"1234\") = \"\"\n\n##### Example 3\n\nmultiple backslaches \n\n strings.extract_domain(\"\\\\\\\\\") = \"\"\n\n##### Example 4\n\nnon-alphabet characters handled gracefully \n\n strings.extract_domain(\"http://例子.卷筒纸.中国\") = \"卷筒纸.中国\"\n\n##### Example 5\n\nhandling URIs \n\n strings.extract_domain(\"mailto:?to=&subject=&body=\") = \"\"\n\n##### Example 6\n\nmultiple characters before actual URL \n\n strings.extract_domain(\" \\t !$5*^)&dahgsdfs;http://www.google.com\") = \"google.com\"\n\n##### Example 7\n\nspecial characters in URI `#` \n\n strings.extract_domain(\"test#@google.com\") = \"\"\n\n##### Example 8\n\nspecial characters in URL `#` \n\n strings.extract_domain(\"https://test#@google.com\") = \"\"\n\n##### Example 9\n\npositive test case \n\n strings.extract_domain(\"https://google.co.in\") = \"google.co.in\""]]
