Best Practice: Adding hyperlinks to search output

When creating dashboards or saved searches, the ability to create hyperlinks using fields from the search results can be useful. To accomplish this, we can use the format() function.

Let's say we want to:

First we need to obtain the data and do some simple regex extractions:

#event_simpleName=PeFileWritten
| TargetFileName=/\\Downloads\\/
| TargetFileName=/(?<FilePath>.+\\)(?<FileName>.+$)/i

Now, we'll use the format() function to create hyperlinks and organize using groupBy():

#event_simpleName=PeFileWritten
| TargetFileName=/\\Downloads\\/
| TargetFileName=/(?<FilePath>.+\\)(?<FileName>.+$)/i
// Virus Total
| format("[Virus Total](https://www.virustotal.com/gui/file/%s)", field=[SHA256HashData], as="VT")
// Hybrid Analysis
| format("[Hybrid Analysis](https://www.hybrid-analysis.com/search?query=%s)", field=[SHA256HashData], as="HA")
| groupBy([aid, FileName], function=collect([FileName, FilePath, VT, HA]))

Now clicking the VirusTotal or Hybrid Analysis links will direct you to the appropriate website with the data included for SHA256.

This is known colloquially as dorking, meaning the URL format for VirusTotal and Hybrid Analysis is known- if we create a URL and include data from our search results, we can hard link to external information. For Hybrid Analysis the format of the URL is:

www.hybrid-analysis.com/search?query=SHA256VALUE

The section after the question mark is dynamic - but we have the SHA256 value or the relevant files in our query results. So using format(), we can dork this hyperlink:

| format("[Hybrid Analysis](https://www.hybrid-analysis.com/search?query=%s)", field=[SHA256HashData], as="HA")

The text between the braces (here it's [Hybrid Analysis]) is what the hyperlink will be titled. The text in the as statement will be the column title in the aggregate output. This link could be used any time there's a SHA256 value in LogScale.

You could also use an Agent ID value to make a one-click RTR link:

// RTR
| format("[RTR Link](https://falcon.crowdstrike.com/
activity/real-time-response/console?start=hosts&aid=%s=f)", field=[aid], as="RTR")

Clicking this link will initiate an RTR session for the aid associated with the event.

If you're using other third-party or internal tooling/resources, be sure to check if the associated URLs are standardized and 'workable'.