Skip to content
COEUS
Install
Sources

URL placeholders

Every placeholder a URL template can carry, with a live renderer.

A source's url entry is a template. When you choose to open that source for an indicator, Coeus substitutes the value into the link. This page lists every placeholder, and renders all of them live against a value you type.

Try it

Try it

detected
URL
Every placeholder rendered for the typed entity
PlaceholderResult
{ioc}https%3A%2F%2Fa.b%2Fc%3Fd%3D1
{ioc:raw}https://a.b/c?d=1
{ioc:noscheme}a.b%2Fc%3Fd%3D1
{ioc:b64}aHR0cHM6Ly9hLmIvYz9kPTE
{ioc:urlscan}https%5C%3A%5C%2F%5C%2Fa.b%5C%2Fc%3Fd%3D1
{ioc:defanged}hxxps://a[.]b/c?d=1
{domain}a.b
{type}url
%sa.b/c?d=1
%rhttps://a.b/c?d=1
%urlscanhttps\:\/\/a.b\/c?d=1

Everything above is produced by the same render() the extension uses, against the same detect(). If a row looks wrong here, it is wrong in the extension too.

The placeholders

PlaceholderResult
{ioc}The value, URL-encoded. The default, and right nine times out of ten.
{ioc:raw}The value, untouched.
{ioc:noscheme}A leading http://, https://, hxxp:// or hxxps:// removed, then encoded.
{ioc:b64}base64url of the value with no padding — the VirusTotal URL id form.
{ioc:urlscan}: and / escaped for a urlscan search query, then encoded.
{ioc:defanged}The defanged form: hxxps://a[.]b/c.
{domain}The host of a URL or an email; a domain itself; otherwise empty.
{type}The type id that matched, e.g. ipv4.

Two rules cover everything else. An unknown {...} placeholder is left exactly as written, so a template that happens to contain braces is not mangled. A template with no placeholder at all is opened unchanged, which is how you add a plain bookmark to a pack.

Legacy forms

Templates written for Coeus 1.x keep working byte for byte:

PlaceholderResult
%sEvery http://, https://, hxxp:// and hxxps:// removed. Not encoded.
%rThe value. Not encoded.
%urlscan: → \: and / → \/. Not encoded.

Choosing between them

{ioc} for query strings. Anything after a ? should be encoded. This is the default for a reason.

{ioc:raw} for path segments where the tool routes on the literal value and encoding breaks it. Be careful: a value with a / in it will change the path shape.

{ioc:noscheme} when the tool wants a bare URL and does its own encoding — a common shape for sandbox and reputation sources.

{ioc:b64} for VirusTotal URL objects. VirusTotal identifies a URL by the base64url of the URL with padding stripped. https://www.virustotal.com/gui/url/{ioc:b64} is the built-in pack's own template.

{ioc:urlscan} for Elasticsearch query strings. urlscan's search treats : and / as syntax, so both need a backslash before the whole query is encoded.

{ioc:defanged} for internal systems that store bracketed values — some case trackers normalise entities on the way in and expect the defanged spelling on the way out.

{domain} when you have a URL but the tool takes a host. For a URL it is the host; for an email it is the part after the @; for a domain it is the domain; for anything else it is empty, which is usually a sign that source should not have listed that type.

{type} for one endpoint that dispatches. A single internal search that takes ?q=…&type=… needs one entry per type in url, all pointing at the same template.

Where templates live

Each source maps entity types to templates:

{
  "id": "acme-case-search",
  "name": "ACME case search",
  "auth": true,
  "url": {
    "ip": "https://cases.example.com/search?q={ioc}&type={type}",
    "sha256": "https://cases.example.com/sample/{ioc}",
    "hash": "https://cases.example.com/search?q={ioc}&type={type}"
  }
}

A url key is either a type id or a group id, and the concrete type wins over the group — a SHA-256 goes to the sample page above, an MD5 falls through to the search. The full list of type and group ids, and the rest of the pack schema, is in the pack format.