Adding to distinct counts for better accounting

signals/links/link_appspot_in_url_path_distinct.yml

@@ -1,4 +1,4 @@
-'name': "Link: Appspot in URL Path Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, strings.ilike(.href_url.path, "*appspot.com*")))
+name: "Link: Appspot in URL Path Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, strings.ilike(.href_url.path, "*appspot.com*")), .href_url.url))

signals/links/link_free_file_host_distinct.yml

@@ -1,4 +1,4 @@
-'name': "Link: Free File Host Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, .href_url.domain.domain in $free_file_hosts))
+name: "Link: Free File Host Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, .href_url.domain.domain in $free_file_hosts), .href_url.url))

signals/links/link_free_subdomain_host_distinct.yml

@@ -1,8 +1,8 @@
-'name': "Link: Free Subdomain Host Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links,
+name: "Link: Free Subdomain Host Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links,
       .href_url.domain.root_domain in $free_subdomain_hosts
       and .href_url.domain.subdomain is not null
       and .href_url.domain.subdomain != "www"
-  ))
+  ), .href_url.url))

signals/links/link_freenom_tld_distinct.yml

@@ -1,4 +1,7 @@
-'name': "Link: Freenom TLD Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, .href_url.domain.tld in ("tk", "ml", "ga", "cf", "gq")))
+name: "Link: Freenom TLD Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, .href_url.domain.tld in ("tk", "ml", "ga", "cf", "gq")),
+                .href_url.url
+       )
+  )

signals/links/link_google_open_redirect_distinct.yml

@@ -1,5 +1,4 @@
-'name': "Link: Google Open Redirect Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links,
-    regex.icontains(.href_url.url, "https?://(www.)?google.[a-zA-Z]{2,}/url\\?q=https?://.+")))
+name: "Link: Google Open Redirect Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, regex.icontains(.href_url.url, "https?://(www.)?google.[a-zA-Z]{2,}/url\\?q=https?://.+")), .href_url.url))

signals/links/link_low_reputation_distinct.yml

@@ -1,4 +1,4 @@
-'name': "Link: Low Reputation Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, .href_url.domain.root_domain not in $tranco_1m))
+name: "Link: Low Reputation Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, .href_url.domain.root_domain not in $tranco_1m), .href_url.url))

signals/links/link_mimatched_distinct.yml

@@ -1,4 +1,4 @@
-'name': "Link: Mismatch Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, .mismatched))
+name: "Link: Mismatch Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, .mismatched), .href_url.url))

signals/links/link_suspicious_tld_distinct.yml

@@ -1,4 +1,4 @@
-'name': "Link: Suspicious TLD Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, .href_url.domain.tld in $suspicious_tlds))
+name: "Link: Suspicious TLD Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, .href_url.domain.tld in $suspicious_tlds), .href_url.url))

signals/links/link_url_shortener_distinct.yml

@@ -1,4 +1,4 @@
-'name': "Link: URL Shortener Unique Count"
-'type': "query"
-'source': |
-  length(distinct(body.links, .href_url.domain.root_domain in $url_shorteners))
+name: "Link: URL Shortener Unique Count"
+type: "query"
+source: |
+  length(distinct(filter(body.links, .href_url.domain.root_domain in $url_shorteners), .href_url.url))