Following on from @PhoneBoy , you can use the API, but you'll need to be a little more creative with it. If you have custom application sites, then you likely have them in a custom application group. If not, put them in one.
(nb: i have a bash shell function named 'mcli' to be the curl syntax and things to handle all the HTTPS communication to the mgmt API server; it's not meant to be human-interactive; it just takes a JSON input and sends it via HTTP POST.)
First fetch your custom application site by name: (here i have one named "Test_Site_Group")
echo '{ "name" : "Test_Site_Group" }' |mcli show-application-site-group
{
"uid" : "9d36b14c-b7c9-4282-a5a4-19d83778c8f3",
"name" : "Test_Site_Group",
"type" : "application-site-group",
"domain" : {
"uid" : "41e821a0-3720-11e3-aa6e-0800200c9fde",
"name" : "SMC User",
"domain-type" : "domain"
},
"members" : [ {
"uid" : "3d765aa4-2b3e-4d9e-a26b-26c20379da78",
"name" : "Malicious_Sites",
"type" : "application-site",
"domain" : {
"uid" : "41e821a0-3720-11e3-aa6e-0800200c9fde",
"name" : "SMC User",
"domain-type" : "domain"
},
"icon" : "Objects/application",
"color" : "black"
} ],
....
}
The ".members[]" key is a list of your custom sites. This is where PhoneBoy said to iterate over that:
$ echo '{ "name" : "Test_Site_Group" }' |mcli show-application-site-group |jq -r '.members[].name' |while read app_site;
do
echo $app_site
done
Malicious_Sites
...
The output is the list of custom application sites you would have. Here, my customer happened to have one like yours, with a list of URLs. I just stole theirs for this demo. Thus, you'll then call your API again for each of the custom application sites in that site group. Then search the "url-list" key with a JQ filter:
$ echo '{ "name" : "Test_Site_Group" }' |\
mcli show-application-site-group |\
jq -r '.members[].name' |\
while read app_site; do
echo '{ "name" : "'${app_site}'" }' |\
mcli show-application-site |\
jq -r --arg url_search "chromeupdates.online" 'select(."url-list"[]|contains($url_search)).name';
done
Malicious_Sites
Again, the output is the name of the custom site that had an URL in the list that you wanted to find. In this case, I passed a static string to JQ as an argument. "chromeupdates.online" is the value of the variable in JQ as $url_search. You can replace that string with whatever you want and however you want.
Ansible can do this, too, but with a little more work with JMESQuery.
If you intend to run this same thing locally on the mgmt server with mgmt_cli, you can, but just replace my forceful JSON with parameters to mgmt_cli. Oh, and be sure to do "export MGMT_CLI_FORMAT=json" before you run mgmt_cli.
