From 541a424693f30062be37ee9784ba5e7134a9e777 Mon Sep 17 00:00:00 2001
From: Elia Camposilvan <25326494+EliaECoyote@users.noreply.github.com>
Date: Tue, 8 Sep 2026 14:34:11 +0200
Subject: [PATCH] Document http.url_details.host BYOTI source

---
 .../security/cloud_siem/ingest_and_enrich/threat_intelligence.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hugo/content/en/security/cloud_siem/ingest_and_enrich/threat_intelligence.md b/hugo/content/en/security/cloud_siem/ingest_and_enrich/threat_intelligence.md
index 8abeaef695b..f282eec107e 100644
--- a/hugo/content/en/security/cloud_siem/ingest_and_enrich/threat_intelligence.md
+++ b/hugo/content/en/security/cloud_siem/ingest_and_enrich/threat_intelligence.md
@@ -38,6 +38,7 @@ When Cloud SIEM processes a log, the log's IP, domain, hash, AWS account ID, con
       - `DNS_ANSWER_NAME`
       - `HTTP_URL`
       - `HTTP_URL_DETAILS_DOMAIN`
+      - `HTTP_URL_DETAILS_HOST`
       - `HOSTNAME`
     - **File hashes**: SHA1, SHA256, and ssdeep hashes found in file- and process-related log attributes.
     - **AWS account IDs**: Values from AWS-related log attributes (for example, `userIdentity.accountId`).