Darkmon Feed

Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the XSOAR TIM module. Pair with the Darkmon integration for incident fetching and automation commands.

Data Enrichment & Threat Intelligence · Darkmon · Feed

Details

ID	`Darkmon Feed`
Provider	Darkmon
Category	Data Enrichment & Threat Intelligence
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Cloud Posture Security Cortex Cloud Cloud Runtime Security EDR Attack Surface Management Threat Intelligence Management Application Security XSIAM Exposure Management Agentix Email Security

README

Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the Cortex XSOAR Threat Intelligence Module (TIM). Pair with the Darkmon integration for incident fetching and automation commands.

Configure Darkmon Feed in Cortex

Parameter	Description	Required
API Base URL	Override the Darkmon TIP API base URL only if your tenant points at a non-default endpoint. The default value already targets the production Darkmon TIP service. Leave blank to use the default.	False
API key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed.	False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Tags	Supports CSV values.	False
Indicator fetch limit	Maximum number of indicators to fetch per cycle.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darkmon-get-indicators

Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.

Base Command

darkmon-get-indicators

Input

Argument Name	Description	Required
limit	Maximum number of indicators to return. Default is 20.	Optional

Context Output

There is no context output for this command.

Configuration parameters

base_url — API Base URL
X-API-KEY — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
tlp_color — Traffic Light Protocol Color
feedTags — Tags
limit — Indicator fetch limit

Commands (1)

darkmon-get-indicators
Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.

Source

DarkmonFeed.py DarkmonFeed_test.py DarkmonFeed.yml DarkmonFeed_description.md

Download History Raw

commonfields:
  id: Darkmon Feed
  version: -1
name: Darkmon Feed
display: Darkmon Feed
category: Data Enrichment & Threat Intelligence
provider: Darkmon
sectionorder:
- Connect
- Collect
description: |-
  Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes,
  emails, and accounts from the Darkmon Threat Intel firehose into the XSOAR TIM
  module. Pair with the Darkmon integration for incident fetching and automation
  commands.
configuration:
- display: API Base URL
  name: base_url
  defaultvalue: https://api.darkmon.com/tip/2025.1
  type: 0
  required: false
  additionalinfo: Override the Darkmon TIP API base URL only if your tenant points at a non-default endpoint. The default value already targets the production Darkmon TIP service. Leave blank to use the default.
  section: Connect
- display: ""
  displaypassword: API key
  name: X-API-KEY
  type: 9
  required: true
  hiddenusername: true
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch indicators
  name: feed
  defaultvalue: 'true'
  type: 8
  required: false
  section: Collect
- display: Indicator Reputation
  name: feedReputation
  defaultvalue: feedInstanceReputationNotSet
  type: 18
  required: false
  options:
  - None
  - Good
  - Suspicious
  - Bad
  additionalinfo: Indicators from this integration instance will be marked with this reputation.
  section: Collect
- display: Source Reliability
  name: feedReliability
  defaultvalue: F - Reliability cannot be judged
  type: 15
  required: true
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  additionalinfo: Reliability of the source providing the intelligence data.
  section: Collect
- display: ''
  name: feedExpirationPolicy
  defaultvalue: indicatorType
  type: 17
  required: false
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
- display: ''
  name: feedExpirationInterval
  defaultvalue: '20160'
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: '240'
  type: 19
  required: false
  section: Collect
- display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  section: Collect
- display: Traffic Light Protocol Color
  name: tlp_color
  type: 15
  required: false
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  section: Collect
- display: Tags
  name: feedTags
  type: 0
  required: false
  additionalinfo: Supports CSV values.
  section: Collect
- display: Indicator fetch limit
  name: limit
  defaultvalue: '1000'
  type: 0
  required: false
  additionalinfo: Maximum number of indicators to fetch per cycle.
  section: Collect
script:
  script: ''
  type: python
  subtype: python3
  feed: true
  runonce: false
  dockerimage: demisto/python3:3.12.13.10116658
  commands:
  - name: darkmon-get-indicators
    description: Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.
    arguments:
    - name: limit
      description: Maximum number of indicators to return.
      defaultValue: "20"
defaultclassifier: Darkmon - Feed Classifier
defaultmapperin: Darkmon - Feed Mapper
tests:
- No tests
fromversion: 6.8.0
marketplaces:
- xsoar
- marketplacev2
- platform
supportedModules:
- xsiam
- agentix