Darkmon Feed

Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the XSOAR TIM module. Pair with the Darkmon integration for incident fetching and automation commands.

Data Enrichment & Threat Intelligence · Darkmon · Feed

Details

ID	`Darkmon Feed`
Provider	Darkmon
Category	Data Enrichment & Threat Intelligence
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Cloud Posture Security Cortex Cloud Cloud Runtime Security EDR Attack Surface Management Threat Intelligence Management Application Security XSIAM Exposure Management Agentix Email Security

README

Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the Cortex XSOAR Threat Intelligence Module (TIM). Pair with the Darkmon integration for incident fetching and automation commands.

Configure Darkmon Feed in Cortex

Parameter	Description	Required
API Base URL	Override the Darkmon TIP API base URL only if your tenant points at a non-default endpoint. The default value already targets the production Darkmon TIP service. Leave blank to use the default.	False
API key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed.	False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Tags	Supports CSV values.	False
Indicator fetch limit	Maximum number of indicators to fetch per cycle.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darkmon-get-indicators

Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.

Base Command

darkmon-get-indicators

Input

Argument Name	Description	Required
limit	Maximum number of indicators to return. Default is 20.	Optional

Context Output

There is no context output for this command.

Configuration parameters

base_url — API Base URL
X-API-KEY — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
tlp_color — Traffic Light Protocol Color
feedTags — Tags
limit — Indicator fetch limit

Commands (1)

darkmon-get-indicators
Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.

Source

DarkmonFeed.py DarkmonFeed_test.py DarkmonFeed.yml DarkmonFeed_description.md

Download History Raw

## Darkmon Feed

Darkmon TIP indicator feed integration for Cortex XSOAR.

This is the **feed half** of the Darkmon pack: it ingests indicators (IOCs)
from the Darkmon Threat Intelligence Platform into XSOAR's Threat Intel
Management module on a configurable interval.

For incident-side functionality (incident fetching, dynamic search,
reputation commands, monitoring playbooks), see the companion **Darkmon**
integration in the same pack.

### What this integration does

- Continuously fetches the Darkmon IOC firehose (IPs, URLs, domains, file
  hashes, emails, accounts) into the XSOAR Threat Intel Management module.
- Tags each indicator with its Darkmon classification, first-seen,
  last-seen, compromise sources, and stealer family where available.
- Routes each indicator to the correct indicator type via the
  `Darkmon - Feed Classifier` and populates fields via the
  `Darkmon - Feed Mapper`.
- Exposes a debug command (`darkmon-get-indicators`) for testing the feed
  pull without waiting for the next scheduled cycle.

### Configuration

Paste your Darkmon TIP API key. The default API base URL points at the
Darkmon TIP production endpoint; override only if your tenant uses a
non-default endpoint. Set the feed reputation, source reliability, and
expiration policy per your SOC's standards.