Darkmon Feed

Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the XSOAR TIM module. Pair with the Darkmon integration for incident fetching and automation commands.

Data Enrichment & Threat Intelligence · Darkmon · Feed

Details

ID	`Darkmon Feed`
Provider	Darkmon
Category	Data Enrichment & Threat Intelligence
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Cloud Posture Security Cortex Cloud Cloud Runtime Security EDR Attack Surface Management Threat Intelligence Management Application Security XSIAM Exposure Management Agentix Email Security

README

Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the Cortex XSOAR Threat Intelligence Module (TIM). Pair with the Darkmon integration for incident fetching and automation commands.

Configure Darkmon Feed in Cortex

Parameter	Description	Required
API Base URL	Override the Darkmon TIP API base URL only if your tenant points at a non-default endpoint. The default value already targets the production Darkmon TIP service. Leave blank to use the default.	False
API key		True
Trust any certificate (not secure)		False
Use system proxy settings		False
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed.	False
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Tags	Supports CSV values.	False
Indicator fetch limit	Maximum number of indicators to fetch per cycle.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

darkmon-get-indicators

Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.

Base Command

darkmon-get-indicators

Input

Argument Name	Description	Required
limit	Maximum number of indicators to return. Default is 20.	Optional

Context Output

There is no context output for this command.

Configuration parameters

base_url — API Base URL
X-API-KEY — (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
tlp_color — Traffic Light Protocol Color
feedTags — Tags
limit — Indicator fetch limit

Commands (1)

darkmon-get-indicators
Fetch a page of Darkmon indicators on demand without waiting for the next scheduled feed cycle. Useful for debugging.

Source

DarkmonFeed.py DarkmonFeed_test.py DarkmonFeed.yml DarkmonFeed_description.md

Download History Raw

"""Tests for the Darkmon Feed integration (feed half of the Darkmon pack)."""

import importlib
import sys
from pathlib import Path


THIS_DIR = Path(__file__).resolve().parent
if str(THIS_DIR) not in sys.path:
    sys.path.insert(0, str(THIS_DIR))

src = importlib.import_module("DarkmonFeed")


def _client() -> "src.Client":
    return src.Client(
        base_url="https://example.test/tip/x",
        headers={"X-API-KEY": "k"},
        verify=False,
        proxy=False,
    )


# ---- Client construction ----


def test_client_constructs():
    c = _client()
    assert c is not None


# ---- Indicator field mapping ----


def test_apply_indicator_fields_full():
    obj = {"fields": {}}
    item = {
        "classification": "malware",
        "compromise_sources": ["redline", "lumma"],
        "first_compromise": "2026-01-01T00:00:00Z",
        "last_compromise": "2026-06-01T00:00:00Z",
        "stealers": ["redline"],
    }
    src._apply_indicator_fields(item, "Email", obj)
    f = obj["fields"]
    assert f["darkmonclassification"] == "malware"
    assert f["darkmoncompromisesources"] == ["redline", "lumma"]
    assert f["darkmonfirstcompromise"] == "2026-01-01T00:00:00Z"
    assert f["darkmonlastcompromise"] == "2026-06-01T00:00:00Z"
    assert f["darkmonstealers"] == ["redline"]


def test_apply_indicator_fields_partial():
    obj = {"fields": {}}
    src._apply_indicator_fields({"classification": "phishing"}, "URL", obj)
    assert obj["fields"] == {"darkmonclassification": "phishing"}


# ---- fetch_indicators_command ----


def test_fetch_indicators_command_maps_types(monkeypatch):
    c = _client()
    monkeypatch.setattr(
        c,
        "get_indicators",
        lambda size=20: {
            "iocObjects": [
                {"type": "IP", "value": "8.8.8.8", "classification": "scanner"},
                {"type": "Domain", "value": "evil.test", "classification": "phishing"},
                {
                    "type": "URL",
                    "value": "https://evil.test",
                    "classification": "phishing",
                },
            ]
        },
    )
    indicators = src.fetch_indicators_command(c, {"limit": 3, "feedTags": "darkmon"})
    assert len(indicators) == 3
    assert {i["type"] for i in indicators} == {
        src.FeedIndicatorType.IP,
        src.FeedIndicatorType.Domain,
        src.FeedIndicatorType.URL,
    }
    assert all(i["service"] == "Darkmon" for i in indicators)
    assert all("darkmon" in i["fields"].get("tags", []) for i in indicators)


def test_fetch_indicators_command_skips_empty(monkeypatch):
    c = _client()
    monkeypatch.setattr(
        c,
        "get_indicators",
        lambda size=20: {
            "iocObjects": [
                {"type": "IP", "value": ""},  # skipped
                {"type": "IP", "value": "1.1.1.1"},
            ]
        },
    )
    indicators = src.fetch_indicators_command(c, {"limit": 2})
    assert len(indicators) == 1
    assert indicators[0]["value"] == "1.1.1.1"


def test_fetch_indicators_command_tlp(monkeypatch):
    c = _client()
    monkeypatch.setattr(
        c,
        "get_indicators",
        lambda size=20: {"iocObjects": [{"type": "IP", "value": "1.1.1.1"}]},
    )
    indicators = src.fetch_indicators_command(c, {"limit": 1, "tlp_color": "AMBER"})
    assert indicators[0]["fields"]["trafficlightprotocol"] == "AMBER"


# ---- darkmon-get-indicators ----


def test_darkmon_get_indicators_command(monkeypatch):
    c = _client()
    monkeypatch.setattr(
        c,
        "get_indicators",
        lambda size=20: {"iocObjects": [{"type": "IP", "value": "1.1.1.1", "classification": "scanner"}]},
    )
    result = src.darkmon_get_indicators_command(c, {"limit": "1"})
    assert result.outputs_prefix == "Darkmon.Indicator"
    assert result.outputs_key_field == "value"
    assert result.outputs[0]["value"] == "1.1.1.1"