RaDark

Details

ID	`RaDark`
Provider	KELA
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

This integration enables you to fetch incidents and manage your RaDark monitor from Cortex XSOAR.
This integration was integrated and tested with version 2 of RaDark

Configure RaDark in Cortex

Parameter	Description	Required
API Key	API Key generated from RaDark by your user.	True
First time fetching	Start fetching incidents from the specified time.	False
Trust any certificate (not secure)		False
Use system proxy settings		False
Monitor ID	Set your monitor ID in RaDark.	True
Fetch incidents		False
Incidents Fetch Interval		False
Incident type		False
Max incidents to fetch each fetching	Maximum supported: 1000	False
Incident types to fetch	Set which incident types to fetch from RaDark.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

radark-incident-get-items

Fetch all items for an incident by the given incident ID.

Base Command

radark-incident-get-items

Input

Argument Name	Description	Required
incident_id	The unique ID of an incident that requires enrichment.	Required

Context Output

Path	Type	Description
Radark.itemDetails.items.item_id	string	The ID of the item on RaDark.
Radark.itemDetails.items.email	string	The email of the item.
Radark.itemDetails.items.domain	string	The domain of the item.
Radark.itemDetails.items.password	string	The password of the item.
Radark.itemDetails.items.password_type	string	The password type of the item.
Radark.itemDetails.items.source	string	The source of the item.
Radark.itemDetails.items.service	string	The service of the item.
Radark.itemDetails.items.dump_post_date	string	The dump post date of the item.
Radark.itemDetails.items.compromised_website	string	The compromised website of the item.
Radark.itemDetails.items.bot_id	string	The bot ID of the item.
Radark.itemDetails.items.resource	string	The resource of the item.
Radark.itemDetails.items.country	string	The country of the item.
Radark.itemDetails.items.source_ip	string	The source IP of the item.
Radark.itemDetails.items.infection_type	string	The infection type of the item.
Radark.itemDetails.items.updated_date	string	The updated date of the item.
Radark.itemDetails.items.username	string	The username of the item.
Radark.itemDetails.items.additional_data	string	The additional data of the item.
Radark.itemDetails.items.price	string	The price of the item.
Radark.itemDetails.items.isp	string	The ISP of the item.
Radark.itemDetails.items.ip	string	The IP of the item.
Radark.itemDetails.items.hostname	string	The hostname of the item.
Radark.itemDetails.items.port	string	The port of the item.
Radark.itemDetails.items.technology	string	The technology of the item.
Radark.itemDetails.items.cve_details	string	The CVE details of the item.
Radark.itemDetails.items.details	string	The details of the item.
Radark.itemDetails.items.type	string	The type of the item.
Radark.itemDetails.items.description	string	The description of the item.
Radark.itemDetails.items.date	string	The date of the item.
Radark.itemDetails.items.bin	string	The bin of the item.
Radark.itemDetails.items.number	string	The number of the item.
Radark.itemDetails.items.tags	string	The tags of the item.
Radark.itemDetails.items.link	string	The link of the item.
Radark.itemDetails.items.context	string	The context of the item.
Radark.itemDetails.details	string	General details of the incident.

Command Example

!radark-incident-get-items incident_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Context Example

{
    "Radark": {
        "itemDetails": {
            "items": [
                {
                    "item_id": "<ITEM_ID>",
                    "email": "testa@test.com",
                    "domain": "test.com",
                    "password": "-",
                    "password_type": "-", 
                    "service": "-"
                }
            ],
          "details": "Incident contains 44 items. Full details can be found on \"items\" tab."
        }
    }
}

*Items are flexible (base on incident type).

Human Readable Output

No data found for item ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

radark-email-enrich

Search a specific email address to get all exposed leaked credentials collected by RaDark.

Base Command

radark-email-enrich

Input

Argument Name	Description	Required
email	The email address tested for leaked credentials.	Required

Context Output

Path	Type	Description
Radark.emailDetails.emails.email	string	The email to enrich from RaDark.
Radark.emailDetails.emails.domain	string	The domain of the email.
Radark.emailDetails.emails.password_type	string	The password type of the email.
Radark.emailDetails.emails.password	string	The password of the email.
Radark.emailDetails.emails.service	string	The service of the email.
Radark.emailDetails.emails.source	string	The source of the email.
Radark.emailDetails.emails.source	string	The posted date of the email.

Command Example

!radark-email-enrich email=testa@test.com

Context Example

{
    "Radark": {
        "emailDetails": {
            "emails": [
                {
                    "date": "2017-01-12T19:43:00Z",
                    "domain": "test.com",
                    "email": "testa@test.com",
                    "password": "-",
                    "password_type": "-",
                    "service": "-",
                    "source": "ss"
                }
            ]
        }
    }
}

Human Readable Output

Email Domain Password Type Password Service Source Date

testa@test.com test.com - - - ss 2017-01-12T19:43:00Z

Email	Domain	Password Type	Password	Service	Source	Date
testa@test.com	test.com	-	-	-	ss	2017-01-12T19:43:00Z

radark-item-handle

Mark item as handled on RaDark.

Base Command

radark-item-handle

Input

Argument Name	Description	Required
item_id	The unique ID of an item that should be marked as handled on RaDark.	Required

Context Output

There is no context output for this command.

Command Example

``````

Human Readable Output

Item ID (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx) marked as handled

radark-item-purchase

Request to purchase an item offered for sale on an automated store.

Base Command

radark-item-purchase

Input

Argument Name	Description	Required
item_id	The unique ID of an item that should requires purchase.	Required

Context Output

There is no context output for this command.

Command Example

!radark-item-purchase item_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Human Readable Output

Bot ID () marked for purchasing

Configuration parameters

api_key — API Key (required)
first_fetch — First time fetching
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
monitor_id — Monitor ID (required)
isFetch — Fetch incidents
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
max_fetch — Max incidents to fetch each fetching
incident_types — Incident types to fetch (required)

Commands (4)

radark-email-enrich
Search a specific email address to get all exposed leaked credentials collected by RaDark.
radark-incident-get-items
Fetch all items for an incident by the given incident ID.
radark-item-handle
Mark item as handled on RaDark.
radark-item-purchase
Request to purchase an item offered for sale on an automated store.

Source

RaDark.py RaDark_test.py RaDark.yml RaDark_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: KELA
commonfields:
  id: RaDark
  version: -1
configuration:
- additionalinfo: API Key generated from RaDark by your user.
  display: API Key
  name: api_key
  required: true
  type: 4
- additionalinfo: Start fetching incidents from the specified time.
  defaultvalue: 45 days
  display: First time fetching
  name: first_fetch
  type: 0
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- additionalinfo: Set your monitor ID in RaDark.
  display: Monitor ID
  name: monitor_id
  required: true
  type: 0
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
- display: Incident type
  name: incidentType
  type: 13
  required: false
- additionalinfo: 'Maximum supported: 1000'
  defaultvalue: "10"
  display: Max incidents to fetch each fetching
  name: max_fetch
  type: 0
  required: false
- additionalinfo: Set which incident types to fetch from RaDark.
  defaultvalue: Leaked Credentials,Compromised Accounts,Intelligence Reports,Network Vulnerabilities,Credit Cards,Hacking Discussions
  display: Incident types to fetch
  name: incident_types
  options:
  - Leaked Credentials
  - Compromised Accounts
  - Intelligence Reports
  - Network Vulnerabilities
  - Credit Cards
  - Hacking Discussions
  required: true
  type: 16
description: This integration enables you to fetch incidents and manage your RaDark monitor from Cortex XSOAR.
display: RaDark
name: RaDark
script:
  commands:
  - arguments:
    - description: The unique ID of an incident that requires enrichment.
      name: incident_id
      required: true
    description: Fetch all items for an incident by the given incident ID.
    name: radark-incident-get-items
    outputs:
    - contextPath: Radark.itemDetails.items.item_id
      description: The ID of the item on RaDark.
      type: string
    - contextPath: Radark.itemDetails.items.email
      description: The email of the item.
      type: string
    - contextPath: Radark.itemDetails.items.domain
      description: The domain of the item.
      type: string
    - contextPath: Radark.itemDetails.items.password
      description: The password of the item.
      type: string
    - contextPath: Radark.itemDetails.items.password_type
      description: The password type of the item.
      type: string
    - contextPath: Radark.itemDetails.items.source
      description: The source of the item.
      type: string
    - contextPath: Radark.itemDetails.items.service
      description: The service of the item.
      type: string
    - contextPath: Radark.itemDetails.items.dump_post_date
      description: The dump post date of the item.
      type: string
    - contextPath: Radark.itemDetails.items.compromised_website
      description: The compromised website of the item.
      type: string
    - contextPath: Radark.itemDetails.items.bot_id
      description: The bot ID of the item.
      type: string
    - contextPath: Radark.itemDetails.items.resource
      description: The resource of the item.
      type: string
    - contextPath: Radark.itemDetails.items.country
      description: The country of the item.
      type: string
    - contextPath: Radark.itemDetails.items.source_ip
      description: The source IP of the item.
      type: string
    - contextPath: Radark.itemDetails.items.infection_type
      description: The infection type of the item.
      type: string
    - contextPath: Radark.itemDetails.items.updated_date
      description: The updated date of the item.
      type: string
    - contextPath: Radark.itemDetails.items.username
      description: The username of the item.
      type: string
    - contextPath: Radark.itemDetails.items.additional_data
      description: The additional data of the item.
      type: string
    - contextPath: Radark.itemDetails.items.price
      description: The price of the item.
      type: string
    - contextPath: Radark.itemDetails.items.isp
      description: The ISP of the item.
      type: string
    - contextPath: Radark.itemDetails.items.ip
      description: The IP of the item.
      type: string
    - contextPath: Radark.itemDetails.items.hostname
      description: The hostname of the item.
      type: string
    - contextPath: Radark.itemDetails.items.port
      description: The port of the item.
      type: string
    - contextPath: Radark.itemDetails.items.technology
      description: The technology of the item.
      type: string
    - contextPath: Radark.itemDetails.items.cve_details
      description: The CVE details of the item.
      type: string
    - contextPath: Radark.itemDetails.items.details
      description: The details of the item.
      type: string
    - contextPath: Radark.itemDetails.items.type
      description: The type of the item.
      type: string
    - contextPath: Radark.itemDetails.items.description
      description: The description of the item.
      type: string
    - contextPath: Radark.itemDetails.items.date
      description: The date of the item.
      type: string
    - contextPath: Radark.itemDetails.items.bin
      description: The bin of the item.
      type: string
    - contextPath: Radark.itemDetails.items.number
      description: The number of the item.
      type: string
    - contextPath: Radark.itemDetails.items.tags
      description: The tags of the item.
      type: string
    - contextPath: Radark.itemDetails.items.link
      description: The link of the item.
      type: string
    - contextPath: Radark.itemDetails.items.context
      description: The context of the item.
      type: string
    - contextPath: Radark.itemDetails.details
      description: General details of the incident.
      type: string
  - arguments:
    - description: The email address tested for leaked credentials.
      name: email
      required: true
    description: Search a specific email address to get all exposed leaked credentials collected by RaDark.
    name: radark-email-enrich
    outputs:
    - contextPath: Radark.emailDetails.emails.email
      description: The email to enrich from RaDark.
      type: string
    - contextPath: Radark.emailDetails.emails.domain
      description: The domain of the email.
      type: string
    - contextPath: Radark.emailDetails.emails.password_type
      description: The password type of the email.
      type: string
    - contextPath: Radark.emailDetails.emails.password
      description: The password of the email.
      type: string
    - contextPath: Radark.emailDetails.emails.service
      description: The service of the email.
      type: string
    - contextPath: Radark.emailDetails.emails.source
      description: The source of the email.
      type: string
    - contextPath: Radark.emailDetails.emails.source
      description: The posted date of the email.
      type: string
  - arguments:
    - description: The unique ID of an item that should be marked as handled on RaDark.
      name: item_id
      required: true
    description: Mark item as handled on RaDark.
    name: radark-item-handle
  - arguments:
    - description: The unique ID of an item that should requires purchase.
      name: item_id
      required: true
    description: Request to purchase an item offered for sale on an automated store.
    name: radark-item-purchase
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  script: ''
  subtype: python3
  type: python
fromversion: 6.0.0
tests:
- No tests (auto formatted)