RaDark

This integration enables you to fetch incidents and manage your RaDark monitor from Cortex XSOAR.
This integration was integrated and tested with version 2 of RaDark

Configure RaDark in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

radark-incident-get-items

Fetch all items for an incident by the given incident ID.

Base Command

radark-incident-get-items

Input

Context Output

Command Example

!radark-incident-get-items incident_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Context Example

{
    "Radark": {
        "itemDetails": {
            "items": [
                {
                    "item_id": "<ITEM_ID>",
                    "email": "testa@test.com",
                    "domain": "test.com",
                    "password": "-",
                    "password_type": "-", 
                    "service": "-"
                }
            ],
          "details": "Incident contains 44 items. Full details can be found on \"items\" tab."
        }
    }
}

*Items are flexible (base on incident type).

Human Readable Output

No data found for item ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

radark-email-enrich

Search a specific email address to get all exposed leaked credentials collected by RaDark.

Base Command

radark-email-enrich

Input

Context Output

Command Example

!radark-email-enrich email=testa@test.com

Context Example

{
    "Radark": {
        "emailDetails": {
            "emails": [
                {
                    "date": "2017-01-12T19:43:00Z",
                    "domain": "test.com",
                    "email": "testa@test.com",
                    "password": "-",
                    "password_type": "-",
                    "service": "-",
                    "source": "ss"
                }
            ]
        }
    }
}

Human Readable Output

Email	Domain	Password Type	Password	Service	Source	Date
testa@test.com	test.com	-	-	-	ss	2017-01-12T19:43:00Z

radark-item-handle

Mark item as handled on RaDark.

Base Command

radark-item-handle

Input

Context Output

There is no context output for this command.

Command Example

``````

Human Readable Output

Item ID (xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx) marked as handled

radark-item-purchase

Request to purchase an item offered for sale on an automated store.

Base Command

radark-item-purchase

Input

Context Output

There is no context output for this command.

Command Example

!radark-item-purchase item_id=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Human Readable Output

Bot ID () marked for purchasing