Darkmon - Phishing Email Triage

Extracts URLs/IPs/file-hashes from a reported phishing email, enriches each via the Darkmon - Enrich * sub-playbooks, and if any indicator is scored Bad (DBotScore=3) calls Generic Block Indicator on it. Notifies the reporter and the SOC at the end.

Pack

Darkmon

Tasks

10

Inputs

• AutoBlock — When true, indicators scored Bad by Darkmon are sent to Darkmon - Generic Block Indicator without an analyst approval task. Defaults to false (a manual approval is presented before any block).

Outputs

• ExtractedIndicators — IOCs extracted from the phishing email body.
• DBotScore — Reputation scores from Darkmon enrichment per IOC.