Darkmon - Block IOC

Analyst-facing wrapper around Darkmon - Generic Block Indicator. Lets analysts paste an IOC into a War Room form and trigger a provider-routed block action.

Darkmon · 4 tasks · 3 inputs · 0 outputs

Details

ID	`Darkmon - Block IOC`
From Version	6.8.0
Tasks	4
Tags	darkmon analyst-tool block

README

Analyst-facing wrapper around Darkmon - Generic Block Indicator. Lets analysts paste an IOC into a War Room form and trigger a provider-routed block action.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Dispatch block via provider switchboard
Notify SOC of manual block

Integrations

This playbook does not use any integrations.

Scripts

This playbook does not use any scripts.

Commands

This playbook does not use any commands.

Playbook Inputs

Name	Description	Default Value	Required
Indicator	The indicator value to block.		Required
Type	ip \| domain \| url.	ip	Optional
Reason	Reason annotated on the block rule.	Manual analyst-triggered block	Optional

Playbook Outputs

There are no outputs for this playbook.

Inputs

Indicator — The indicator value to block.
Type — ip | domain | url.
Reason — Reason annotated on the block rule.

Flowchart

Source

playbook-Darkmon_Block_IOC.yml

Download History Raw

id: Darkmon - Block IOC
version: -1
name: Darkmon - Block IOC
description: Analyst-facing wrapper around Darkmon - Generic Block Indicator. Lets analysts paste an IOC into a War Room form and trigger a provider-routed block action.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- analyst-tool
- block
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: ac1083d2-ade5-4406-8f04-7806222a7dbb
    type: start
    task:
      id: ac1083d2-ade5-4406-8f04-7806222a7dbb
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: 1e06646f-3909-4565-9a28-955eb5973a03
    type: playbook
    task:
      id: 1e06646f-3909-4565-9a28-955eb5973a03
      version: -1
      name: Dispatch block via provider switchboard
      description: ''
      playbookName: Darkmon - Generic Block Indicator
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Indicator:
        simple: ${inputs.Indicator}
      Type:
        simple: ${inputs.Type}
      Reason:
        simple: ${inputs.Reason}
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: 4488d703-b16e-439c-acc9-3c1e0cd1234d
    type: playbook
    task:
      id: 4488d703-b16e-439c-acc9-3c1e0cd1234d
      version: -1
      name: Notify SOC of manual block
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: 'Manual block applied: ${inputs.Indicator}'
      Body:
        simple: 'Analyst ${currentUser} blocked ${inputs.Indicator} (${inputs.Type}). Reason: ${inputs.Reason}'
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: 455263b5-9720-4e2d-bf8d-9f1509d9561c
    type: title
    task:
      id: 455263b5-9720-4e2d-bf8d-9f1509d9561c
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: '{"linkLabelsPosition": {}, "paper": {"dimensions": {"height": 935, "width": 480, "x": 0, "y": 0}}}'
inputs:
- key: Indicator
  value: {}
  required: true
  description: The indicator value to block.
- key: Type
  value:
    simple: ip
  required: false
  description: ip | domain | url.
- key: Reason
  value:
    simple: Manual analyst-triggered block
  required: false
  description: Reason annotated on the block rule.
outputs: []
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security