Darkmon - Compromised Account Response

id: Darkmon - Compromised Account Response
version: -1
name: Darkmon - Compromised Account Response
description: Incident-type playbook for 'Darkmon Compromised Credential' (and similar). Identifies the user via the configured directory, suspends, forces a password reset, revokes active sessions, and notifies SOC + the user.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- ir
- account-takeover
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 68996222-a5f9-4d1b-beb3-a6a005afad3e
    type: start
    task:
      id: 68996222-a5f9-4d1b-beb3-a6a005afad3e
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: 661e384e-b84a-47aa-9545-2767bc2b27f9
    type: playbook
    task:
      id: 661e384e-b84a-47aa-9545-2767bc2b27f9
      version: -1
      name: Disable account
      description: Routes to AD/Okta/AzureAD per identity provider list.
      playbookName: Darkmon - Generic User Action
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Username:
        simple: ${incident.darkmonusername}
      Action:
        simple: disable
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 550, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: 1f6fb4ed-7978-45d4-aa99-88584a6aa191
    type: playbook
    task:
      id: 1f6fb4ed-7978-45d4-aa99-88584a6aa191
      version: -1
      name: Force password reset
      description: ''
      playbookName: Darkmon - Generic User Action
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Username:
        simple: ${incident.darkmonusername}
      Action:
        simple: reset-password
      NewPassword:
        simple: ${NEW_PASSWORD}
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 550, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: 68e42c77-12d0-42f6-a48f-9a704db515e7
    type: playbook
    task:
      id: 68e42c77-12d0-42f6-a48f-9a704db515e7
      version: -1
      name: Revoke active sessions
      description: ''
      playbookName: Darkmon - Generic User Action
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Username:
        simple: ${incident.darkmonusername}
      Action:
        simple: revoke-sessions
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 550, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '4':
    id: '4'
    taskid: 32a3806b-a38f-4ecc-ab91-237b23df2090
    type: playbook
    task:
      id: 32a3806b-a38f-4ecc-ab91-237b23df2090
      version: -1
      name: Notify SOC + user
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: Account ${incident.darkmonusername} has been suspended
      Body:
        simple: Account suspended after Darkmon flagged it as compromised. Reset/revoke completed. Verify in Audit log.
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -950, "y": 1730}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: 56c90d3d-d139-4bcb-99a8-fd74efffe22f
    type: title
    task:
      id: 56c90d3d-d139-4bcb-99a8-fd74efffe22f
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -950, "y": 1970}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '6':
    id: '6'
    taskid: a1b2c3d4-1111-4111-8111-111111111111
    type: regular
    task:
      id: a1b2c3d4-1111-4111-8111-111111111111
      version: -1
      name: Generate new password
      description: Generates a strong password used by the Force password reset step. Replaces the previous orphan ${random_password} reference so reset actually has a value to apply.
      script: GeneratePassword
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      min_lcase:
        simple: '2'
      min_ucase:
        simple: '2'
      min_digits:
        simple: '2'
      min_symbols:
        simple: '1'
      max_lcase:
        simple: '8'
      max_ucase:
        simple: '6'
      max_digits:
        simple: '4'
      max_symbols:
        simple: '4'
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
  '7':
    id: '7'
    taskid: a1b2c3d4-2222-4222-8222-222222222222
    type: condition
    task:
      id: a1b2c3d4-2222-4222-8222-222222222222
      version: -1
      name: Auto-disable enabled?
      description: Routes around the manual approval gate when the AutoDisable input is true. Defaults to false so destructive actions wait for an analyst by default.
      type: condition
      iscommand: false
      brand: ''
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoDisable
            iscontext: true
          right:
            value:
              simple: 'true'
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
  '8':
    id: '8'
    taskid: a1b2c3d4-3333-4333-8333-333333333333
    type: condition
    task:
      id: a1b2c3d4-3333-4333-8333-333333333333
      version: -1
      name: Analyst approval to disable account?
      description: Manual approval gate. Analyst confirms the disable + reset + revoke sequence before any destructive action runs. Required when AutoDisable input is false (the default).
      type: condition
      iscommand: false
      brand: ''
    message:
      to:
      subject:
        simple: Approve compromised account response for ${incident.darkmonusername}?
      body:
        simple: Darkmon reported credentials for ${incident.darkmonusername} as compromised. Approving will disable the account, force a password reset, and revoke active sessions. Reject to skip all three and only notify.
      methods: []
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 0
        retriesinterval: 0
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - 'yes'
      - 'no'
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
view: '{"linkLabelsPosition": {"7_1_yes": 0.1, "7_8_#default#": 0.5, "8_4_#default#": 0.1, "8_1_yes": 0.5}, "paper": {"dimensions": {"height": 2135, "width": 1980, "x": -1000, "y": 0}}}'
inputs:
- key: AutoDisable
  value:
    simple: 'false'
  required: false
  description: When true, the playbook proceeds straight to the disable + password-reset + revoke-sessions sequence without an analyst approval task. Defaults to false. Accounts in the Darkmon - Auto-Disable Allowlist are never auto-disabled regardless of this input.
  playbookInputQuery:
outputs: []
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security