Darkmon - Compromised Credentials Sweep

Polls Darkmon for compromised credentials, filters to the customer's email/web domains, dedupes via state list, and creates a 'Darkmon Compromised Credential' incident per new account. Triggered on a 4-hour Job.

Darkmon · 8 tasks · 0 inputs · 2 outputs

Details

IDDarkmon - Compromised Credentials Sweep
From Version6.8.0
Tasks8
Tagsdarkmon monitoring

README

Polls Darkmon for compromised credentials, filters to the customer’s email/web domains, dedupes via state list, and creates a ‘Darkmon Compromised Credential’ incident per new account. Triggered on a 4-hour Job.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • Darkmon - Generic Notify

Integrations

  • Darkmon

Scripts

  • DarkmonCreateIncidents
  • DarkmonFilterUnseen

Commands

  • dmontip-get-compromised

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path Description Type
NewAccounts Compromised account records that triggered new incidents this run. unknown
Darkmon.Compromised.Account Raw compromised account data returned by Darkmon. unknown

Outputs

  • NewAccounts — Compromised account records that triggered new incidents this run.
  • Darkmon.Compromised.Account — Raw compromised account data returned by Darkmon.

Commands used

dmontip-get-compromised

Flowchart

yes Start Start Fetch latest compromised accounts - dmontip-get-compromised Fetch latest compromised ... dmontip-get-compromised Filter to customer domains and unseen account IDs - DarkmonFilterUnseen Filter to customer domain... DarkmonFilterUnseen Create one incident per new account - DarkmonCreateIncidents Create one incident per n... DarkmonCreateIncidents Notify SOC - Darkmon - Generic Notify Notify SOC Darkmon - Generic Notify Done Done Is Darkmon integration available? - IsIntegrationAvailable Is Darkmon integration av... IsIntegrationAvailable Done Done

Source

playbook-Darkmon_Compromised_Credentials_Sweep.yml
Download History Raw 
id: Darkmon - Compromised Credentials Sweep
version: -1
name: Darkmon - Compromised Credentials Sweep
description: Polls Darkmon for compromised credentials, filters to the customer's email/web domains, dedupes via state list, and creates a 'Darkmon Compromised Credential' incident per new account. Triggered on a 4-hour Job.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- monitoring
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 0344d9df-6aa7-423e-a45e-3868a7223948
    type: start
    task:
      id: 0344d9df-6aa7-423e-a45e-3868a7223948
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: 918b6c57-dbed-4b6f-9b10-fbc9385ff642
    type: regular
    task:
      id: 918b6c57-dbed-4b6f-9b10-fbc9385ff642
      version: -1
      name: Fetch latest compromised accounts
      description: Pulls the most recent 100 compromised accounts (sorted newest first).
      script: Darkmon|||dmontip-get-compromised
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      type:
        simple: accounts
      size:
        simple: '100'
      sort:
        simple: firstSeen,desc
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: 852c8531-03ac-4c8f-bccc-8e412677090c
    type: regular
    task:
      id: 852c8531-03ac-4c8f-bccc-8e412677090c
      version: -1
      name: Filter to customer domains and unseen account IDs
      description: 'Helper script: returns ${{NewAccounts}} containing only accounts whose username matches a customer domain and whose id is not in the Seen list. Updates the seen list.'
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonFilterUnseen
    scriptarguments:
      items:
        simple: ${{Darkmon.Compromised.Account}}
      id_field:
        simple: id
      seen_list:
        simple: Darkmon - Seen Compromised Accounts
      domain_filter_list:
        simple: Darkmon - Customer Domains
      domain_match_field:
        simple: username
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 2c514eaa-3910-4d9b-bf7a-688a74b80dab
    type: regular
    task:
      id: 2c514eaa-3910-4d9b-bf7a-688a74b80dab
      version: -1
      name: Create one incident per new account
      description: Helper script that calls createNewIncident per new entry, mapping Darkmon fields to incident fields.
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonCreateIncidents
    scriptarguments:
      items:
        simple: ${{NewAccounts}}
      incident_type:
        simple: Darkmon Compromised Credential
      name_template:
        simple: 'Darkmon: ${{username}} compromised at ${{url}}'
      field_map:
        simple: darkmonaccountid=id,darkmonusername=username,darkmonpasswordredacted=password,darkmonurl=url,darkmonsourcename=sources,darkmonstealer=stealers,country=countries,darkmonfirstcompromise=firstCompromiseDate,darkmonlastcompromise=lastCompromiseDate
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: c210ca17-a4f1-4deb-a1dd-9dc487ad5e9b
    type: playbook
    task:
      id: c210ca17-a4f1-4deb-a1dd-9dc487ad5e9b
      version: -1
      name: Notify SOC
      description: Routes the alert to whichever provider the customer configured.
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Darkmon - Generic Notify
    scriptarguments:
      Subject:
        simple: 'Darkmon: ${{NewAccounts.length}} new compromised customer credentials'
      Body:
        simple: Sweep created ${{NewAccounts.length}} 'Darkmon Compromised Credential' incidents.
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: c102476b-c77c-4247-a9a8-d57851a9fe70
    type: title
    task:
      id: c102476b-c77c-4247-a9a8-d57851a9fe70
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '100':
    id: '100'
    taskid: de2a3401-8408-47f9-90b3-9b41d4ad4f70
    type: condition
    task:
      id: de2a3401-8408-47f9-90b3-9b41d4ad4f70
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: fad0587e-6cd6-4f8a-a416-a4dd18af61a2
    type: title
    task:
      id: fad0587e-6cd6-4f8a-a416-a4dd18af61a2
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 1655, "width": 980, "x": -500, "y": 0}}}'
inputs: []
outputs:
- contextPath: NewAccounts
  description: Compromised account records that triggered new incidents this run.
  type: unknown
- contextPath: Darkmon.Compromised.Account
  description: Raw compromised account data returned by Darkmon.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security