Darkmon - Compromised Employee Auto-Disable

id: Darkmon - Compromised Employee Auto-Disable
version: -1
name: Darkmon - Compromised Employee Auto-Disable
description: "Hourly poll of compromised employees. For each new entry, looks up the user\nin the configured directory and acts per the DisableMode playbook input:\n  - notify-only       : creates incident and notifies; no AD action.   [DEFAULT]\n  - approval-required : creates incident, blocks on a manual approval task,\n                        then disables on approve.\n  - auto-disable      : disables the account immediately, then notifies.\nAccounts in the 'Darkmon - Auto-Disable Allowlist' list are NEVER auto-disabled."
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- monitoring
- response
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 4c7a8f1e-5964-451f-bcb3-f8ec1584c701
    type: start
    task:
      id: 4c7a8f1e-5964-451f-bcb3-f8ec1584c701
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: 37859f85-9ec5-42c5-a1e7-423e6af4da8d
    type: regular
    task:
      id: 37859f85-9ec5-42c5-a1e7-423e6af4da8d
      version: -1
      name: Fetch compromised employee accounts
      description: Pulls compromised employee accounts sorted newest first.
      script: Darkmon|||dmontip-get-compromised
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      type:
        simple: employees
      size:
        simple: '100'
      sort:
        simple: firstSeen,desc
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: c7e37494-89f6-4097-977c-c0a9292b6fe2
    type: regular
    task:
      id: c7e37494-89f6-4097-977c-c0a9292b6fe2
      version: -1
      name: Filter new + non-allowlisted
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonFilterUnseen
    scriptarguments:
      items:
        simple: ${{Darkmon.Compromised.Employee}}
      id_field:
        simple: id
      seen_list:
        simple: Darkmon - Seen Compromised Employees
      allowlist:
        simple: Darkmon - Auto-Disable Allowlist
      allowlist_match_field:
        simple: username
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 76b775d5-1f30-4470-8f06-f65e864fe9ee
    type: condition
    task:
      id: 76b775d5-1f30-4470-8f06-f65e864fe9ee
      version: -1
      name: Branch on DisableMode input
      description: ''
      type: condition
      iscommand: false
      brand: ''
    nexttasks:
      '#default#':
      - '4'
      approval-required:
      - '5'
      auto-disable:
      - '6'
    separatecontext: false
    conditions:
    - label: approval-required
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.DisableMode
            iscontext: true
          right:
            value:
              simple: approval-required
    - label: auto-disable
      condition:
      - - operator: isEqualString
          left:
            value:
              simple: inputs.DisableMode
            iscontext: true
          right:
            value:
              simple: auto-disable
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: 0fe490b7-d3a9-48cb-a0ee-4c5f11c15d5b
    type: regular
    task:
      id: 0fe490b7-d3a9-48cb-a0ee-4c5f11c15d5b
      version: -1
      name: 'notify-only: create incident + notify'
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonCreateIncidents
    scriptarguments:
      items:
        simple: ${{NewAccounts}}
      incident_type:
        simple: Darkmon Compromised Employee
      name_template:
        simple: 'Darkmon: employee ${{username}} compromised (notify-only)'
      field_map:
        simple: darkmonusername=username,darkmonpasswordredacted=password,darkmonsourcename=sources,darkmonstealer=stealers,darkmonactiontaken=notify-only
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -430, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: 2a6593c8-595f-4196-907d-435a747e3184
    type: regular
    task:
      id: 2a6593c8-595f-4196-907d-435a747e3184
      version: -1
      name: 'approval-required: create incident, manual approval task'
      description: Incident layout includes a Manual Task task that calls Generic User Action on approval.
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonCreateIncidents
    scriptarguments:
      items:
        simple: ${{NewAccounts}}
      incident_type:
        simple: Darkmon Compromised Employee
      name_template:
        simple: 'Darkmon: employee ${{username}} - PENDING APPROVAL'
      field_map:
        simple: darkmonusername=username,darkmonsourcename=sources,darkmonstealer=stealers,darkmonactiontaken=approval-required
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '6':
    id: '6'
    taskid: 328eaa12-a611-4224-b1fb-21a568463b83
    type: playbook
    task:
      id: 328eaa12-a611-4224-b1fb-21a568463b83
      version: -1
      name: 'auto-disable: call Generic User Action(disable) per username'
      description: Invokes Generic User Action sub-playbook in 'disable' mode for each compromised employee. Sub-playbook routes to AD/Okta/AzureAD per Identity Provider list.
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Darkmon - Generic User Action
    scriptarguments:
      Username:
        simple: ${{NewAccounts.username}}
      Action:
        simple: disable
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 530, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '7':
    id: '7'
    taskid: bb1b8406-7dd9-4392-a1f3-a12aa338a58e
    type: playbook
    task:
      id: bb1b8406-7dd9-4392-a1f3-a12aa338a58e
      version: -1
      name: Notify SOC + IT
      description: ''
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Darkmon - Generic Notify
    scriptarguments:
      Subject:
        simple: 'Darkmon: ${{NewAccounts.length}} new compromised employees'
      Body:
        simple: 'Mode: ${{inputs.DisableMode}}. Affected usernames: ${{NewAccounts.username}}'
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '8':
    id: '8'
    taskid: 06e1c49c-8434-41eb-9026-e8c3427cc01c
    type: title
    task:
      id: 06e1c49c-8434-41eb-9026-e8c3427cc01c
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1730}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '100':
    id: '100'
    taskid: df1828b8-ae6e-41c4-b608-93478b97b84b
    type: condition
    task:
      id: df1828b8-ae6e-41c4-b608-93478b97b84b
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: e116b3f4-8cc7-4a73-9103-179e7398f3a9
    type: title
    task:
      id: e116b3f4-8cc7-4a73-9103-179e7398f3a9
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"3_4_#default#": 0.82, "3_5_approval-required": 0.82, "3_6_auto-disable": 0.82, "100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 1895, "width": 1460, "x": -500, "y": 0}}}'
inputs:
- key: DisableMode
  value:
    simple: notify-only
  required: false
  description: |-
    Controls how the playbook reacts when a new compromised employee account is observed. Allowed values:
    - notify-only       : creates an incident and notifies; no directory action. (DEFAULT, safe)
    - approval-required : creates an incident with a manual approval task; on approve, runs the disable.
    - auto-disable      : disables the account immediately, then notifies.
    Accounts in the 'Darkmon - Auto-Disable Allowlist' list are NEVER auto-disabled regardless of this input.
  playbookInputQuery:
outputs:
- contextPath: NewAccounts
  description: Compromised employee accounts that triggered action this run.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security