Darkmon - EDR Alert Enrichment

Designed to be invoked from CrowdStrike / SentinelOne / Defender alert playbooks. Takes the alert's IOCs, enriches each via Darkmon, and if any are scored Bad, escalates incident severity and notifies the SOC. Endpoint containment is left to the EDR-specific playbook.

Darkmon · 6 tasks · 0 inputs · 1 output

Details

ID	`Darkmon - EDR Alert Enrichment`
From Version	6.8.0
Tasks	6
Tags	darkmon edr ir

README

Designed to be invoked from CrowdStrike / SentinelOne / Defender alert playbooks. Takes the alert’s IOCs, enriches each via Darkmon, and if any are scored Bad, escalates incident severity and notifies the SOC. Endpoint containment is left to the EDR-specific playbook.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Enrich IOCs via Darkmon (URL pass)
Notify SOC

Integrations

This playbook does not use any integrations.

Scripts

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path	Description	Type
DBotScore	Per-IOC reputation scores from Darkmon.	unknown

Outputs

DBotScore — Per-IOC reputation scores from Darkmon.

Flowchart

Source

playbook-Darkmon_EDR_Alert_Enrichment.yml

Download History Raw

id: Darkmon - EDR Alert Enrichment
version: -1
name: Darkmon - EDR Alert Enrichment
description: Designed to be invoked from CrowdStrike / SentinelOne / Defender alert playbooks. Takes the alert's IOCs, enriches each via Darkmon, and if any are scored Bad, escalates incident severity and notifies the SOC. Endpoint containment is left to the EDR-specific playbook.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- edr
- ir
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 34f83352-a2f5-4e17-bd3c-39b00fdf618e
    type: start
    task:
      id: 34f83352-a2f5-4e17-bd3c-39b00fdf618e
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: aea160ea-f963-41aa-b1ce-0cecbbd805a0
    type: playbook
    task:
      id: aea160ea-f963-41aa-b1ce-0cecbbd805a0
      version: -1
      name: Enrich IOCs via Darkmon (URL pass)
      description: Replicate this task for IP/Domain/File/Email if the EDR alert exposes those IOCs.
      playbookName: Darkmon - Enrich URL
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      URL:
        simple: ${incident.alerturls}
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: 1ca794ff-eb92-4ac2-9906-0df8602f5e00
    type: condition
    task:
      id: 1ca794ff-eb92-4ac2-9906-0df8602f5e00
      version: -1
      name: Any malicious?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    conditions:
    - label: 'yes'
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    nexttasks:
      'yes':
      - '3'
      '#default#':
      - '4'
  '3':
    id: '3'
    taskid: a5e653c6-3a7c-43dd-bb14-e5eaaddfb968
    type: regular
    task:
      id: a5e653c6-3a7c-43dd-bb14-e5eaaddfb968
      version: -1
      name: Escalate severity to Critical
      description: ''
      scriptName: Set
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      key:
        simple: incident.severity
      value:
        simple: '4'
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 550, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '4':
    id: '4'
    taskid: 97d350cd-746d-4727-8dc9-4397bc312f97
    type: playbook
    task:
      id: 97d350cd-746d-4727-8dc9-4397bc312f97
      version: -1
      name: Notify SOC
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: EDR alert enriched - ${DBotScore.length:0} IOCs evaluated
      Body:
        simple: ${DBotScore(val.Score === 3).Indicator}
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: a66ce7e8-9b66-4993-abe1-beda29d76245
    type: title
    task:
      id: a66ce7e8-9b66-4993-abe1-beda29d76245
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: '{"linkLabelsPosition": {"2_4_#default#": 0.1, "2_3_yes": 0.5}, "paper": {"dimensions": {"height": 1415, "width": 1480, "x": -500, "y": 0}}}'
inputs: []
outputs:
- contextPath: DBotScore
  description: Per-IOC reputation scores from Darkmon.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security