Darkmon - EDR Alert Enrichment

Designed to be invoked from CrowdStrike / SentinelOne / Defender alert playbooks. Takes the alert's IOCs, enriches each via Darkmon, and if any are scored Bad, escalates incident severity and notifies the SOC. Endpoint containment is left to the EDR-specific playbook.

Darkmon · 6 tasks · 0 inputs · 1 output

Outputs

  • DBotScore — Per-IOC reputation scores from Darkmon.

Flowchart

yes Start Start Enrich IOCs via Darkmon (URL pass) - Darkmon - Enrich URL Enrich IOCs via Darkmon (... Darkmon - Enrich URL Any malicious? Any malicious? Escalate severity to Critical - Set Escalate severity to Crit... Set Notify SOC - Darkmon - Generic Notify Notify SOC Darkmon - Generic Notify Done Done