Darkmon - Email Deep Dive

Analyst-driven full Darkmon profile for a single email address. Runs board-protection check, all three boardemails categories, and global search. Outputs a unified summary into the incident War Room.

Darkmon · 10 tasks · 1 input · 5 outputs

Details

IDDarkmon - Email Deep Dive
From Version6.8.0
Tasks10
Tagsdarkmon investigation

README

Analyst-driven full Darkmon profile for a single email address. Runs board-protection check, all three boardemails categories, and global search. Outputs a unified summary into the incident War Room.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Darkmon

Scripts

  • PrintErrorEntry

Commands

  • dmontip-get-boardemails
  • dmontip-get-boardprotection
  • dmontip-global-search

Playbook Inputs

Name Description Default Value Required
Email Email address to investigate.   Required

Playbook Outputs

Path Description Type
Darkmon.BoardProtection Board-protection records that match the email. unknown
Darkmon.BoardLeak.Account Account-class board-leak records for this email. unknown
Darkmon.BoardLeak.ComboList Combo-list records for this email. unknown
Darkmon.BoardLeak.PublicBreach Public-breach records for this email. unknown
Darkmon.SearchResult Global-search hits for the email. unknown

Inputs

  • Email — Email address to investigate.

Outputs

  • Darkmon.BoardProtection — Board-protection records that match the email.
  • Darkmon.BoardLeak.Account — Account-class board-leak records for this email.
  • Darkmon.BoardLeak.ComboList — Combo-list records for this email.
  • Darkmon.BoardLeak.PublicBreach — Public-breach records for this email.
  • Darkmon.SearchResult — Global-search hits for the email.

Commands used

dmontip-get-boardemails dmontip-get-boardprotection dmontip-global-search

Flowchart

yes Start Start Is the email under board protection? - dmontip-get-boardprotection Is the email under board ... dmontip-get-boardprotection Board-leak accounts for this email - dmontip-get-boardemails Board-leak accounts for t... dmontip-get-boardemails Board-leak combo lists - dmontip-get-boardemails Board-leak combo lists dmontip-get-boardemails Board-leak public breaches - dmontip-get-boardemails Board-leak public breaches dmontip-get-boardemails Global search for the email - dmontip-global-search Global search for the email dmontip-global-search Summarize into War Room - PrintErrorEntry Summarize into War Room PrintErrorEntry Done Done Is Darkmon integration available? - IsIntegrationAvailable Is Darkmon integration av... IsIntegrationAvailable Done Done

Source

playbook-Darkmon_Email_Deep_Dive.yml
Download History Raw 
id: Darkmon - Email Deep Dive
version: -1
name: Darkmon - Email Deep Dive
description: Analyst-driven full Darkmon profile for a single email address. Runs board-protection check, all three boardemails categories, and global search. Outputs a unified summary into the incident War Room.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- investigation
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 50d311bd-b753-4029-8d44-c857bdca6289
    type: start
    task:
      id: 50d311bd-b753-4029-8d44-c857bdca6289
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: 8c41331d-a866-450a-ac99-89e915250cb0
    type: regular
    task:
      id: 8c41331d-a866-450a-ac99-89e915250cb0
      version: -1
      name: Is the email under board protection?
      description: Checks whether the email address is currently under board-leak protection monitoring.
      script: Darkmon|||dmontip-get-boardprotection
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      size:
        simple: '100'
      term:
        simple: ${inputs.Email}
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: f1faa4aa-c8cb-44e3-8115-f56abcb78164
    type: regular
    task:
      id: f1faa4aa-c8cb-44e3-8115-f56abcb78164
      version: -1
      name: Board-leak accounts for this email
      description: Retrieves leaked account records associated with the board-protected email.
      script: Darkmon|||dmontip-get-boardemails
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      type:
        simple: accounts
      email:
        simple: ${inputs.Email}
      size:
        simple: '100'
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: 608f841a-c5e0-421a-a124-dc7c1f68a7d8
    type: regular
    task:
      id: 608f841a-c5e0-421a-a124-dc7c1f68a7d8
      version: -1
      name: Board-leak combo lists
      description: Retrieves combo list records associated with the board-protected email.
      script: Darkmon|||dmontip-get-boardemails
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      type:
        simple: combo-lists
      email:
        simple: ${inputs.Email}
      size:
        simple: '100'
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '4':
    id: '4'
    taskid: 6c2bd0b9-4806-4d41-9d48-8dea44162bcf
    type: regular
    task:
      id: 6c2bd0b9-4806-4d41-9d48-8dea44162bcf
      version: -1
      name: Board-leak public breaches
      description: Retrieves public breach records associated with the board-protected email.
      script: Darkmon|||dmontip-get-boardemails
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      type:
        simple: public-breaches
      email:
        simple: ${inputs.Email}
      size:
        simple: '100'
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: 7aab48b4-4a8b-4f53-9dad-bf2e6487a102
    type: regular
    task:
      id: 7aab48b4-4a8b-4f53-9dad-bf2e6487a102
      version: -1
      name: Global search for the email
      description: Performs a global search across the Darkmon platform for the email address.
      script: Darkmon|||dmontip-global-search
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      query:
        simple: ${inputs.Email}
      type:
        simple: Email
      size:
        simple: '50'
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '6':
    id: '6'
    taskid: 7fa7df32-96fa-4f7c-8df8-c1690f8b9fde
    type: regular
    task:
      id: 7fa7df32-96fa-4f7c-8df8-c1690f8b9fde
      version: -1
      name: Summarize into War Room
      description: Prints a summary of all Darkmon findings for the email into the War Room.
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      message:
        simple: 'Darkmon profile for ${inputs.Email}: under-protection=${Darkmon.BoardProtection.length:0}, accounts=${Darkmon.BoardLeak.Account.length:0}, combos=${Darkmon.BoardLeak.ComboList.length:0}, breaches=${Darkmon.BoardLeak.PublicBreach.length:0}, search-hits=${Darkmon.SearchResult.length:0}.'
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1730}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '7':
    id: '7'
    taskid: ef00f256-1a2b-4c50-952e-60f4cbc32422
    type: title
    task:
      id: ef00f256-1a2b-4c50-952e-60f4cbc32422
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1970}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '100':
    id: '100'
    taskid: 8b43a433-9534-49f0-91ba-7cf10d2273d4
    type: condition
    task:
      id: 8b43a433-9534-49f0-91ba-7cf10d2273d4
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: 47522341-b318-4e30-b880-5e0ae9dd5671
    type: title
    task:
      id: 47522341-b318-4e30-b880-5e0ae9dd5671
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 2135, "width": 980, "x": -500, "y": 0}}}'
inputs:
- key: Email
  value: {}
  required: true
  description: Email address to investigate.
outputs:
- contextPath: Darkmon.BoardProtection
  description: Board-protection records that match the email.
  type: unknown
- contextPath: Darkmon.BoardLeak.Account
  description: Account-class board-leak records for this email.
  type: unknown
- contextPath: Darkmon.BoardLeak.ComboList
  description: Combo-list records for this email.
  type: unknown
- contextPath: Darkmon.BoardLeak.PublicBreach
  description: Public-breach records for this email.
  type: unknown
- contextPath: Darkmon.SearchResult
  description: Global-search hits for the email.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security