Darkmon - Enrich Domain

Sub-playbook that calls the Darkmon !domain command and returns DBotScore + Common.Domain for the input Domain indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.

Darkmon · 5 tasks · 1 input · 9 outputs

Details

IDDarkmon - Enrich Domain
From Version6.8.0
Tasks5

README

Sub-playbook that calls the Darkmon !domain command and returns DBotScore + Common.Domain for the input Domain indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

  • Darkmon

Scripts

This playbook does not use any scripts.

Commands

  • domain

Playbook Inputs

Name Description Default Value Required
Domain The Domain indicator value to enrich. Defaults to ${Domain.Name}. Domain.Name Required

Playbook Outputs

Path Description Type
DBotScore.Indicator The indicator value. string
DBotScore.Type The indicator type. string
DBotScore.Vendor The vendor reporting the score (Darkmon). string
DBotScore.Score The reputation score (0=Unknown, 1=Good, 2=Suspicious, 3=Bad). number
DBotScore.Reliability Source reliability per the Admiralty code. string
Domain.Name The Domain value. string
Domain.Malicious.Vendor The vendor that flagged this Domain as malicious (Darkmon). string
Domain.Malicious.Description Reason this Domain was flagged as malicious. string
Darkmon.SearchResult Full search result records returned by Darkmon for this indicator. unknown

Inputs

  • Domain — The Domain indicator value to enrich. Defaults to ${Domain.Name}.

Outputs

  • DBotScore.Indicator — The indicator value.
  • DBotScore.Type — The indicator type.
  • DBotScore.Vendor — The vendor reporting the score (Darkmon).
  • DBotScore.Score — The reputation score (0=Unknown, 1=Good, 2=Suspicious, 3=Bad).
  • DBotScore.Reliability — Source reliability per the Admiralty code.
  • Domain.Name — The Domain value.
  • Domain.Malicious.Vendor — The vendor that flagged this Domain as malicious (Darkmon).
  • Domain.Malicious.Description — Reason this Domain was flagged as malicious.
  • Darkmon.SearchResult — Full search result records returned by Darkmon for this indicator.

Commands used

domain

Flowchart

yes Start Start Run Darkmon domain lookup - domain Run Darkmon domain lookup domain Done Done Is Darkmon integration available? - IsIntegrationAvailable Is Darkmon integration av... IsIntegrationAvailable Done Done

Source

playbook-Darkmon_Enrich_Domain.yml
Download History Raw 
id: Darkmon - Enrich Domain
version: -1
name: Darkmon - Enrich Domain
description: Sub-playbook that calls the Darkmon !domain command and returns DBotScore + Common.Domain for the input Domain indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 58c433f6-9f8c-4c59-85e4-649d492159ef
    type: start
    task:
      id: 58c433f6-9f8c-4c59-85e4-649d492159ef
      version: -1
      name: ''
      description: ''
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: ef80b616-1b04-4184-8b45-91b4f63df51e
    type: regular
    task:
      id: ef80b616-1b04-4184-8b45-91b4f63df51e
      version: -1
      name: Run Darkmon domain lookup
      description: Calls the Darkmon !domain reputation command to enrich the Domain.
      script: Darkmon|||domain
      type: regular
      iscommand: true
      brand: Darkmon
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      domain:
        complex:
          root: inputs.Domain
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: ecb5ddbd-8aec-40ac-85d1-ca61f892a561
    type: title
    task:
      id: ecb5ddbd-8aec-40ac-85d1-ca61f892a561
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '100':
    id: '100'
    taskid: e21c0719-eddc-4915-9fc1-3d6bae425e55
    type: condition
    task:
      id: e21c0719-eddc-4915-9fc1-3d6bae425e55
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: fb102262-922c-4a60-8a90-225004f04f81
    type: title
    task:
      id: fb102262-922c-4a60-8a90-225004f04f81
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 935, "width": 980, "x": -500, "y": 0}}}'
inputs:
- key: Domain
  value:
    complex:
      root: Domain
      accessor: Name
  required: true
  description: The Domain indicator value to enrich. Defaults to ${Domain.Name}.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator value.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor reporting the score (Darkmon).
  type: string
- contextPath: DBotScore.Score
  description: The reputation score (0=Unknown, 1=Good, 2=Suspicious, 3=Bad).
  type: number
- contextPath: DBotScore.Reliability
  description: Source reliability per the Admiralty code.
  type: string
- contextPath: Domain.Name
  description: The Domain value.
  type: string
- contextPath: Domain.Malicious.Vendor
  description: The vendor that flagged this Domain as malicious (Darkmon).
  type: string
- contextPath: Domain.Malicious.Description
  description: Reason this Domain was flagged as malicious.
  type: string
- contextPath: Darkmon.SearchResult
  description: Full search result records returned by Darkmon for this indicator.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security