Darkmon - Enrich Email
Sub-playbook that calls the Darkmon !email command and returns DBotScore + Common.Account.Email for the input Email indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
Darkmon · 5 tasks · 1 input · 9 outputs
Inputs
Email— The Email indicator value to enrich. Defaults to ${Email.Address}.
Outputs
DBotScore.Indicator— The indicator value.DBotScore.Type— The indicator type.DBotScore.Vendor— The vendor reporting the score (Darkmon).DBotScore.Score— The reputation score (0=Unknown, 1=Good, 2=Suspicious, 3=Bad).DBotScore.Reliability— Source reliability per the Admiralty code.Account.Email.Address— The Email value.Account.Email.Malicious.Vendor— The vendor that flagged this Email as malicious (Darkmon).Account.Email.Malicious.Description— Reason this Email was flagged as malicious.Darkmon.SearchResult— Full search result records returned by Darkmon for this indicator.
Commands used
email