Darkmon - Enrich IP
Sub-playbook that calls the Darkmon !ip command and returns DBotScore + Common.IP for the input IP indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
Darkmon · 5 tasks · 1 input · 9 outputs
Inputs
IP— The IP indicator value to enrich. Defaults to ${IP.Address}.
Outputs
DBotScore.Indicator— The indicator value.DBotScore.Type— The indicator type.DBotScore.Vendor— The vendor reporting the score (Darkmon).DBotScore.Score— The reputation score (0=Unknown, 1=Good, 2=Suspicious, 3=Bad).DBotScore.Reliability— Source reliability per the Admiralty code.IP.Address— The IP value.IP.Malicious.Vendor— The vendor that flagged this IP as malicious (Darkmon).IP.Malicious.Description— Reason this IP was flagged as malicious.Darkmon.SearchResult— Full search result records returned by Darkmon for this indicator.
Commands used
ip