Darkmon - Generic Block Indicator

Provider-agnostic indicator-block dispatcher. Reads the 'Darkmon - Block Provider' List for the configured block target (panos | fortinet | umbrella | cloudflare) and routes to the matching command. Falls back to logging the block intent in the War Room when no provider is configured.

Darkmon · 8 tasks · 3 inputs · 0 outputs

Inputs

  • Indicator — The indicator value (IP, domain, URL) to block.
  • Type — One of ip | domain | url.
  • Reason — Free-text reason annotated on the block rule.

Flowchart

panos fortinet umbrella cloudflare Start Start Provider switch Provider switch Palo Alto: block on EDL Palo Alto: block on EDL Fortinet: add to address group Fortinet: add to address ... Cisco Umbrella: add destination block Cisco Umbrella: add desti... CloudFlare: zone-level block CloudFlare: zone-level block Fallback: log block intent - PrintErrorEntry Fallback: log block intent PrintErrorEntry Done Done