Darkmon - Generic Notify

Provider-agnostic notification dispatcher. Reads "Darkmon - Notification Provider" List for the configured target (slack | teams | email | servicenow | jira) and routes to the matching command.

Darkmon · 9 tasks · 5 inputs · 0 outputs

Details

ID	`Darkmon - Generic Notify`
From Version	6.8.0
Tasks	9

README

Darkmon - Generic Notify

Provider-agnostic notification dispatcher. Reads the “Darkmon - Notification Provider” List for the configured target (slack teams email servicenow jira) and routes to the matching command. Falls back to logging the subject in the War Room when no provider is configured.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Slack v3
Microsoft Teams
Mail Sender (New)
ServiceNow v2
Jira V3

Scripts

PrintErrorEntry

Commands

send-notification
send-mail
servicenow-create-ticket
jira-create-issue

Playbook Inputs

Name	Description	Default Value	Required
Subject	Short subject of the notification.		Required
Body	Body of the notification (markdown supported by most providers).		Required
SlackChannel	Slack channel (used only when provider=slack).	#soc-alerts	Optional
TeamsChannel	Teams channel (used only when provider=teams).		Optional
EmailTo	Email recipients (used only when provider=email).		Optional

Playbook Outputs

There are no outputs for this playbook.

Inputs

Subject — Short subject of the notification.
Body — Body of the notification (markdown supported by most providers).
SlackChannel — Slack channel (used only when provider=slack).
TeamsChannel — Teams channel (used only when provider=teams).
EmailTo — Email recipients (used only when provider=email).

Flowchart

Source

playbook-Darkmon_Generic_Notify.yml

Download History Raw

id: Darkmon - Generic Notify
version: -1
name: Darkmon - Generic Notify
description: Provider-agnostic notification dispatcher. Reads "Darkmon - Notification Provider" List for the configured target (slack | teams | email | servicenow | jira) and routes to the matching command.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 3d7deead-057c-4a78-a75a-00ec3fb67659
    type: start
    task:
      id: 3d7deead-057c-4a78-a75a-00ec3fb67659
      version: -1
      name: ''
      description: ''
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: 0b8c69c3-6dbf-47d5-9b50-90cc0805bbb5
    type: condition
    task:
      id: 0b8c69c3-6dbf-47d5-9b50-90cc0805bbb5
      version: -1
      name: Provider switch
      description: ''
      type: condition
      iscommand: false
      brand: ''
    conditions:
    - label: slack
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: lists.Darkmon - Notification Provider
            iscontext: true
          ignorecase: true
          right:
            value:
              simple: slack
    - label: teams
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: lists.Darkmon - Notification Provider
            iscontext: true
          ignorecase: true
          right:
            value:
              simple: teams
    - label: email
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: lists.Darkmon - Notification Provider
            iscontext: true
          ignorecase: true
          right:
            value:
              simple: email
    - label: servicenow
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: lists.Darkmon - Notification Provider
            iscontext: true
          ignorecase: true
          right:
            value:
              simple: servicenow
    - label: jira
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: lists.Darkmon - Notification Provider
            iscontext: true
          ignorecase: true
          right:
            value:
              simple: jira
    nexttasks:
      '#default#':
      - '7'
      slack:
      - '2'
      teams:
      - '3'
      email:
      - '4'
      servicenow:
      - '5'
      jira:
      - '6'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: b02d32ea-eed6-46af-849d-a16b72e74287
    type: regular
    task:
      id: b02d32ea-eed6-46af-849d-a16b72e74287
      version: -1
      name: Send Slack message
      description: ''
      script: send-notification
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      message:
        complex:
          root: inputs.Body
      to:
        complex:
          root: inputs.SlackChannel
      using-brand:
        simple: SlackV3
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -670, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: 6bfe95d5-7782-418d-88e4-0c486d2c9f30
    type: regular
    task:
      id: 6bfe95d5-7782-418d-88e4-0c486d2c9f30
      version: -1
      name: Send Teams message
      description: ''
      script: send-notification
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      message:
        complex:
          root: inputs.Body
      to:
        complex:
          root: inputs.TeamsChannel
      using-brand:
        simple: Microsoft Teams
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -190, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '4':
    id: '4'
    taskid: aaf0f6c8-7ab7-4294-bbba-cc512cde7573
    type: regular
    task:
      id: aaf0f6c8-7ab7-4294-bbba-cc512cde7573
      version: -1
      name: Send email
      description: ''
      script: send-mail
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      to:
        complex:
          root: inputs.EmailTo
      subject:
        complex:
          root: inputs.Subject
      body:
        complex:
          root: inputs.Body
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 290, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: 801ab1aa-6d9d-4743-b81b-f59a3e9a4240
    type: regular
    task:
      id: 801ab1aa-6d9d-4743-b81b-f59a3e9a4240
      version: -1
      name: Create ServiceNow ticket
      description: ''
      script: servicenow-create-ticket
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      short_description:
        complex:
          root: inputs.Subject
      description:
        complex:
          root: inputs.Body
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 770, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '6':
    id: '6'
    taskid: 370d0f85-b465-4e47-839c-1f0b61262716
    type: regular
    task:
      id: 370d0f85-b465-4e47-839c-1f0b61262716
      version: -1
      name: Create Jira issue
      description: ''
      script: jira-create-issue
      type: regular
      iscommand: true
      brand: ''
    scriptarguments:
      summary:
        complex:
          root: inputs.Subject
      description:
        complex:
          root: inputs.Body
      issueTypeName:
        simple: Task
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 1250, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '7':
    id: '7'
    taskid: d5a56ee0-004f-4a05-8aee-684819ccafbd
    type: regular
    task:
      id: d5a56ee0-004f-4a05-8aee-684819ccafbd
      version: -1
      name: 'Fallback: log to War Room'
      description: No notification provider configured. The Subject and Body are left in the War Room for the analyst.
      scriptName: PrintErrorEntry
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      message:
        complex:
          root: inputs.Subject
          transformers:
          - operator: concat
            args:
              prefix:
                value:
                  simple: '[Darkmon] '
              suffix:
                value:
                  simple: ' - configure ''Darkmon - Notification Provider'' to route alerts.'
    nexttasks:
      '#none#':
      - '8'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -1150, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '8':
    id: '8'
    taskid: 2b1883fa-edd0-4e3b-9b7c-9c0abcc24128
    type: title
    task:
      id: 2b1883fa-edd0-4e3b-9b7c-9c0abcc24128
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"1_7_#default#": 0.82, "1_2_slack": 0.82, "1_3_teams": 0.82, "1_4_email": 0.82, "1_5_servicenow": 0.82, "1_6_jira": 0.82}, "paper": {"dimensions": {"height": 935, "width": 2880, "x": -1200, "y": 0}}}'
inputs:
- key: Subject
  value: {}
  required: true
  description: Short subject of the notification.
- key: Body
  value: {}
  required: true
  description: Body of the notification (markdown supported by most providers).
- key: SlackChannel
  value:
    simple: '#soc-alerts'
  required: false
  description: Slack channel (used only when provider=slack).
- key: TeamsChannel
  value: {}
  required: false
  description: Teams channel (used only when provider=teams).
- key: EmailTo
  value: {}
  required: false
  description: Email recipients (used only when provider=email).
outputs: []
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security