Darkmon - Phishing Email Triage

Extracts URLs/IPs/file-hashes from a reported phishing email, enriches each via the Darkmon - Enrich * sub-playbooks, and if any indicator is scored Bad (DBotScore=3) calls Generic Block Indicator on it. Notifies the reporter and the SOC at the end.

Darkmon · 10 tasks · 1 input · 2 outputs

Inputs

  • AutoBlock — When true, indicators scored Bad by Darkmon are sent to Darkmon - Generic Block Indicator without an analyst approval task. Defaults to false (a manual approval is presented before any block).

Outputs

  • ExtractedIndicators — IOCs extracted from the phishing email body.
  • DBotScore — Reputation scores from Darkmon enrichment per IOC.

Flowchart

yes yes yes Start Start Extract IOCs from email - ExtractIndicatorsFromTextFile Extract IOCs from email ExtractIndicatorsFromTextFile Enrich each IOC via Darkmon - Darkmon - Enrich URL Enrich each IOC via Darkmon Darkmon - Enrich URL Any indicator scored Bad? Any indicator scored Bad? Block malicious indicators - Darkmon - Generic Block Indicator Block malicious indicators Darkmon - Generic Block Indic... Auto-block enabled? Auto-block enabled? Analyst approval to block? Analyst approval to block? Notify reporter - Darkmon - Generic Notify Notify reporter Darkmon - Generic Notify Notify SOC - Darkmon - Generic Notify Notify SOC Darkmon - Generic Notify Done Done