Darkmon - Phishing Email Triage

Extracts URLs/IPs/file-hashes from a reported phishing email, enriches each via the Darkmon - Enrich * sub-playbooks, and if any indicator is scored Bad (DBotScore=3) calls Generic Block Indicator on it. Notifies the reporter and the SOC at the end.

Darkmon · 10 tasks · 1 input · 2 outputs

Details

ID	`Darkmon - Phishing Email Triage`
From Version	6.8.0
Tasks	10
Tags	darkmon phishing ir

README

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Block malicious indicators
Enrich each IOC via Darkmon
Notify SOC
Notify reporter

Integrations

This playbook does not use any integrations.

Scripts

ExtractIndicatorsFromTextFile

Commands

This playbook does not use any commands.

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path	Description	Type
ExtractedIndicators	IOCs extracted from the phishing email body.	unknown
DBotScore	Reputation scores from Darkmon enrichment per IOC.	unknown

Inputs

AutoBlock — When true, indicators scored Bad by Darkmon are sent to Darkmon - Generic Block Indicator without an analyst approval task. Defaults to false (a manual approval is presented before any block).

Outputs

ExtractedIndicators — IOCs extracted from the phishing email body.
DBotScore — Reputation scores from Darkmon enrichment per IOC.

Flowchart

Source

playbook-Darkmon_Phishing_Email_Triage.yml

Download History Raw

id: Darkmon - Phishing Email Triage
version: -1
name: Darkmon - Phishing Email Triage
description: Extracts URLs/IPs/file-hashes from a reported phishing email, enriches each via the Darkmon - Enrich * sub-playbooks, and if any indicator is scored Bad (DBotScore=3) calls Generic Block Indicator on it. Notifies the reporter and the SOC at the end.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- phishing
- ir
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 9f19c1a2-93f8-4063-958a-159340d40505
    type: start
    task:
      id: 9f19c1a2-93f8-4063-958a-159340d40505
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '1'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '1':
    id: '1'
    taskid: 7b4810de-b9b5-4457-9d44-c61c34053b4b
    type: regular
    task:
      id: 7b4810de-b9b5-4457-9d44-c61c34053b4b
      version: -1
      name: Extract IOCs from email
      description: Uses the platform ExtractIndicatorsFromTextFile script to harvest IOCs from the incoming email body.
      scriptName: ExtractIndicatorsFromTextFile
      type: regular
      iscommand: false
      brand: ''
    scriptarguments:
      text:
        simple: ${incident.emailbody}
      indicator_types:
        simple: URL,IP,Hash,Domain
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '2':
    id: '2'
    taskid: b840b601-7ec7-4090-8a84-1a0fa2a8fd95
    type: playbook
    task:
      id: b840b601-7ec7-4090-8a84-1a0fa2a8fd95
      version: -1
      name: Enrich each IOC via Darkmon
      description: One pass of Darkmon URL enrichment over the extracted URLs. Domain/IP/Hash equivalents can be added per-customer by extending this playbook with parallel branches.
      playbookName: Darkmon - Enrich URL
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      URL:
        simple: ${ExtractedIndicators.URL}
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '3':
    id: '3'
    taskid: 5b8eeb26-11e4-4268-ad11-08510cc0967c
    type: condition
    task:
      id: 5b8eeb26-11e4-4268-ad11-08510cc0967c
      version: -1
      name: Any indicator scored Bad?
      description: ''
      type: condition
      iscommand: false
      brand: ''
    conditions:
    - label: 'yes'
      condition:
      - - operator: greaterThanOrEqual
          left:
            value:
              complex:
                root: DBotScore.Score
            iscontext: true
          right:
            value:
              simple: '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    nexttasks:
      'yes':
      - '8'
      '#default#':
      - '5'
  '4':
    id: '4'
    taskid: c07b16cd-622d-4a35-834f-4952aa8d1894
    type: playbook
    task:
      id: c07b16cd-622d-4a35-834f-4952aa8d1894
      version: -1
      name: Block malicious indicators
      description: ''
      playbookName: Darkmon - Generic Block Indicator
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Indicator:
        simple: ${DBotScore(val.Score >= 3).Indicator}
      Type:
        simple: url
      Reason:
        simple: Darkmon scored Bad in phishing triage
    nexttasks:
      '#none#':
      - '5'
    view: '{"position": {"x": 1050, "y": 1490}}'
  '8':
    id: '8'
    taskid: 0c9d3a5e-5e1f-4ec7-9e80-7b1a2f0f5311
    type: condition
    task:
      id: 0c9d3a5e-5e1f-4ec7-9e80-7b1a2f0f5311
      version: -1
      name: Auto-block enabled?
      description: Routes around the manual approval gate when AutoBlock input is true.
      type: condition
      iscommand: false
      brand: ''
    conditions:
    - label: 'yes'
      condition:
      - - operator: isEqualString
          left:
            value:
              complex:
                root: inputs.AutoBlock
            iscontext: true
          right:
            value:
              simple: 'true'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 550, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    nexttasks:
      'yes':
      - '4'
      '#default#':
      - '9'
  '9':
    id: '9'
    taskid: 1d8e4f6f-6f2f-4fd8-af91-8c2b3f1f6422
    type: condition
    task:
      id: 1d8e4f6f-6f2f-4fd8-af91-8c2b3f1f6422
      version: -1
      name: Analyst approval to block?
      description: Manual approval gate. Analyst confirms the block action before the Generic Block Indicator playbook runs.
      type: condition
      iscommand: false
      brand: ''
    message:
      to:
      subject:
        simple: Approve block of ${DBotScore(val.Score >= 3).Indicator}?
      body:
        simple: Darkmon scored the following indicator(s) Bad. Approve to send to Darkmon - Generic Block Indicator.
      methods: []
      format: ''
      bcc:
      cc:
      timings:
        retriescount: 0
        retriesinterval: 0
        completeafterreplies: 1
        completeafterv2: false
        completeaftersla: false
      replyOptions:
      - 'yes'
      - 'no'
    nexttasks:
      'yes':
      - '4'
      '#default#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '5':
    id: '5'
    taskid: 361b9161-619e-4a94-a629-4590a974c293
    type: playbook
    task:
      id: 361b9161-619e-4a94-a629-4590a974c293
      version: -1
      name: Notify reporter
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: Your phishing report has been triaged
      Body:
        simple: Thanks - we triaged your report. ${DBotScore.length:0} indicators evaluated.
    nexttasks:
      '#none#':
      - '6'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 1730}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '6':
    id: '6'
    taskid: a1dfdd29-aa80-4c30-b0c8-c335e0f8a65c
    type: playbook
    task:
      id: a1dfdd29-aa80-4c30-b0c8-c335e0f8a65c
      version: -1
      name: Notify SOC
      description: ''
      playbookName: Darkmon - Generic Notify
      type: playbook
      iscommand: false
      brand: ''
    scriptarguments:
      Subject:
        simple: Phishing triage complete
      Body:
        simple: Incident ${incident.id} - see Darkmon enrichment context for results.
    nexttasks:
      '#none#':
      - '7'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 1970}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '7':
    id: '7'
    taskid: 3304e1ac-dc11-462d-8b9e-937a20e13723
    type: title
    task:
      id: 3304e1ac-dc11-462d-8b9e-937a20e13723
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 2210}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
view: '{"linkLabelsPosition": {"3_5_#default#": 0.1, "3_8_yes": 0.5, "8_4_yes": 0.1, "8_9_#default#": 0.5, "9_5_#default#": 0.1, "9_4_yes": 0.5}, "paper": {"dimensions": {"height": 2375, "width": 1980, "x": -500, "y": 0}}}'
inputs:
- key: AutoBlock
  value:
    simple: 'false'
  required: false
  description: When true, indicators scored Bad by Darkmon are sent to Darkmon - Generic Block Indicator without an analyst approval task. Defaults to false (a manual approval is presented before any block).
  playbookInputQuery:
outputs:
- contextPath: ExtractedIndicators
  description: IOCs extracted from the phishing email body.
  type: unknown
- contextPath: DBotScore
  description: Reputation scores from Darkmon enrichment per IOC.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security