Darkmon - Ransomware Mentions Watch

Every 6 hours, polls ransomware mentions for the customer organisation. New entries open a critical 'Darkmon Ransomware Mention' incident and notify the CISO via Generic Notify.

Darkmon · 8 tasks · 0 inputs · 0 outputs

Details

ID	`Darkmon - Ransomware Mentions Watch`
From Version	6.8.0
Tasks	8
Tags	darkmon monitoring

README

Every 6 hours, polls ransomware mentions for the customer organisation. New entries open a critical ‘Darkmon Ransomware Mention’ incident and notify the CISO via Generic Notify.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

Darkmon - Generic Notify

Integrations

Darkmon

Scripts

DarkmonCreateIncidents
DarkmonFilterUnseen

Commands

dmontip-get-ransomware

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

There are no outputs for this playbook.

Commands used

dmontip-get-ransomware

Flowchart

Source

playbook-Darkmon_Ransomware_Mentions_Watch.yml

Download History Raw

id: Darkmon - Ransomware Mentions Watch
version: -1
name: Darkmon - Ransomware Mentions Watch
description: Every 6 hours, polls ransomware mentions for the customer organisation. New entries open a critical 'Darkmon Ransomware Mention' incident and notify the CISO via Generic Notify.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- monitoring
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: eff80257-5aa8-4ceb-b61a-3b3248bfcd4c
    type: start
    task:
      id: eff80257-5aa8-4ceb-b61a-3b3248bfcd4c
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: ea07a276-36b2-485d-a212-90e060284889
    type: regular
    task:
      id: ea07a276-36b2-485d-a212-90e060284889
      version: -1
      name: Fetch ransomware mentions
      description: ''
      script: Darkmon|||dmontip-get-ransomware
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      type:
        simple: mentions
      size:
        simple: '50'
      sort:
        simple: publishedAt,desc
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: aa4e0d9f-3d6d-4c4e-a083-8624a4576214
    type: regular
    task:
      id: aa4e0d9f-3d6d-4c4e-a083-8624a4576214
      version: -1
      name: Filter new mentions
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonFilterUnseen
    scriptarguments:
      items:
        simple: ${{Darkmon.Ransomware}}
      id_field:
        simple: id
      seen_list:
        simple: Darkmon - Seen Ransomware Mentions
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 568ce999-4e54-46c7-9a0d-cb412ca28b8c
    type: regular
    task:
      id: 568ce999-4e54-46c7-9a0d-cb412ca28b8c
      version: -1
      name: Open critical incidents
      description: ''
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonCreateIncidents
    scriptarguments:
      items:
        simple: ${{NewAccounts}}
      incident_type:
        simple: Darkmon Ransomware Mention
      severity:
        simple: '4'
      name_template:
        simple: 'Darkmon: ${{victimName}} listed by ${{threatActor}}'
      field_map:
        simple: darkmonvictimname=victimName,darkmonthreatactor=threatActor,darkmonpublishedat=publishedAt,darkmonscreenshoturl=screenShotUrl
    nexttasks:
      '#none#':
      - '4'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '4':
    id: '4'
    taskid: d23b8918-25ef-4325-9412-eb83170bff09
    type: playbook
    task:
      id: d23b8918-25ef-4325-9412-eb83170bff09
      version: -1
      name: Page CISO
      description: ''
      type: playbook
      iscommand: false
      brand: ''
      playbookName: Darkmon - Generic Notify
    scriptarguments:
      Subject:
        simple: 'CRITICAL: Darkmon ransomware mention'
      Body:
        simple: ${{NewAccounts.length}} new ransomware mentions of the company.
    nexttasks:
      '#none#':
      - '5'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1250}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '5':
    id: '5'
    taskid: db745e82-1ae8-4f2e-9f2d-978ca7dd8a7a
    type: title
    task:
      id: db745e82-1ae8-4f2e-9f2d-978ca7dd8a7a
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1490}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '100':
    id: '100'
    taskid: a0cc153a-7371-4459-b6b0-6452aaeac7fb
    type: condition
    task:
      id: a0cc153a-7371-4459-b6b0-6452aaeac7fb
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: e0152525-25c2-4228-8e17-fb3643621b34
    type: title
    task:
      id: e0152525-25c2-4228-8e17-fb3643621b34
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 1655, "width": 980, "x": -500, "y": 0}}}'
inputs: []
outputs: []
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security