Darkmon - Ransomware Victim Response

Triggered when our company surfaces in a Darkmon ransomware mention. Verifies the match, opens a war-room channel via Generic Notify, pages the CISO, and prints next-step guidance for the customer's IR runbook.

Darkmon · 6 tasks · 2 inputs · 0 outputs

Inputs

  • CISOEmail — Mailbox to notify when this playbook fires. Replaces the orphan ${customer_domain} variable so deployments do not silently send to a non-resolving address.
  • WarRoomChannel — Slack / Teams channel where SOC discussion of this ransomware victim incident happens. Defaults to

Flowchart

Start Start Verify victim name vs customer domains - DarkmonFilterUnseen Verify victim name vs cus... DarkmonFilterUnseen Open war-room channel - Darkmon - Generic Notify Open war-room channel Darkmon - Generic Notify Page CISO - Darkmon - Generic Notify Page CISO Darkmon - Generic Notify Print IR runbook hints - PrintErrorEntry Print IR runbook hints PrintErrorEntry Done Done