Darkmon - VIP Email Monitor

Hourly poll of board-protected emails. For each protected email, checks accounts/combo-lists/public-breaches and opens a 'Darkmon VIP Email Leak' incident per new entry.

Darkmon · 6 tasks · 0 inputs · 1 output

Details

ID	`Darkmon - VIP Email Monitor`
From Version	6.8.0
Tasks	6
Tags	darkmon monitoring

README

Hourly poll of board-protected emails. For each protected email, checks accounts/combo-lists/public-breaches and opens a ‘Darkmon VIP Email Leak’ incident per new entry.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

Darkmon

Scripts

DarkmonVIPFanOut

Commands

dmontip-get-boardprotection

Playbook Inputs

There are no inputs for this playbook.

Playbook Outputs

Path	Description	Type
Darkmon.BoardProtection	List of currently board-protected emails.	unknown

Outputs

Darkmon.BoardProtection — List of currently board-protected emails.

Commands used

dmontip-get-boardprotection

Flowchart

Source

playbook-Darkmon_VIP_Email_Monitor.yml

Download History Raw

id: Darkmon - VIP Email Monitor
version: -1
name: Darkmon - VIP Email Monitor
description: Hourly poll of board-protected emails. For each protected email, checks accounts/combo-lists/public-breaches and opens a 'Darkmon VIP Email Leak' incident per new entry.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
tags:
- darkmon
- monitoring
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: ef4aa57f-333c-4fc4-acb0-15078c6b9a92
    type: start
    task:
      id: ef4aa57f-333c-4fc4-acb0-15078c6b9a92
      version: -1
      name: ''
      description: ''
      type: start
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '1':
    id: '1'
    taskid: 999c507e-0303-4c2c-8462-81e5f5e41438
    type: regular
    task:
      id: 999c507e-0303-4c2c-8462-81e5f5e41438
      version: -1
      name: List protected emails
      description: Pulls all currently board-protected emails.
      script: Darkmon|||dmontip-get-boardprotection
      type: regular
      iscommand: true
      brand: Darkmon
    scriptarguments:
      size:
        simple: '100'
    nexttasks:
      '#none#':
      - '2'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '2':
    id: '2'
    taskid: e0fdc6ca-d56e-4da3-8d9d-5985267cb38f
    type: regular
    task:
      id: e0fdc6ca-d56e-4da3-8d9d-5985267cb38f
      version: -1
      name: Per-email leak fan-out
      description: 'Helper script: for each email, runs dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries via the seen list, creates incidents.'
      type: regular
      iscommand: false
      brand: ''
      scriptName: DarkmonVIPFanOut
    scriptarguments:
      emails:
        simple: ${{Darkmon.BoardProtection.value}}
      seen_list:
        simple: Darkmon - Seen VIP Leaks
      incident_type:
        simple: Darkmon VIP Email Leak
    nexttasks:
      '#none#':
      - '3'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '3':
    id: '3'
    taskid: 1c286565-f885-4638-9cc4-76e73ae868d3
    type: title
    task:
      id: 1c286565-f885-4638-9cc4-76e73ae868d3
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 1010}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  '100':
    id: '100'
    taskid: 3f85937b-1e21-4bc5-bf80-0f73ea0bc0e7
    type: condition
    task:
      id: 3f85937b-1e21-4bc5-bf80-0f73ea0bc0e7
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: 02bc6ae1-fd63-4623-b7c8-64ab06e26f0d
    type: title
    task:
      id: 02bc6ae1-fd63-4623-b7c8-64ab06e26f0d
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 1175, "width": 980, "x": -500, "y": 0}}}'
inputs: []
outputs:
- contextPath: Darkmon.BoardProtection
  description: List of currently board-protected emails.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security