DarkmonFilterUnseen

Details

ID	`DarkmonFilterUnseen`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon

README

Filters items by ID against an XSOAR List (state) and optionally by domain match or allowlist. Updates the List with new IDs. Outputs NewAccounts.

Script Data

Name	Description
Script Type	python3
Tags	darkmon
Cortex XSOAR Version	6.5.0

Used In

This script is used in the following playbooks and scripts.

Darkmon - Critical CVE Pipeline
Darkmon - Ransomware Mentions Watch
Darkmon - Brand-Targeted NRD Watch
Darkmon - Compromised Employee Auto-Disable
Darkmon - Compromised Credentials Sweep
Darkmon - Ransomware Victim Response

Inputs

Argument Name	Description
items	Items to process.
id_field	Field name to use as the dedup key.
seen_list	Name of the XSOAR List storing already-seen IDs.
domain_filter_list	Optional - list of customer domains to filter username matches.
domain_match_field	Field on each item to match against domain_filter_list.
allowlist	Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field	Field to match against the allowlist.
incident_type	Incident type for newly created incidents.
severity	Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template	Incident name template (supports ${field} interpolation).
field_map	Comma-separated ‘fieldCli=sourcePath’ pairs.
emails	Email addresses to fan out per VIP fetch.
domains
brands_list
max_distance
min_cvss
tech_stack_list

Outputs

Path	Description	Type
NewAccounts		unknown
CreatedIncidents		unknown
Count		number
Typosquats		unknown
FilteredCVEs		unknown
VIPCreated		number

Source

DarkmonFilterUnseen.py DarkmonFilterUnseen_test.py DarkmonFilterUnseen.yml

Download History Raw

commonfields:
  id: DarkmonFilterUnseen
  version: -1
name: DarkmonFilterUnseen
script: ""
type: python
subtype: python3
fromversion: 6.8.0
tags:
- darkmon
comment: "Filters items by ID against an XSOAR List (state) and optionally by domain match or allowlist. Updates the List with new IDs. Outputs NewAccounts."
args:
- name: items
  isArray: true
  description: Items to process.
- name: id_field
  description: Field name to use as the dedup key.
  defaultValue: id
- name: seen_list
  description: Name of the XSOAR List storing already-seen IDs.
- name: domain_filter_list
  description: Optional - list of customer domains to filter username matches.
- name: domain_match_field
  description: Field on each item to match against domain_filter_list.
  defaultValue: username
- name: allowlist
  description: Optional list of usernames/DNs that must NEVER be actioned.
- name: allowlist_match_field
  description: Field to match against the allowlist.
  defaultValue: username
- name: incident_type
  description: Incident type for newly created incidents.
- name: severity
  description: Severity (1=Low, 2=Medium, 3=High, 4=Critical).
- name: name_template
  description: Incident name template (supports ${field} interpolation).
- name: field_map
  description: Comma-separated 'fieldCli=sourcePath' pairs.
- name: emails
  isArray: true
  description: Email addresses to fan out per VIP fetch.
- name: domains
  isArray: true
  description: Optional list of customer domains to filter domain-based matches.
- name: brands_list
  description: Name of the XSOAR List containing brand names for NRD brand-watch matching.
- name: max_distance
  defaultValue: "2"
  description: Maximum Levenshtein distance allowed when matching NRD domains against brand names.
- name: min_cvss
  defaultValue: "9.0"
  description: Minimum CVSS score threshold; CVEs below this value are excluded.
- name: tech_stack_list
  description: Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance.
outputs:
- contextPath: NewAccounts
  description: Newly discovered account records that have not been previously actioned.
  type: unknown
- contextPath: CreatedIncidents
  description: Incidents created during this execution run.
  type: unknown
- contextPath: Count
  description: Total count of new items processed.
  type: number
- contextPath: Typosquats
  description: NRD domains identified as potential typosquats of monitored brand names.
  type: unknown
- contextPath: FilteredCVEs
  description: CVEs that passed the CVSS and tech-stack filters.
  type: unknown
- contextPath: VIPCreated
  description: Number of VIP-related incidents created during this execution.
  type: number
scripttarget: 0
runonce: false
dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- xsoar
- platform
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security