DarkmonFilterUnseen

Details

ID	`DarkmonFilterUnseen`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon

README

Filters items by ID against an XSOAR List (state) and optionally by domain match or allowlist. Updates the List with new IDs. Outputs NewAccounts.

Script Data

Name	Description
Script Type	python3
Tags	darkmon
Cortex XSOAR Version	6.5.0

Used In

This script is used in the following playbooks and scripts.

Darkmon - Critical CVE Pipeline
Darkmon - Ransomware Mentions Watch
Darkmon - Brand-Targeted NRD Watch
Darkmon - Compromised Employee Auto-Disable
Darkmon - Compromised Credentials Sweep
Darkmon - Ransomware Victim Response

Inputs

Argument Name	Description
items	Items to process.
id_field	Field name to use as the dedup key.
seen_list	Name of the XSOAR List storing already-seen IDs.
domain_filter_list	Optional - list of customer domains to filter username matches.
domain_match_field	Field on each item to match against domain_filter_list.
allowlist	Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field	Field to match against the allowlist.
incident_type	Incident type for newly created incidents.
severity	Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template	Incident name template (supports ${field} interpolation).
field_map	Comma-separated ‘fieldCli=sourcePath’ pairs.
emails	Email addresses to fan out per VIP fetch.
domains
brands_list
max_distance
min_cvss
tech_stack_list

Outputs

Path	Description	Type
NewAccounts		unknown
CreatedIncidents		unknown
Count		number
Typosquats		unknown
FilteredCVEs		unknown
VIPCreated		number

Source

DarkmonFilterUnseen.py DarkmonFilterUnseen_test.py DarkmonFilterUnseen.yml

Download History Raw

import DarkmonFilterUnseen
import demistomock as demisto  # noqa: F401


def test_main_no_items(mocker):
    """
    Given:
        - No items passed to the script

    When:
        - main() is called with an empty items list

    Then:
        - return_results is called with an empty NewAccounts list
    """
    mocker.patch.object(
        demisto,
        "args",
        return_value={"items": [], "id_field": "id", "seen_list": "test-list"},
    )
    mocker.patch.object(demisto, "executeCommand", return_value=[{"Contents": "", "Type": 1}])
    mock_return = mocker.patch.object(DarkmonFilterUnseen, "return_results")

    DarkmonFilterUnseen.main()

    mock_return.assert_called_once()
    result = mock_return.call_args[0][0]
    assert result.get("NewAccounts") == []


def test_main_filters_seen_items(mocker):
    """
    Given:
        - Two items where one ID is already in the seen list

    When:
        - main() is called

    Then:
        - Only the unseen item is returned in NewAccounts
    """
    items = [{"id": "abc123"}, {"id": "xyz789"}]
    mocker.patch.object(
        demisto,
        "args",
        return_value={"items": items, "id_field": "id", "seen_list": "test-list"},
    )
    mocker.patch.object(
        demisto,
        "executeCommand",
        side_effect=[
            [{"Contents": "abc123", "Type": 1}],  # getList returns abc123 as already seen
            [{"Contents": "", "Type": 1}],  # setList call
        ],
    )
    mock_return = mocker.patch.object(DarkmonFilterUnseen, "return_results")

    DarkmonFilterUnseen.main()

    mock_return.assert_called_once()
    result = mock_return.call_args[0][0]
    assert len(result.get("NewAccounts", [])) == 1
    assert result["NewAccounts"][0]["id"] == "xyz789"