DarkmonLevenshtein

Computes the minimum Levenshtein edit distance between a domain's root label and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to flag typosquatting candidates.

python · Darkmon

Details

ID	`DarkmonLevenshtein`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon transformer

README

Computes the minimum Levenshtein edit distance between a domain’s root label
and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to
flag typosquatting candidates.

Script Data

Name	Description
Script Type	python3
Tags	darkmon, transformer
Cortex XSOAR Version	6.5.0

Used In

This script is used in the following playbooks and scripts.

DarkmonScoreNRDs

Inputs

Argument Name	Description
domain	The domain to compare (only the root label is used).
brands	Comma-separated brand names to compare against.

Outputs

Path	Description	Type
Darkmon.Levenshtein.domain	The input domain (lowercased).	String
Darkmon.Levenshtein.brand	The brand with the smallest distance to the domain root.	String
Darkmon.Levenshtein.distance	The minimum Levenshtein distance found.	Number

Source

DarkmonLevenshtein.py DarkmonLevenshtein_test.py DarkmonLevenshtein.yml

Download History Raw

commonfields:
  id: DarkmonLevenshtein
  version: -1
name: DarkmonLevenshtein
script: ""
type: python
subtype: python3
fromversion: 6.8.0
tags:
- darkmon
- transformer
comment: |-
  Computes the minimum Levenshtein edit distance between a domain's root label
  and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to
  flag typosquatting candidates.
args:
- name: domain
  required: true
  description: The domain to compare (only the root label is used).
- name: brands
  required: true
  isArray: true
  description: Comma-separated brand names to compare against.
outputs:
- contextPath: Darkmon.Levenshtein.domain
  description: The input domain (lowercased).
  type: String
- contextPath: Darkmon.Levenshtein.brand
  description: The brand with the smallest distance to the domain root.
  type: String
- contextPath: Darkmon.Levenshtein.distance
  description: The minimum Levenshtein distance found.
  type: Number
scripttarget: 0
runonce: false
dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- xsoar
- platform
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security