DarkmonVIPFanOut

Details

ID	`DarkmonVIPFanOut`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon

README

For each protected email, calls dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries, creates incidents.

Script Data

Name	Description
Script Type	python3
Tags	darkmon
Cortex XSOAR Version	6.5.0

Dependencies

This script uses the following commands and scripts.

Darkmon
dmontip-get-boardemails

Used In

This script is used in the following playbooks and scripts.

Darkmon - VIP Email Monitor

Inputs

Argument Name	Description
items	Items to process.
id_field	Field name to use as the dedup key.
seen_list	Name of the XSOAR List storing already-seen IDs.
domain_filter_list	Optional - list of customer domains to filter username matches.
domain_match_field	Field on each item to match against domain_filter_list.
allowlist	Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field	Field to match against the allowlist.
incident_type	Incident type for newly created incidents.
severity	Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template	Incident name template (supports ${field} interpolation).
field_map	Comma-separated ‘fieldCli=sourcePath’ pairs.
emails	Email addresses to fan out per VIP fetch.
domains
brands_list
max_distance
min_cvss
tech_stack_list

Outputs

Path	Description	Type
NewAccounts		unknown
CreatedIncidents		unknown
Count		number
Typosquats		unknown
FilteredCVEs		unknown
VIPCreated		number

Source

DarkmonVIPFanOut.py DarkmonVIPFanOut_test.py DarkmonVIPFanOut.yml

Download History Raw

commonfields:
  id: DarkmonVIPFanOut
  version: -1
name: DarkmonVIPFanOut
script: ""
type: python
subtype: python3
fromversion: 6.8.0
tags:
- darkmon
comment: "For each protected email, calls dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries, creates incidents."
args:
- name: items
  isArray: true
  description: Items to process.
- name: id_field
  description: Field name to use as the dedup key.
  defaultValue: id
- name: seen_list
  description: Name of the XSOAR List storing already-seen IDs.
- name: domain_filter_list
  description: Optional - list of customer domains to filter username matches.
- name: domain_match_field
  description: Field on each item to match against domain_filter_list.
  defaultValue: username
- name: allowlist
  description: Optional list of usernames/DNs that must NEVER be actioned.
- name: allowlist_match_field
  description: Field to match against the allowlist.
  defaultValue: username
- name: incident_type
  description: Incident type for newly created incidents.
- name: severity
  description: Severity (1=Low, 2=Medium, 3=High, 4=Critical).
- name: name_template
  description: Incident name template (supports ${field} interpolation).
- name: field_map
  description: Comma-separated 'fieldCli=sourcePath' pairs.
- name: emails
  isArray: true
  description: Email addresses to fan out per VIP fetch.
- name: domains
  isArray: true
  description: Optional list of customer domains to filter domain-based matches.
- name: brands_list
  description: Name of the XSOAR List containing brand names for NRD brand-watch matching.
- name: max_distance
  defaultValue: "2"
  description: Maximum Levenshtein distance allowed when matching NRD domains against brand names.
- name: min_cvss
  defaultValue: "9.0"
  description: Minimum CVSS score threshold; CVEs below this value are excluded.
- name: tech_stack_list
  description: Name of the XSOAR List containing tech-stack tags used to filter CVEs by relevance.
outputs:
- contextPath: NewAccounts
  description: Newly discovered account records that have not been previously actioned.
  type: unknown
- contextPath: CreatedIncidents
  description: Incidents created during this execution run.
  type: unknown
- contextPath: Count
  description: Total count of new items processed.
  type: number
- contextPath: Typosquats
  description: NRD domains identified as potential typosquats of monitored brand names.
  type: unknown
- contextPath: FilteredCVEs
  description: CVEs that passed the CVSS and tech-stack filters.
  type: unknown
- contextPath: VIPCreated
  description: Number of VIP-related incidents created during this execution.
  type: number
scripttarget: 0
runonce: false
dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- xsoar
- platform
tests:
- No tests