DarkmonVIPFanOut

For each protected email, calls dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries, creates incidents.

python · Darkmon

Details

ID	`DarkmonVIPFanOut`
Language	python
From Version	6.8.0
Docker Image	`demisto/python3:3.12.13.10116658`
Tags	darkmon

README

For each protected email, calls dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries, creates incidents.

Script Data

Name	Description
Script Type	python3
Tags	darkmon
Cortex XSOAR Version	6.5.0

Dependencies

This script uses the following commands and scripts.

Darkmon
dmontip-get-boardemails

Used In

This script is used in the following playbooks and scripts.

Darkmon - VIP Email Monitor

Inputs

Argument Name	Description
items	Items to process.
id_field	Field name to use as the dedup key.
seen_list	Name of the XSOAR List storing already-seen IDs.
domain_filter_list	Optional - list of customer domains to filter username matches.
domain_match_field	Field on each item to match against domain_filter_list.
allowlist	Optional list of usernames/DNs that must NEVER be actioned.
allowlist_match_field	Field to match against the allowlist.
incident_type	Incident type for newly created incidents.
severity	Severity (1=Low, 2=Medium, 3=High, 4=Critical).
name_template	Incident name template (supports ${field} interpolation).
field_map	Comma-separated ‘fieldCli=sourcePath’ pairs.
emails	Email addresses to fan out per VIP fetch.
domains
brands_list
max_distance
min_cvss
tech_stack_list

Outputs

Path	Description	Type
NewAccounts		unknown
CreatedIncidents		unknown
Count		number
Typosquats		unknown
FilteredCVEs		unknown
VIPCreated		number

Source

DarkmonVIPFanOut.py DarkmonVIPFanOut_test.py DarkmonVIPFanOut.yml

Download History Raw

import DarkmonVIPFanOut
import demistomock as demisto  # noqa: F401


def test_main_no_emails(mocker):
    """
    Given:
        - No protected emails passed to the script

    When:
        - main() is called with an empty emails list

    Then:
        - return_results is called with zero VIPCreated
    """
    mocker.patch.object(
        demisto,
        "args",
        return_value={
            "emails": [],
            "seen_list": "test-list",
            "incident_type": "Darkmon VIP Alert",
            "name_template": "VIP: ${email}",
            "severity": "3",
        },
    )
    mocker.patch.object(demisto, "executeCommand", return_value=[{"Contents": "", "Type": 1}])
    mock_return = mocker.patch.object(DarkmonVIPFanOut, "return_results")

    DarkmonVIPFanOut.main()

    mock_return.assert_called_once()
    result = mock_return.call_args[0][0]
    assert result.get("VIPCreated") == 0 or result.get("VIPCreated") is not None