id: Darkmon - Enrich Domain
version: -1
name: Darkmon - Enrich Domain
description: Sub-playbook that calls the Darkmon !domain command and returns DBotScore + Common.Domain for the input Domain indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
fromversion: 6.8.0
marketplaces:
- xsoar
- platform
starttaskid: '0'
tasks:
  '0':
    id: '0'
    taskid: 58c433f6-9f8c-4c59-85e4-649d492159ef
    type: start
    task:
      id: 58c433f6-9f8c-4c59-85e4-649d492159ef
      version: -1
      name: ''
      description: ''
      iscommand: false
      brand: ''
    nexttasks:
      '#none#':
      - '100'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 50}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '1':
    id: '1'
    taskid: ef80b616-1b04-4184-8b45-91b4f63df51e
    type: regular
    task:
      id: ef80b616-1b04-4184-8b45-91b4f63df51e
      version: -1
      name: Run Darkmon domain lookup
      description: Calls the Darkmon !domain reputation command to enrich the Domain.
      script: Darkmon|||domain
      type: regular
      iscommand: true
      brand: Darkmon
    nexttasks:
      '#none#':
      - '2'
    scriptarguments:
      domain:
        complex:
          root: inputs.Domain
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '2':
    id: '2'
    taskid: ecb5ddbd-8aec-40ac-85d1-ca61f892a561
    type: title
    task:
      id: ecb5ddbd-8aec-40ac-85d1-ca61f892a561
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 770}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
  '100':
    id: '100'
    taskid: e21c0719-eddc-4915-9fc1-3d6bae425e55
    type: condition
    task:
      id: e21c0719-eddc-4915-9fc1-3d6bae425e55
      version: -1
      name: Is Darkmon integration available?
      description: Skips the playbook gracefully if the Darkmon integration is not configured in this tenant. Calls the built-in IsIntegrationAvailable script with brandname=Darkmon.
      scriptName: IsIntegrationAvailable
      type: condition
      iscommand: false
      brand: ''
    scriptarguments:
      brandname:
        simple: Darkmon
    results:
    - brandInstances
    nexttasks:
      'yes':
      - '1'
      '#default#':
      - '101'
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": 50, "y": 290}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: true
    quietmode: 0
  '101':
    id: '101'
    taskid: fb102262-922c-4a60-8a90-225004f04f81
    type: title
    task:
      id: fb102262-922c-4a60-8a90-225004f04f81
      version: -1
      name: Done
      description: ''
      type: title
      iscommand: false
      brand: ''
    separatecontext: false
    continueonerrortype: ''
    view: '{"position": {"x": -450, "y": 530}}'
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: '{"linkLabelsPosition": {"100_1_yes": 0.1, "100_101_#default#": 0.5}, "paper": {"dimensions": {"height": 935, "width": 980, "x": -500, "y": 0}}}'
inputs:
- key: Domain
  value:
    complex:
      root: Domain
      accessor: Name
  required: true
  description: The Domain indicator value to enrich. Defaults to ${Domain.Name}.
  playbookInputQuery:
outputs:
- contextPath: DBotScore.Indicator
  description: The indicator value.
  type: string
- contextPath: DBotScore.Type
  description: The indicator type.
  type: string
- contextPath: DBotScore.Vendor
  description: The vendor reporting the score (Darkmon).
  type: string
- contextPath: DBotScore.Score
  description: The reputation score (0=Unknown, 1=Good, 2=Suspicious, 3=Bad).
  type: number
- contextPath: DBotScore.Reliability
  description: Source reliability per the Admiralty code.
  type: string
- contextPath: Domain.Name
  description: The Domain value.
  type: string
- contextPath: Domain.Malicious.Vendor
  description: The vendor that flagged this Domain as malicious (Darkmon).
  type: string
- contextPath: Domain.Malicious.Description
  description: Reason this Domain was flagged as malicious.
  type: string
- contextPath: Darkmon.SearchResult
  description: Full search result records returned by Darkmon for this indicator.
  type: unknown
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security