commonfields:
  id: DarkmonLevenshtein
  version: -1
name: DarkmonLevenshtein
script: ""
type: python
subtype: python3
fromversion: 6.8.0
tags:
- darkmon
- transformer
comment: |-
  Computes the minimum Levenshtein edit distance between a domain's root label
  and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to
  flag typosquatting candidates.
args:
- name: domain
  required: true
  description: The domain to compare (only the root label is used).
- name: brands
  required: true
  isArray: true
  description: Comma-separated brand names to compare against.
outputs:
- contextPath: Darkmon.Levenshtein.domain
  description: The input domain (lowercased).
  type: String
- contextPath: Darkmon.Levenshtein.brand
  description: The brand with the smallest distance to the domain root.
  type: String
- contextPath: Darkmon.Levenshtein.distance
  description: The minimum Levenshtein distance found.
  type: Number
scripttarget: 0
runonce: false
dockerimage: demisto/python3:3.12.13.10116658
marketplaces:
- xsoar
- platform
tests:
- No tests
supportedModules:
- cloud_posture
- cloud
- cloud_runtime_security
- edr
- asm
- tim
- cloud_appsec
- xsiam
- exposure_management
- agentix
- email_security