Details
Content
Dependencies
Version History

Stay ahead of cyber threats with Darkmon TIP - real-time threat intelligence from the Clear, Deep, and Dark Web tailored to your assets. The pack provides indicator enrichment, compromised-credentials monitoring, board-level VIP email protection, ransomware mention tracking, brand-targeting NRD detection, and critical CVE pipelines, plus provider-agnostic incident response playbooks ready to plug into any SOC stack.

Darkmon Threat Intelligence Pack

Stay ahead of cyber threats with Darkmon TIP - real-time threat intelligence
from the Clear, Deep, and Dark Web, tailored to your assets and operationalized
inside Cortex XSOAR.

What's in the box

This is an end-to-end content pack, not just an integration. It ships
everything a SOC team needs to put Darkmon intelligence into action.

Integration

Darkmon - 18 commands covering indicator enrichment, IOC feed ingestion
(TIM), compromised data discovery, board-level VIP email protection,
ransomware tracking, newly-registered-domain monitoring, vulnerability
intelligence, and a fully dynamic global search.

Indicator enrichment (sub-playbooks)

Darkmon - Enrich IP
Darkmon - Enrich Domain
Darkmon - Enrich URL
Darkmon - Enrich File Hash
Darkmon - Enrich Email

These are wired into XSOAR's reputation system via DBotScore + Common.<Type>
contracts so they slot into any existing playbook with no rewrites.

Continuous monitoring

Darkmon - Compromised Credentials Sweep (every 4h)
Darkmon - VIP Email Monitor (hourly)
Darkmon - Ransomware Mentions Watch (every 6h)
Darkmon - Brand-Targeted NRD Watch (daily)
Darkmon - Critical CVE Pipeline (daily)

Each ships with its own incident type, layout, dedup pre-process rule, and a
List of tunables (customer domains, brand names, tech stack, severity rules)
so multi-tenant deployments customize without forking.

Incident response

Darkmon - Phishing Email Triage
Darkmon - Compromised Account Response
Darkmon - EDR Alert Enrichment
Darkmon - Ransomware Victim Response
Darkmon - Email Deep Dive

These response playbooks call provider-agnostic switchboard sub-playbooks so
they work whatever your stack looks like.

Provider-agnostic adapters (Tier 4)

Darkmon - Generic Notify (Slack | Teams | Email | ServiceNow | Jira)
Darkmon - Generic Block Indicator (Palo Alto NGFW | Fortinet | Cisco
Umbrella | CloudFlare)
Darkmon - Generic User Action (suspend, force password reset on
Active Directory | Okta | Azure AD)

Quick start

Install this pack from the Cortex Marketplace.
Open Settings → Integrations → Darkmon and click Add instance.
Paste your Darkmon API key. Leave API Base URL at the default unless
instructed otherwise.
Click the Test button on the instance configuration page. Expect "Success".

For full configuration, command examples, and playbook docs, see the
per-artifact READMEs under each subfolder.

Compliance posture

The pack defaults to GDPR-strict + secrets redaction. Passwords, card
numbers, and SSNs never appear in War Room markdown unless the integration's
redact_secrets toggle is explicitly set to false. Raw values remain
available to playbooks via rawJSON so automation isn't blocked.

Support

This pack is maintained by Darkmon as a developer-supported pack.
Visit darkmon.com or contact support@darkmon.com.

Versioning

Semantic versioning. See ReleaseNotes/ for change history.

Pack Contributors:

Darkmon

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Darkmon Threat Intelligence Pack

Stay ahead of cyber threats with Darkmon TIP - real-time threat intelligence
from the Clear, Deep, and Dark Web, tailored to your assets and operationalized
inside Cortex.

What's in the box

This is an end-to-end content pack, not just an integration. It ships
everything a SOC team needs to put Darkmon intelligence into action.

Integration

Darkmon - 18 commands covering indicator enrichment, IOC feed ingestion
(TIM), compromised data discovery, board-level VIP email protection,
ransomware tracking, newly-registered-domain monitoring, vulnerability
intelligence, and a fully dynamic global search.

Indicator enrichment (sub-playbooks)

Darkmon - Enrich IP
Darkmon - Enrich Domain
Darkmon - Enrich URL
Darkmon - Enrich File Hash
Darkmon - Enrich Email

These are wired into XSOAR's reputation system via DBotScore + Common.<Type>
contracts so they slot into any existing playbook with no rewrites.

Continuous monitoring

Darkmon - Compromised Credentials Sweep (every 4h)
Darkmon - VIP Email Monitor (hourly)
Darkmon - Ransomware Mentions Watch (every 6h)
Darkmon - Brand-Targeted NRD Watch (daily)
Darkmon - Critical CVE Pipeline (daily)

Incident response

Darkmon - Phishing Email Triage
Darkmon - Compromised Account Response
Darkmon - EDR Alert Enrichment
Darkmon - Ransomware Victim Response
Darkmon - Email Deep Dive

These response playbooks call provider-agnostic switchboard sub-playbooks so
they work whatever your stack looks like.

Provider-agnostic adapters (Tier 4)

Darkmon - Generic Notify (Slack | Teams | Email | ServiceNow | Jira)
Darkmon - Generic Block Indicator (Palo Alto NGFW | Fortinet | Cisco
Umbrella | CloudFlare)
Darkmon - Generic User Action (suspend, force password reset on
Active Directory | Okta | Azure AD)

Quick start

Install this pack from the Cortex Marketplace.
Open Settings → Integrations → Darkmon and click Add instance.
Paste your Darkmon API key. Leave API Base URL at the default unless
instructed otherwise.
Click the Test button on the instance configuration page. Expect "Success".

For full configuration, command examples, and playbook docs, see the
per-artifact READMEs under each subfolder.

Compliance posture

Support

This pack is maintained by Darkmon as a developer-supported pack.
Visit darkmon.com or contact support@darkmon.com.

Versioning

Semantic versioning. See ReleaseNotes/ for change history.

Pack Contributors:

Darkmon

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
DarkmonFilterCVEs	Filters CVEs by CVSS minimum and intersection with a tech-stack tag list.
DarkmonCreateIncidents	Creates one XSOAR incident per item using a name_template and field_map (comma-separated 'field=path' pairs).
DarkmonFilterUnseen	Filters items by ID against an XSOAR List (state) and optionally by domain match or allowlist. Updates the List with new IDs. Outputs NewAccounts.
DarkmonScoreNRDs	For each NRD, calls DarkmonLevenshtein against the brands list and emits Typosquats with distance <= max_distance.
DarkmonLevenshtein	Computes the minimum Levenshtein edit distance between a domain's root label and a list of brand names. Used by Darkmon - Brand-Targeted NRD Watch to flag typosquatting candidates.
DarkmonVIPFanOut	For each protected email, calls dmontip-get-boardemails three times (accounts, combo-lists, public-breaches), filters new entries, creates incidents.

Classifiers

Name	Description
Darkmon - Feed Classifier	Routes raw Darkmon indicator records to the matching indicator type based on the type field returned by the Darkmon API.
Darkmon - Classifier	Routes raw Darkmon records to the matching Darkmon incident type based on the darkmon_kind field added by fetch_incidents() and by the DarkmonCreateIncidents script.
Darkmon - Incoming Mapper	Maps raw Darkmon record JSON to XSOAR incident fields. Routed per Darkmon incident type by the Darkmon - Classifier.
Darkmon - Feed Mapper	Maps raw Darkmon indicator JSON to XSOAR indicator fields per indicator type.

Incident Fields

Name	Description
Darkmon Brand	The protected brand the domain typosquats.
Darkmon CVE Severity	Severity label (critical, high, medium, low).
Darkmon First Compromise	First time this credential was observed compromised.
Darkmon URL	URL where the credential was used.
Darkmon Stealer	Stealer family that captured this credential.
Darkmon Distance	Levenshtein distance between the domain and the brand.
Darkmon Source	The source where the leak was observed.
Darkmon Protected Email	The board-protected email this leak references.
Darkmon Account ID	The Darkmon record ID for the leaked account.
Darkmon Threat Actor	Ransomware group claiming the attack.
Darkmon Leak Type	Category of leak (account, combo-list, public-breach).
Darkmon Screenshot URL	URL of the ransomware listing screenshot.
Darkmon Leak ID	The Darkmon record ID for the underlying leak.
Darkmon Observed Domain	The newly-registered domain that resembles the brand.
Darkmon Victim Name	Victim organisation name as reported by the threat actor.
Darkmon Password (Redacted)	The leaked password, replaced by '***' when redact_secrets is enabled.
Darkmon Action Taken	Action that was performed (disabled, reset, revoked, none).
Darkmon Registered At	When the domain was first registered (per Darkmon NRD feed).
Darkmon Last Compromise	Most recent observation of this credential being compromised.
Darkmon Published At	When the ransomware mention was first observed.
Darkmon Employee Email	The corporate email of the compromised employee.
Darkmon Directory User	Resolved directory username (sAMAccountName / UPN / login).
Darkmon Affected Components	Customer tech-stack tags that intersect this CVE.
Darkmon Username	The leaked username.

Incident Types

Name	Description
Darkmon Compromised Employee
Darkmon Ransomware Mention
Darkmon VIP Email Leak
Darkmon Compromised Credential
Darkmon Critical CVE
Darkmon Typosquatting Threat

Indicator Fields

Name	Description
Darkmon Classification	Darkmon's classification of the indicator (e.g. malicious, phishing, suspicious, clean).
Darkmon Compromise Sources	Sources where this indicator appeared in compromise data (stealer logs, breaches, dark forums).
Darkmon Last Compromise	Most recent date Darkmon observed this indicator in compromise data.
Darkmon Stealer Families	Stealer family names linked to this indicator (e.g. RedLine, Vidar, Raccoon).
Darkmon First Compromise	Earliest date Darkmon observed this indicator in compromise data.

Integrations

Name	Description
Darkmon Feed (Developer Contribution)	Darkmon TIP indicator feed for Cortex XSOAR. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the XSOAR TIM module. Pair with the Darkmon integration for incident fetching and automation commands.
Darkmon (Developer Contribution)	Stay ahead of cyber threats with Darkmon TIP - real-time threat intelligence from the Clear, Deep, and Dark Web tailored to your assets. Pack also helps with integration with Cortex XSOAR and provides pre-made playbooks/templates to ease integration use.

Job

Name	Description
Darkmon - VIP Email Monitor
Darkmon - Ransomware Mentions Watch
Darkmon - Brand-Targeted NRD Watch
Darkmon - Compromised Credentials Sweep
Darkmon - Critical CVE Pipeline
Darkmon - Compromised Employee Auto-Disable

Layouts

Name	Description
Darkmon Compromised Credential	Layout for Darkmon Compromised Credential incidents.
Darkmon Ransomware Mention	Layout for Darkmon Ransomware Mention incidents.
Darkmon VIP Email Leak	Layout for Darkmon VIP Email Leak incidents.
Darkmon Critical CVE	Layout for Darkmon Critical CVE incidents.
Darkmon Typosquatting Threat	Layout for Darkmon Typosquatting Threat incidents.
Darkmon Domain	Layout for Darkmon-enriched Domain indicators. Adds a Darkmon tab with classification and compromise context.
Darkmon Email	Layout for Darkmon-enriched Email indicators. Adds a Darkmon tab with classification and compromise context.
Darkmon URL	Layout for Darkmon-enriched URL indicators. Adds a Darkmon tab with classification and compromise context.
Darkmon Account	Layout for Darkmon-enriched Account indicators. Adds a Darkmon tab with compromise sources, first/last compromise, and stealer families.
Darkmon File	Layout for Darkmon-enriched File indicators. Adds a Darkmon tab with classification and compromise context.
Darkmon Compromised Employee	Layout for Darkmon Compromised Employee incidents.
Darkmon IP	Layout for Darkmon-enriched IP indicators. Adds a Darkmon tab with classification and compromise context.

Lists

Name	Description
Darkmon - Brand Names	One brand per line (e.g. acme, acmeproducts). The NRD Brand Watch flags any newly-registered domain whose Levenshtein distance to a brand is at most the configured threshold (default 2).
Darkmon - Seen CVEs	State store: CVE IDs already actioned.
Darkmon - Tech Stack Tags	Customer technology tags, one per line (e.g. nginx, openssl, apache). The Critical CVE Pipeline filters CVEs to those whose tags intersect this list.
Darkmon - Seen Compromised Employees	State store: employee account IDs already actioned.
Darkmon - Seen Ransomware Mentions	State store: ransomware mention IDs already actioned.
Darkmon - Notification Provider	Single-value list with the configured notification target. One of: slack, teams, email, servicenow, jira. Read by the Generic Notify sub-playbook.
Darkmon - Umbrella Block List ID	Single-value list - the Cisco Umbrella destination-list ID to append to. Required only when 'Darkmon - Block Provider' is set to 'umbrella'.
Darkmon - Seen Compromised Accounts	State store: account IDs already opened as incidents. The Compromised Credentials Sweep appends to this list and uses it to suppress duplicates.
Darkmon - Seen VIP Leaks	State store: composite '<email>::<leak_type>::<leak_id>' entries already actioned.
Darkmon - Identity Provider	Single-value list with the configured directory provider. One of: ad, okta, azuread. Read by the Generic User Action sub-playbook.
Darkmon - Auto-Disable Allowlist	Comma-separated usernames or DNs that must NEVER be auto-disabled (e.g. ceo@acme.com, svc-monitor). Override for the Compromised Employee Auto-Disable playbook.
Darkmon - Customer Domains	Comma-separated customer email/web domains (e.g. acme.com,acme.co.uk). The Compromised Credentials Sweep filters Darkmon results to usernames matching any of these domains.
Darkmon - Block Provider	Single-value list with the configured block target. One of: panos, fortinet, umbrella, cloudflare. Read by Darkmon - Generic Block Indicator.
Darkmon - Seen NRDs	State store: NRD IDs already evaluated.

Playbooks

Name	Description
Darkmon - Email Deep Dive	Analyst-driven full Darkmon profile for a single email address. Runs board-protection check, all three boardemails categories, and global search. Outputs a unified summary into the incident War Room.
Darkmon - Compromised Credentials Sweep	Polls Darkmon for compromised credentials, filters to the customer's email/web domains, dedupes via state list, and creates a 'Darkmon Compromised Credential' incident per new account. Triggered on a 4-hour Job.
Darkmon - Enrich IP	Sub-playbook that calls the Darkmon !ip command and returns DBotScore + Common.IP for the input IP indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
Darkmon - Generic User Action	Provider-agnostic user-action dispatcher (disable, reset password, revoke sessions). Reads "Darkmon - Identity Provider" List for the configured directory (ad \| okta \| azuread) and routes to the matching command.
Darkmon - Enrich URL	Sub-playbook that calls the Darkmon !url command and returns DBotScore + Common.URL for the input URL indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
Darkmon - Enrich Domain	Sub-playbook that calls the Darkmon !domain command and returns DBotScore + Common.Domain for the input Domain indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
Darkmon - Ransomware Mentions Watch	Every 6 hours, polls ransomware mentions for the customer organisation. New entries open a critical 'Darkmon Ransomware Mention' incident and notify the CISO via Generic Notify.
Darkmon - Block IOC	Analyst-facing wrapper around Darkmon - Generic Block Indicator. Lets analysts paste an IOC into a War Room form and trigger a provider-routed block action.
Darkmon - Brand-Targeted NRD Watch	Daily sweep of newly-registered domains. Each candidate's root label is compared against the brand list via DarkmonLevenshtein; matches with distance <= 2 (configurable) open a 'Darkmon Typosquatting Threat' incident.
Darkmon - Phishing Email Triage	Extracts URLs/IPs/file-hashes from a reported phishing email, enriches each via the Darkmon - Enrich * sub-playbooks, and if any indicator is scored Bad (DBotScore=3) calls Generic Block Indicator on it. Notifies the reporter and the SOC at the end.
Darkmon - Compromised Employee Auto-Disable	Hourly poll of compromised employees. For each new entry, looks up the user in the configured directory and acts per the DisableMode playbook input: notify-only : creates incident and notifies; no AD action. [DEFAULT] approval-required : creates incident, blocks on a manual approval task, then disables on approve. auto-disable : disables the account immediately, then notifies. Accounts in the 'Darkmon - Auto-Disable Allowlist' list are NEVER auto-disabled.
Darkmon - Enrich File	Sub-playbook that calls the Darkmon !file command and returns DBotScore + Common.File for the input File indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.
Darkmon - VIP Email Monitor	Hourly poll of board-protected emails. For each protected email, checks accounts/combo-lists/public-breaches and opens a 'Darkmon VIP Email Leak' incident per new entry.
Darkmon - Generic Block Indicator	Provider-agnostic indicator-block dispatcher. Reads the 'Darkmon - Block Provider' List for the configured block target (panos \| fortinet \| umbrella \| cloudflare) and routes to the matching command. Falls back to logging the block intent in the War Room when no provider is configured.
Darkmon - Ransomware Victim Response	Triggered when our company surfaces in a Darkmon ransomware mention. Verifies the match, opens a war-room channel via Generic Notify, pages the CISO, and prints next-step guidance for the customer's IR runbook.
Darkmon - Compromised Account Response	Incident-type playbook for 'Darkmon Compromised Credential' (and similar). Identifies the user via the configured directory, suspends, forces a password reset, revokes active sessions, and notifies SOC + the user.
Darkmon - EDR Alert Enrichment	Designed to be invoked from CrowdStrike / SentinelOne / Defender alert playbooks. Takes the alert's IOCs, enriches each via Darkmon, and if any are scored Bad, escalates incident severity and notifies the SOC. Endpoint containment is left to the EDR-specific playbook.
Darkmon - Critical CVE Pipeline	Daily filter of new CVEs (CVSS >= 9) against the customer's tech-stack tags. Matches open a 'Darkmon Critical CVE' incident per match and ticket via Generic Notify.
Darkmon - Generic Notify	Provider-agnostic notification dispatcher. Reads "Darkmon - Notification Provider" List for the configured target (slack \| teams \| email \| servicenow \| jira) and routes to the matching command.
Darkmon - Enrich Email	Sub-playbook that calls the Darkmon !email command and returns DBotScore + Common.Account.Email for the input Email indicator. Designed to be invoked from a parent playbook; does not auto-run on indicator creation.

Integrations

Name	Description
Darkmon (Developer Contribution)	Stay ahead of cyber threats with Darkmon TIP - real-time threat intelligence from the Clear, Deep, and Dark Web tailored to your assets. Pack also helps with integration with Cortex and provides pre-made playbooks/templates to ease integration use.
Darkmon Feed (Developer Contribution)	Darkmon TIP indicator feed for Cortex. Pulls IPs, URLs, domains, file hashes, emails, and accounts from the Darkmon Threat Intel firehose into the XSOAR TIM module. Pair with the Darkmon integration for incident fetching and automation commands.

Lists

Name	Description
Darkmon - Umbrella Block List ID	Single-value list - the Cisco Umbrella destination-list ID to append to. Required only when 'Darkmon - Block Provider' is set to 'umbrella'.
Darkmon - Seen Ransomware Mentions	State store: ransomware mention IDs already actioned.
Darkmon - Block Provider	Single-value list with the configured block target. One of: panos, fortinet, umbrella, cloudflare. Read by Darkmon - Generic Block Indicator.
Darkmon - Seen Compromised Accounts	State store: account IDs already opened as incidents. The Compromised Credentials Sweep appends to this list and uses it to suppress duplicates.
Darkmon - Seen NRDs	State store: NRD IDs already evaluated.
Darkmon - Seen Compromised Employees	State store: employee account IDs already actioned.
Darkmon - Tech Stack Tags	Customer technology tags, one per line (e.g. nginx, openssl, apache). The Critical CVE Pipeline filters CVEs to those whose tags intersect this list.
Darkmon - Customer Domains	Comma-separated customer email/web domains (e.g. acme.com,acme.co.uk). The Compromised Credentials Sweep filters Darkmon results to usernames matching any of these domains.
Darkmon - Identity Provider	Single-value list with the configured directory provider. One of: ad, okta, azuread. Read by the Generic User Action sub-playbook.
Darkmon - Brand Names	One brand per line (e.g. acme, acmeproducts). The NRD Brand Watch flags any newly-registered domain whose Levenshtein distance to a brand is at most the configured threshold (default 2).
Darkmon - Seen VIP Leaks	State store: composite '<email>::<leak_type>::<leak_id>' entries already actioned.
Darkmon - Seen CVEs	State store: CVE IDs already actioned.
Darkmon - Notification Provider	Single-value list with the configured notification target. One of: slack, teams, email, servicenow, jira. Read by the Generic Notify sub-playbook.
Darkmon - Auto-Disable Allowlist	Comma-separated usernames or DNs that must NEVER be auto-disabled (e.g. ceo@acme.com, svc-monitor). Override for the Compromised Employee Auto-Disable playbook.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR

Optional Content Packs (8)

Pack Name	Pack By
Active Directory Query	By: Cortex XSOAR
FortiGate	By: Cortex XSOAR
Atlassian Jira	By: Cortex XSOAR
Microsoft Graph User	By: Cortex XSOAR
Okta	By: Cortex XSOAR
OrionMalware	By: Airbus
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

All level dependencies (8)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Base	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Supported By	Developer
Created	June 18, 2026
Last Release	June 18, 2026

Threat Intelligence Management

Phishing

Ransomware

Vulnerability Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.