phishing_investigate_and_respond.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Samples",
    "misc": { "apps_list": ["VirusTotal", "DomainTools", "WHOIS", "MaxMind", "OpenDNS Investigate", "Carbon Black Response", "WildFire", "LDAP", "iSight Partners", "Screenshot Machine", "Threat Grid", "DNS"] },
    "coa": {
        "data": {
            "clean": true,
            "code_block": "\"\"\"\nThis playbook is deigned to perform the investigative steps necessary to investigate a potential Phishing attempt. It will process File attachments, IPs, domains,  and URLs. If there is a positive, the Admin user group on Phantom will have 6 hours to respond to the prompt in order to have the email deleted from the exchange server.\n\"\"\"\n\ndef test_params(container, datapath, key_name):\n    params = []\n    items = set(phantom.collect(container, datapath, scope='all'))\n    for item in items:\n        params.append({key_name:item}) \n    return params",
            "description": "This playbook investigates and remediates phishing emails with Admin approval.",
            "hash": "56874fe28baf205528160233ce1baea9c09a6950",
            "joint": {
                "cells": [
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ce44fff4-b819-466b-8753-b3f5a876f54f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "23059f38-2a33-4650-82b1-f7a2dadd3507",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 22
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "737975da-65b8-4fa5-b77b-bf09aebfb02b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "d4fc2a1c-c23b-4b9a-8b57-5a61fd7e0b97",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 70
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f055ffed-d172-4522-9dd0-9c92abeb8ff8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "77d8ce2c-70b2-4079-ab58-2dcc0e9de1f4",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 99
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d2bea40a-cc5e-44ef-87ee-d0333237f405",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6fb61cc1-02e4-459c-b207-cde18af43ea7",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 164
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8f78ccbb-de30-4b4a-97fd-3f281506009e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "13d2dbeb-d067-4726-a735-6b2a1a2f2997",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 193
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7767d776-c3fa-430d-9a1f-5fac9602aff2",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ff093ff3-4757-4d50-aadd-e2bf0302492e",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 203
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e69bc0e9-e532-4bfc-8f5f-9ed297851d0d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "4b113e34-7244-41c8-9b2c-1a912d42a710",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 244
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "71a3a192-bf3d-4b3b-b4d6-ef6bd6d8abd7",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "23059f38-2a33-4650-82b1-f7a2dadd3507",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "64ea3268-666a-45af-8d42-f9929aff7941",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 345
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "95d4d2d3-5d41-4d42-84e5-8a29c1dd8f44",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "64ea3268-666a-45af-8d42-f9929aff7941",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "59bc3d6d-a78a-4ee8-a3b0-b5447f50c50a",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 409
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "5cbb5137-ae3f-4774-8d35-8551d40b9038",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "59bc3d6d-a78a-4ee8-a3b0-b5447f50c50a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "16627a55-3d8f-4fdd-8801-4569ed4cceb2",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 451
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d16408c2-1bf5-4613-a986-c838774dfbd0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "16627a55-3d8f-4fdd-8801-4569ed4cceb2",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "05fc4563-b46c-43f6-8f0c-5f2ccf3cdccb",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 463
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "814155ab-aae0-4bbf-a6f6-0b41424b9fcd",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ded77a91-c99f-41b9-8ddc-ac70d8489ce7",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "97d32384-9ca1-40fe-b4b6-afd4024e08a6",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 695
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7363fb53-078a-4fd5-8764-a7d667b9ded2",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "97d32384-9ca1-40fe-b4b6-afd4024e08a6",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "59bc3d6d-a78a-4ee8-a3b0-b5447f50c50a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 731
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "bd267e1d-d410-4006-a5cc-8ab45fe926a8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d4fc2a1c-c23b-4b9a-8b57-5a61fd7e0b97",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c27da6f5-9a5f-4f67-8904-d033ea6084f1",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 879
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d51589a6-e098-4f65-8e66-8a9a06115f1b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "77d8ce2c-70b2-4079-ab58-2dcc0e9de1f4",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ee4ed44f-ec9c-4fbc-a6e3-3cf5d368c600",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 937
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "68051e0a-b3d1-48eb-b5ee-e9e66cf1b06f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c77a71d5-4888-4395-9615-e4129ff4afe4",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "9a6196f9-4997-4ab3-bb59-d7cfbad1165e",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1107
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "01e550b6-0764-4fbf-bbe8-5ff77bf98cf8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6fb61cc1-02e4-459c-b207-cde18af43ea7",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f354576b-53b1-4d04-b99e-7040e7f6e97c",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1425
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "74574837-b471-4d75-a887-918ce916d4c8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "4b113e34-7244-41c8-9b2c-1a912d42a710",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "d6adce13-8c78-4db5-bc59-835952340c83",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1808
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8b6d8215-476c-43f8-97e5-2d1ea7d68574",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0b6f00e5-37b5-46f9-8fc5-b5997a577697",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "04238772-5424-47f6-ba2a-c06759a8d0ee",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2754
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0475ba76-63ba-4dcd-8297-9ef4045c5be7",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "04238772-5424-47f6-ba2a-c06759a8d0ee",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "446431b4-4afa-4a35-b2d9-39cf10d63357",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2778
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "2caa5d5e-093a-4daf-8986-d76eb0c7eb0a",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9a6196f9-4997-4ab3-bb59-d7cfbad1165e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "7ac8409a-22b1-4166-a80b-44abc67b58c2",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3103
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "37036147-145f-4ea8-b274-c7ff955f94d6",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "7ac8409a-22b1-4166-a80b-44abc67b58c2",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "67b3634e-4975-4d85-bf65-66e476c39752",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3122
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "df66c3be-b568-4d24-8d4d-baf9e09ebc6f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "05fc4563-b46c-43f6-8f0c-5f2ccf3cdccb",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1540,
                                "y": 180
                            }
                        ],
                        "z": 3283
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7d3068af-4da8-431a-889f-bb5bbadb4351",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "67b3634e-4975-4d85-bf65-66e476c39752",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3383
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0eb76760-ab25-44cc-9b29-81e4507fa169",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "45bbe9e7-ed5e-4d30-b3a0-8efc89c476e0",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6cecf136-a654-4106-85a1-4f58c529097b",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 4168
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "4799871f-6e2b-43c2-9630-92b658998f66",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "446431b4-4afa-4a35-b2d9-39cf10d63357",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 5900
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7a0e6b83-1b49-4ab0-b91c-41145acee0c7",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "7233d7f5-1952-4905-8161-541cc6502691",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 5925
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all detals of actions \n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "delete email",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6cecf136-a654-4106-85a1-4f58c529097b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 761,
                        "line_start": 748,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 2100,
                            "y": 440
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 5937
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "6c90fe94-845f-4edb-9ec3-318e98ec310b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "7233d7f5-1952-4905-8161-541cc6502691",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "45bbe9e7-ed5e-4d30-b3a0-8efc89c476e0",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 5940
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8de85d8e-5dd3-427a-8893-b357f6c3c5c5",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "f354576b-53b1-4d04-b99e-7040e7f6e97c",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bb1ab4a8-d7a7-4dab-b5bc-323dbc137ec9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 6088
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "40e7c1aa-2fdf-470c-b2d0-47df6c9f4c91",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bb1ab4a8-d7a7-4dab-b5bc-323dbc137ec9",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0b6f00e5-37b5-46f9-8fc5-b5997a577697",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 6102
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "2533fe60-73c1-425f-8ec7-456c13ad4041",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d6adce13-8c78-4db5-bc59-835952340c83",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "91e24cdc-5717-49c1-9389-960606d5751c",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 6152
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "fae48569-ea43-4d94-816e-9a9489ec058b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "91e24cdc-5717-49c1-9389-960606d5751c",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1360,
                                "y": 880
                            }
                        ],
                        "z": 6214
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "daaac6cb-cfa2-4909-a392-b0777cafc537",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ee4ed44f-ec9c-4fbc-a6e3-3cf5d368c600",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "fe89567f-bdf1-4b7e-97c8-fa7c4c20736e",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 6291
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "76e62bab-91d1-42b0-91f7-0b578d9a5805",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "fe89567f-bdf1-4b7e-97c8-fa7c4c20736e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1260,
                                "y": 600
                            }
                        ],
                        "z": 6326
                    },
                    {
                        "action": "geolocate ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "maxmind",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.continent_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.country_iso_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.country_name",
                                        "data_type": "string",
                                        "map_info": "Country"
                                    },
                                    {
                                        "data_path": "action_result.data.*.latitude",
                                        "data_type": "numeric",
                                        "map_info": "latitude"
                                    },
                                    {
                                        "data_path": "action_result.data.*.longitude",
                                        "data_type": "numeric",
                                        "map_info": "longitude"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "map_info": "IP Address"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "map_info": "name"
                                    },
                                    {
                                        "data_path": "action_result.data.*.city_name",
                                        "data_type": "string",
                                        "map_info": "City"
                                    },
                                    {
                                        "data_path": "action_result.data.*.postal_code",
                                        "data_type": "string",
                                        "map_info": "Postal Code"
                                    },
                                    {
                                        "data_path": "action_result.data.*.as_org",
                                        "data_type": "string",
                                        "map_info": "Organization"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state_iso_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state_name",
                                        "data_type": "string",
                                        "map_info": "State/Province"
                                    },
                                    {
                                        "data_path": "action_result.data.*.time_zone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "geolocate ip"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def geolocate_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('geolocate_ip_1() called')\n\n    # collect data for 'geolocate_ip_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'geolocate_ip_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"geolocate ip\", parameters=parameters, assets=['maxmind'], callback=filter_10, name=\"geolocate_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "4b113e34-7244-41c8-9b2c-1a912d42a710",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 180,
                        "line_start": 159,
                        "message": "Configuring now",
                        "name": "geolocate ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 840
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "geolocate_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6699
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 8
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_8(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_8() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation_1:action_result.summary.detected_urls\", \">=\", \"1\"],\n        ],\n        name=\"filter_8:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        filter_13(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "f354576b-53b1-4d04-b99e-7040e7f6e97c",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 257,
                        "line_start": 239,
                        "name": "filter",
                        "notes": "",
                        "number": 8,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">=",
                                        "data_type": "",
                                        "param": "ip_reputation_1:action_result.summary.detected_urls",
                                        "value": "1"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 420,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_8",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6726
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 5
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_5() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"domain_reputation_1:action_result.status\", \"==\", \"MALICIOUS\"],\n        ],\n        name=\"filter_5:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        filter_15(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "domain reputation 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ee4ed44f-ec9c-4fbc-a6e3-3cf5d368c600",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 275,
                        "line_start": 257,
                        "name": "filter",
                        "notes": "",
                        "number": 5,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "domain_reputation_1:action_result.status",
                                        "value": "MALICIOUS"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 420,
                            "y": 560
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_5",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6742
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "56756795-8a31-4569-8694-bffb58dee1a1",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "64ea3268-666a-45af-8d42-f9929aff7941",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ded77a91-c99f-41b9-8ddc-ac70d8489ce7",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 6762
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f772537c-8af6-45d0-9b17-413724ea45d1",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c27da6f5-9a5f-4f67-8904-d033ea6084f1",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "67b3634e-4975-4d85-bf65-66e476c39752",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1020,
                                "y": 320
                            }
                        ],
                        "z": 6778
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "acc670e0-6e55-41cb-85ef-0477ae84e2ef",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c27da6f5-9a5f-4f67-8904-d033ea6084f1",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c77a71d5-4888-4395-9615-e4129ff4afe4",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 6783
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 13
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "xlink:href": "/inc/coa/img/block_icon_note_on.svg"
                            }
                        },
                        "block_code": "def filter_13(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_13() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation_1:action_result.parameter.ip\", \"==\", \"artifact:*.cef.destinationAddress\"],\n        ],\n        name=\"filter_13:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        lookup_ip_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bb1ab4a8-d7a7-4dab-b5bc-323dbc137ec9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 373,
                        "line_start": 355,
                        "name": "filter",
                        "notes": "Filter the artifact",
                        "number": 13,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "ip_reputation_1:action_result.parameter.ip",
                                        "value": "artifact:*.cef.destinationAddress"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 560,
                            "y": 700
                        },
                        "previous_function": "",
                        "previous_name": "filter_13",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6865
                    },
                    {
                        "action": "detonate file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "file_name": "",
                            "force_analysis": "",
                            "private": "",
                            "vault_id": "artifact:*.cef.deviceCustomString6",
                            "vm": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "file_name": "",
                                    "vault_id": "artifact:*.cef.deviceCustomString6"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "wildfire",
                                "output": [
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.parameter.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pe file",
                                            "pdf",
                                            "flash",
                                            "apk",
                                            "jar",
                                            "doc",
                                            "xls",
                                            "ppt"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_info.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_info.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_info.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_info.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_info.malware",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_info.filetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.malware",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.platform",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.software",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file path"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.malware",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.task",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image",
                                        "data_type": "string"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "sandbox"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "detonate file"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'detonate_file_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.deviceCustomString6', 'artifact:*.id'])\n    vault_items = phantom.Vault.get_file_info(container_id=container['id'])\n\n    parameters = []\n    \n    # build parameters list for 'detonate_file_1' call\n    for vault_item in vault_items:\n        if vault_item['vault_id']:\n            parameters.append({\n                'file_name': \"\",\n                'vault_id': vault_item['vault_id'],\n            })\n\n    if parameters:\n        phantom.act(\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_3, name=\"detonate_file_1\")    \n    else:\n        phantom.error(\"'detonate_file_1' will not be executed due to lack of parameters\")\n    \n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ded77a91-c99f-41b9-8ddc-ac70d8489ce7",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 436,
                        "line_start": 411,
                        "message": "Configuring now",
                        "name": "detonate file",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 560,
                            "y": 20
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "detonate_file_1",
                        "required_params": {
                            "vault_id": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6870
                    },
                    {
                        "action": "get system attributes",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "fields": "",
                            "hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "fields": "",
                                    "hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domainctrl1",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "DNS Hostname",
                                        "column_order": 1,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.dnshostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Distinguished Name",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.distinguishedname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Object Category",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.objectcategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Object Class",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.objectclass",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Object Guid",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.objectguid",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Country Code",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.countrycode",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Last Logoff",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.lastlogoff",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Last Logon",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.lastlogon",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Last Logon Timestamp",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.lastlogontimestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Local Policy Flags",
                                        "column_order": 10,
                                        "data_path": "action_result.data.*.localpolicyflags",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Logon Count",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.logoncount",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.netbootguid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.netbootmirrordatafile",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Object SID",
                                        "column_order": 14,
                                        "data_path": "action_result.data.*.objectsid",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "OS",
                                        "column_order": 15,
                                        "data_path": "action_result.data.*.operatingsystem",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Service Pack",
                                        "column_order": 16,
                                        "data_path": "action_result.data.*.operatingsystemservicepack",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "OS Version",
                                        "column_order": 17,
                                        "data_path": "action_result.data.*.operatingsystemversion",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Primary Group ID",
                                        "column_order": 18,
                                        "data_path": "action_result.data.*.primarygroupid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.displayname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cn",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.pwdlastset",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.samaccountname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.samaccounttype",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.accountexpires",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.badpasswordtime",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.badpwdcount",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.codepage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.dscorepropagationdata",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.instancetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.iscriticalsystemobject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.ms-ds-creatorsid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.serviceprincipalname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.usnchanged",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.usncreated",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.useraccountcontrol",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.whenchanged",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.whencreated",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.os",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.fields",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.hostname",
                                        "data_type": "string"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "directory service"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get sysinfo"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_sysinfo(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('get_sysinfo() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_sysinfo' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'get_sysinfo' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'fields': \"\",\n                'hostname': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"get system attributes\", parameters=parameters, assets=['domainctrl1'], callback=join_prompt_1, name=\"get_sysinfo\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "hunt file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "get sysinfo",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "05fc4563-b46c-43f6-8f0c-5f2ccf3cdccb",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 460,
                        "line_start": 436,
                        "message": "Configuring now",
                        "name": "get system attributes",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1320,
                            "y": 140
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_sysinfo",
                        "required_params": {
                            "hostname": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6875
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_2() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"hunt_file_1:action_result.data.*.computerId\", \"!=\", \"\\\"NULL\\\"\"],\n        ],\n        name=\"filter_2:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        get_sysinfo(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "hunt file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "16627a55-3d8f-4fdd-8801-4569ed4cceb2",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 478,
                        "line_start": 460,
                        "name": "filter",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "hunt_file_1:action_result.data.*.computerId",
                                        "value": "\"NULL\""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1180,
                            "y": 140
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6876
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 11
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_11(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_11() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"domain_reputation_2:action_result.summary.domain_status\", \"==\", \"MALICIOUS\"],\n        ],\n        name=\"filter_11:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        join_prompt_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "domain reputation 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "446431b4-4afa-4a35-b2d9-39cf10d63357",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 567,
                        "line_start": 549,
                        "name": "filter",
                        "notes": "",
                        "number": 11,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "domain_reputation_2:action_result.summary.domain_status",
                                        "value": "MALICIOUS"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1180,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_11",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6940
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 15
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "block"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_15(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_15() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"domain_reputation_1:action_result.parameter.domain\", \"==\", \"artifact:*.cef.destinationDnsDomain\"],\n        ],\n        name=\"filter_15:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        join_prompt_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "domain reputation 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "fe89567f-bdf1-4b7e-97c8-fa7c4c20736e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 725,
                        "line_start": 707,
                        "name": "filter",
                        "notes": "",
                        "number": 15,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "domain_reputation_1:action_result.parameter.domain",
                                        "value": "artifact:*.cef.destinationDnsDomain"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 560,
                            "y": 560
                        },
                        "previous_function": "",
                        "previous_name": "filter_15",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6957
                    },
                    {
                        "action": "file reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "artifact:*.cef.cs6"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "file reputation",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.40",
                                "asset_name": "virustotal",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "hash": "artifact:*.cef.cs6"
                                },
                                "id": 142,
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.permalink",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.total",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resource",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scan_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "virustotal scan id"
                                        ],
                                        "data_path": "action_result.data.*.scan_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_scans",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.detected",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "parameters": {
                                    "hash": {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "File hash to query",
                                        "key": "hash",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "targets": "34",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "file reputation"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('file_reputation_1() called')\n\n    # collect data for 'file_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.cs6', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'file_reputation_1' call\n    for container_item in container_data:\n        parameters.append({\n            'hash': container_item[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_1, name=\"file_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "23059f38-2a33-4650-82b1-f7a2dadd3507",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 117,
                        "line_start": 97,
                        "message": "Configuring now",
                        "name": "file reputation",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 20
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "file_reputation_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6959
                    },
                    {
                        "action": "url reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "url": "artifact:*.cef.requestURL"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "url reputation",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.40",
                                "asset_name": "virustotal",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "url": "artifact:*.cef.requestURL"
                                },
                                "id": 142,
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.permalink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.total",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Url",
                                        "column_order": 0,
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.resource",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scan_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "virustotal scan id"
                                        ],
                                        "data_path": "action_result.data.*.scan_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.detected",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.found",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.summary.detections",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "Total Scans",
                                        "column_order": 1,
                                        "data_path": "action_result.summary.total_scans",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Positives",
                                        "column_order": 2,
                                        "data_path": "action_result.summary.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "parameters": {
                                    "url": {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "URL to query",
                                        "key": "url",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "targets": "34",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "url reputation"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def url_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('url_reputation_1() called')\n\n    # collect data for 'url_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.requestURL', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'url_reputation_1' call\n    for container_item in container_data:\n        parameters.append({\n            'url': container_item[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(\"url reputation\", parameters=parameters, assets=['virustotal'], callback=filter_4, name=\"url_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "d4fc2a1c-c23b-4b9a-8b57-5a61fd7e0b97",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 521,
                        "line_start": 501,
                        "message": "Configuring now",
                        "name": "url reputation",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 280
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "url_reputation_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6961
                    },
                    {
                        "action": "ip reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "ip reputation",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.40",
                                "asset_name": "virustotal",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress"
                                },
                                "id": 142,
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "column_name": "Ip",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "As Owner",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.as_owner",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Asn",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.asn",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.downloaded_samples",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.communicating_samples",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolutions.*.hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolutions.*.last_resolved",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.total",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.scan_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.total",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.total",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "parameters": {
                                    "ip": {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "IP to query",
                                        "key": "ip",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "targets": "34",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "ip reputation"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('ip_reputation_1() called')\n\n    # collect data for 'ip_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'ip_reputation_1' call\n    for container_item in container_data:\n        parameters.append({\n            'ip': container_item[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(\"ip reputation\", parameters=parameters, assets=['virustotal'], callback=filter_8, name=\"ip_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6fb61cc1-02e4-459c-b207-cde18af43ea7",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 200,
                        "line_start": 180,
                        "message": "Configuring now",
                        "name": "ip reputation",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "ip_reputation_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6965
                    },
                    {
                        "action": "detonate url",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "url": "url_reputation_1:action_result.data.*.resource"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "url": "url_reputation_1:action_result.data.*.resource"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "threatgrid",
                                "output": [
                                    {
                                        "contains": [
                                            "threatgrid task id"
                                        ],
                                        "data_path": "action_result.summary.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.summary.results_url",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.summary.target",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.changed",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.contents.curr",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.contents.orig",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.type",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.type",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.changed",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.ioc",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.URL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.Method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.Network_Stream",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.hits",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.truncated",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.status.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.status.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.origin",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.status.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.status.done_url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.running_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.vm_runtime",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.analysis_started_at",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.analysis_submitted_at",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.new",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.kpid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.proc",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.monitored",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.process_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.tid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.upid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.uthread",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.dll_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.shell_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.command_line",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.desktop_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.runtime_data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.window_title",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.image_pathname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.current_directory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.analyzed_because",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.access",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.options",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.dst",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.src",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.uid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.ts_end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.session",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.report.network.*.dst_port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.duration",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.report.network.*.src_port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.ts_begin",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.transport",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_orig",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_resp",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.conn_state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_missed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets_orig",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets_resp",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_orig_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_resp_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.magic",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.run_time",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.current_os",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.sandcastle",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.controlsubject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.sample_executed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.sandbox_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.report_created",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.sandbox_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.js",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.pe",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.ini",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.lnk",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.pdf",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.rtf",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.txt",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.html",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.network.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.created-time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.entropy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.exports",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.original_file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.header_relocations",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_code_segment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_instruction_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_segment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.pages",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.size_in_paragraphs",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.import_hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.number_of_symbols",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.actual_checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.claimed_checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.entrypoint_address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.file_alignment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_major_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_minor_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.loader_flag",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.number_of_rva_and_sizes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.reserved_field",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.section_alignment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.subsystem",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.dll",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.entries",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.internal_checksum_match",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.codepage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.language",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.locale",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.offset",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.resource_sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.sublanguage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.characteristics",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.data_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.Sections.InternetShortcut.Properties.URL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section_hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.virtual_size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.signatures",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.tag_attrs",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.urls",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.magic-type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.mime-type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.origin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.relation.network",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.relation.process",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.annotations.network.*.ts",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.os",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.status.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.status.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.login",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.status.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.started_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.completed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.submitted_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.submission_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.bis",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.sample",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.max-severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.max-confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url",
                                            "domain"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "sandbox"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "detonate url"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def detonate_url_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('detonate_url_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'detonate_url_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['url_reputation_1:action_result.data.*.resource', 'url_reputation_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'detonate_url_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'url': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"detonate url\", parameters=parameters, assets=['threatgrid'], callback=filter_6, name=\"detonate_url_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "url reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c77a71d5-4888-4395-9615-e4129ff4afe4",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 707,
                        "line_start": 684,
                        "message": "Configuring now",
                        "name": "detonate url",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 500,
                            "y": 420
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "detonate_url_1",
                        "required_params": {
                            "url": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6972
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 6
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_6() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"detonate_url_1:action_result.data.*.threat.max-confidence\", \">\", 50],\n        ],\n        name=\"filter_6:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        attribution(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "detonate url",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "9a6196f9-4997-4ab3-bb59-d7cfbad1165e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 324,
                        "line_start": 306,
                        "name": "filter",
                        "notes": "",
                        "number": 6,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "detonate_url_1:action_result.data.*.threat.max-confidence",
                                        "value": "50"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 740,
                            "y": 420
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_6",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": "",
                        "z": 6973
                    },
                    {
                        "action": "hunt url",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "url": "filtered-data:filter_6:condition_1:detonate_url_1:action_result.parameter.url"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "url": "filtered-data:filter_6:condition_1:detonate_url_1:action_result.parameter.url"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "isightpartners",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "URL",
                                        "column_order": 0,
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Report Title",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ThreatScape",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.threatscape_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.ThreatScape",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reportLink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.webLink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publishDate",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.matchedOn.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.matchedOn.*.key",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Report Id",
                                        "column_order": 4,
                                        "contains": [
                                            "isightpartners report id"
                                        ],
                                        "data_path": "action_result.data.*.reportId",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Published Date",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.published_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.reports_matched",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "threat intel"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "attribution"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def attribution(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('attribution() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'attribution' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_6:condition_1:detonate_url_1:action_result.parameter.url\", \"filtered-data:filter_6:condition_1:detonate_url_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'attribution' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'url': filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"hunt url\", parameters=parameters, assets=['isightpartners'], callback=join_get_screenshot_1, name=\"attribution\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "detonate url",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "attribution",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "7ac8409a-22b1-4166-a80b-44abc67b58c2",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 501,
                        "line_start": 478,
                        "message": "Configuring now",
                        "name": "hunt url",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 880,
                            "y": 420
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "attribution",
                        "required_params": {
                            "url": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": "",
                        "z": 6974
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_4() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"url_reputation_1:action_result.data.*.positives\", \">=\", \"1\"],\n        ],\n        name=\"filter_4:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        join_get_screenshot_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"url_reputation_1:action_result.data.*.positives\", \"<\", \"1\"],\n        ],\n        name=\"filter_4:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        detonate_url_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "url reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c27da6f5-9a5f-4f67-8904-d033ea6084f1",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 355,
                        "line_start": 324,
                        "name": "filter",
                        "notes": "",
                        "number": 4,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">=",
                                        "data_type": "",
                                        "param": "url_reputation_1:action_result.data.*.positives",
                                        "value": "1"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "<",
                                        "data_type": "",
                                        "param": "url_reputation_1:action_result.data.*.positives",
                                        "value": "1"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 420,
                            "y": 280
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_4",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6976
                    },
                    {
                        "action": "get screenshot",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "size": "",
                            "url": "filtered-data:filter_4:condition_1:url_reputation_1:action_result.parameter.url"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "size": "",
                                    "url": "filtered-data:filter_4:condition_1:url_reputation_1:action_result.parameter.url"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "screenshot machine",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Downloaded screenshot"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.summary.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.google.com_screenshot.jpg"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.size",
                                        "data_type": "string",
                                        "example_values": [
                                            48692
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.summary.vault_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "025a0aed68c79a9dc14fa11654ed9a21d521f79e"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.summary.permalink",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url",
                                            "domain"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.google.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.vault_file_path",
                                        "data_type": "string",
                                        "example_values": [
                                            "/opt/phantom/vault/02/5a/025a0aed68c79a9dc14fa11654ed9a21d521f79e"
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get screenshot"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_screenshot_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('get_screenshot_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_screenshot_1' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_4:condition_1:url_reputation_1:action_result.parameter.url\", \"filtered-data:filter_4:condition_1:url_reputation_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'get_screenshot_1' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'url': filtered_results_item_1[0],\n                'size': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"get screenshot\", parameters=parameters, assets=['screenshot machine'], callback=join_prompt_1, name=\"get_screenshot_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "attribution, url reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "67b3634e-4975-4d85-bf65-66e476c39752",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_get_screenshot_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('join_get_screenshot_1() called')\n    \n    # if the joined function has already been called, do nothing\n    if phantom.get_run_data(key='join_get_screenshot_1_called'):\n        return\n\n    # no callbacks to check, call connected block \"get_screenshot_1\"\n    phantom.save_run_data(key='join_get_screenshot_1_called', value='get_screenshot_1', auto=True)\n\n    get_screenshot_1(container=container, handle=handle)\n    \n    return",
                        "join_optional": [
                            "url_reputation_1",
                            "attribution"
                        ],
                        "join_start": 647,
                        "line_end": 661,
                        "line_start": 623,
                        "message": "Configuring now",
                        "name": "get screenshot",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1120,
                            "y": 420
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_screenshot_1",
                        "required_params": {
                            "url": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": "",
                        "z": 6977
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_3() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"detonate_file_1:action_result.summary.malware\", \"==\", \"yes\"],\n        ],\n        name=\"filter_3:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        join_hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "97d32384-9ca1-40fe-b4b6-afd4024e08a6",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 97,
                        "line_start": 79,
                        "name": "filter",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "detonate_file_1:action_result.summary.malware",
                                        "value": "yes"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 800,
                            "y": 20
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6978
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.data.*.positives\", \"<=\", \"3\"],\n        ],\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        detonate_file_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.data.*.positives\", \">\", \"3\"],\n        ],\n        name=\"filter_1:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        join_hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "64ea3268-666a-45af-8d42-f9929aff7941",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 306,
                        "line_start": 275,
                        "name": "filter",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "<=",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.data.*.positives",
                                        "value": "3"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.data.*.positives",
                                        "value": "3"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 420,
                            "y": 20
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6979
                    },
                    {
                        "action": "hunt file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "file_reputation_1:filtered-action_result.data.*.sha256",
                            "range": "",
                            "type": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "file_reputation_1:filtered-action_result.data.*.sha256"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "cbprotect",
                                "output": [
                                    {
                                        "column_name": "ID",
                                        "column_order": 0,
                                        "contains": [
                                            "carbon black file id"
                                        ],
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Computer ID",
                                        "column_order": 2,
                                        "contains": [
                                            "carbon black computer id"
                                        ],
                                        "data_path": "action_result.data.*.computerId",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.trust",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Company",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.company",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "File Name",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.fileName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.fileSize",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.fileType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.pathName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.fileFlags",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.fileState",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publisher",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Prevalence",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.prevalence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.dateCreated",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.productName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publisherId",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.certificateId",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.fileExtension",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.trustMessages",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.effectiveState",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.productVersion",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publisherState",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sha256HashType",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.certificateState",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reputationEnabled",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publisherOrCompany",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reputationAvailable",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approvedByReputation",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.installedProgramName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.prevalence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            },
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "file_reputation_1:filtered-action_result.data.*.sha256",
                                    "range": "",
                                    "type": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "carbon black query type"
                                        ],
                                        "data_path": "action_result.parameter.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.range",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.device_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.terms",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.total_results",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.modload_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.sensor_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.process_md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_unique_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.cmdline",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.filemod_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "carbon black process id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.last_update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.netconn_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file path"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.regmod_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.crossproc_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.segment_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.host_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.childproc_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.unique_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.elapsed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.terms",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.total_results",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.ids",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.host_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.observed_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Signed",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.binary.results.*.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_executable_image",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_64bit",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.endpoint",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.legal_copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.cb_version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.last_seen",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.elapsed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            },
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "file_reputation_1:filtered-action_result.data.*.sha256"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "cylance_1",
                                "output": [
                                    {
                                        "column_name": "Device Name",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.data.*.device_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "First IP",
                                        "column_order": 1,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.data.*.ip_addresses.0",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "File Quarantine Status",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.data.*.file_quarantine_status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Running",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.data.*.running",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "File Paths",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.data.*.file_paths",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Serial Number",
                                        "column_order": 5,
                                        "contains": [
                                            "cylance serial number"
                                        ],
                                        "data_path": "action_result.data.*.data.*.serial_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.added",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.policy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.unsafe",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.waived",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.abnormal",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.auto_run",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.is_offline",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.os_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.detected_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.first_found",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.quarantined",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.ip_addresses.*.",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.agent_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.mac_addresses.*.",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.files_analyzed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.exploit_attempts",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.last_reported_users.*.",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.*.background_detection",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_devices",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt file"
                            },
                            ".background": {
                                "stroke": "#E6984E"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 1
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('hunt_file_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_file_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"file_reputation_1:filtered-action_result.data.*.sha256\", \"file_reputation_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        parameters.append({\n            'hash': passed_filtered_results_item_1[0],\n            'range': \"\",\n            'type': \"\",\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': passed_filtered_results_item_1[1]},\n        })\n\n    phantom.act(\"hunt file\", parameters=parameters, assets=['cbprotect','carbonblack','cylance_1'], callback=filter_2, name=\"hunt_file_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "file reputation, detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "59bc3d6d-a78a-4ee8-a3b0-b5447f50c50a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('join_hunt_file_1() called')\n    \n    # if the joined function has already been called, do nothing\n    if phantom.get_run_data(key='join_hunt_file_1_called'):\n        return\n\n    # no callbacks to check, call connected block \"hunt_file_1\"\n    phantom.save_run_data(key='join_hunt_file_1_called', value='hunt_file_1', auto=True)\n\n    hunt_file_1(container=container, handle=handle)\n    \n    return",
                        "join_optional": [
                            "file_reputation_1",
                            "detonate_file_1"
                        ],
                        "join_start": 397,
                        "line_end": 411,
                        "line_start": 373,
                        "message": "Configuring now",
                        "name": "hunt file",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 940,
                            "y": 140
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_file_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "warn",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6980
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 0.7
                            }
                        },
                        "block_code": "def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('decision_1() called')\n\n    # check for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"prompt_1:action_result.summary.response\", \"==\", \"YES\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched_artifacts_1 or matched_results_1:\n        delete_email_2(action=action, success=success, container=container, results=results, handle=handle)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "prompt 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "7233d7f5-1952-4905-8161-541cc6502691",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 79,
                        "line_start": 61,
                        "name": "decision",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "prompt_1:action_result.summary.response",
                                        "value": "YES"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1720,
                            "y": 420
                        },
                        "previous_function": "",
                        "previous_name": "decision_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 6983
                    },
                    {
                        "action_name": "",
                        "action_type": "generic",
                        "active": false,
                        "angle": 0,
                        "approver": "Administrator",
                        "attrs": {
                            ".background": {
                                "stroke": "#637282"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            "g.approver image": {
                                "xlink:href": "/inc/coa/img/icon_approver_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def prompt_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('prompt_1() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"Administrator\"\n    message = \"\"\"An email is being marked as a Phish attempt. Please inspect and approve so that Phantom can delete all instances of the phish from your mail server.  If you do not respond within 6 hours (360 Minutes) the email will _NOT_ be deleted. If you respond \\\"Yes\\\" Phantom will start the removal of the phish from all mailboxes on your mail server. All enrichment data is in MIssion Control for your review.\"\"\"\n\n    # response options\n    options = {\n        \"type\": \"list\",\n        \"choices\": [\n            \"Yes\",\n            \"No\",\n        ]\n    }\n\n    phantom.prompt(container=container, user=user, message=message, respond_in_mins=360, name=\"prompt_1\", options=options, callback=decision_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "get sysinfo, get screenshot, domain reputation 2, geolocate ip, domain reputation 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2c2513e3-6df7-45a6-aff1-11a0a3b3e0c3",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_prompt_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('join_prompt_1() called')\n    \n    # if the joined function has already been called, do nothing\n    if phantom.get_run_data(key='join_prompt_1_called'):\n        return\n\n    # check if all connected incoming actions are done i.e. have succeeded or failed\n    if phantom.actions_done([ 'domain_reputation_2', 'domain_reputation_1' ]):\n        \n        # save the state that the joined function has now been called\n        phantom.save_run_data(key='join_prompt_1_called', value='prompt_1')\n        \n        # call connected block \"prompt_1\"\n        prompt_1(container=container, handle=handle)\n    \n    return",
                        "join_optional": [
                            "get_sysinfo",
                            "get_screenshot_1",
                            "domain_reputation",
                            "IP_Domain_Rep",
                            "geolocate_ip_1"
                        ],
                        "join_start": 587,
                        "line_end": 605,
                        "line_start": 567,
                        "message": "An email is being marked as a Phish attempt. Please inspect and approve so that Phantom can delete all instances of the phish from your mail server.  If you do not respond within 6 hours (360 Minutes) the email will _NOT_ be deleted. If you respond \"Yes\" Phantom will start the removal of the phish from all mailboxes on your mail server. All enrichment data is in MIssion Control for your review.",
                        "name": "prompt",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "parameters": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1580,
                            "y": 420
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "prompt_1",
                        "respond_in": "360",
                        "response_key": "Yes/No",
                        "response_options": [
                            "Yes",
                            "No"
                        ],
                        "response_type": "list",
                        "showNumber": false,
                        "show_number": true,
                        "size": {
                            "height": 80,
                            "width": 80
                        },
                        "state": "prompt",
                        "status": "",
                        "type": "coa.Prompt",
                        "warn": false,
                        "z": 6988
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 14
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "xlink:href": "/inc/coa/img/block_icon_note_on.svg"
                            }
                        },
                        "block_code": "def filter_14(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_14() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"geolocate_ip_1:artifact:*.cef.destinationAddress\", \"==\", \"artifact:*.cef.destinationAddress\"],\n        ],\n        name=\"filter_14:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        join_prompt_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "geolocate ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "91e24cdc-5717-49c1-9389-960606d5751c",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 623,
                        "line_start": 605,
                        "name": "filter",
                        "notes": "Filter the artifact",
                        "number": 14,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "geolocate_ip_1:artifact:*.cef.destinationAddress",
                                        "value": "artifact:*.cef.destinationAddress"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 560,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "filter_14",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6995
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 10
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_10(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_10() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"geolocate_ip_1:action_result.data.*.country_name\", \"in\", \"Burma,China,Eretrea,Iran,North Korea,Saudi Arabia,Sudan,Turkmenistan,Uzbekistan\"],\n        ],\n        name=\"filter_10:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        filter_14(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "geolocate ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "d6adce13-8c78-4db5-bc59-835952340c83",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 239,
                        "line_start": 221,
                        "name": "filter",
                        "notes": "",
                        "number": 10,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "in",
                                        "data_type": "",
                                        "param": "geolocate_ip_1:action_result.data.*.country_name",
                                        "value": "Burma,China,Eretrea,Iran,North Korea,Saudi Arabia,Sudan,Turkmenistan,Uzbekistan"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 420,
                            "y": 840
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_10",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 6996
                    },
                    {
                        "action": "whois domain",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "domain": "artifact:*.cef.destinationDnsDomain"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "domain": "artifact:*.cef.destinationDnsDomain"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "whois",
                                "output": [
                                    {
                                        "contains": [
                                            "domain",
                                            "url"
                                        ],
                                        "data_path": "action_result.parameter.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Admin City",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.contacts.admin.city",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Admin Country",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.contacts.admin.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Admin Email",
                                        "column_order": 5,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.contacts.admin.email",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Admin Name",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.contacts.admin.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Admin Organization",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.contacts.admin.organization",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.admin.phone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.admin.postalcode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.admin.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.admin.street",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.admin.fax",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Registrant City",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.contacts.registrant.city",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Registrant Country",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.contacts.registrant.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Registrant Email",
                                        "column_order": 10,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.contacts.registrant.email",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Registrant Name",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.contacts.registrant.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Registrant Organization",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.contacts.registrant.organization",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Registrant Phone",
                                        "column_order": 13,
                                        "data_path": "action_result.data.*.contacts.registrant.phone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.registrant.fax",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.registrant.postalcode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.registrant.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.registrant.street",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.city",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.contacts.tech.email",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.fax",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.organization",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.phone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.postalcode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contacts.tech.street",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.creation_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.emails",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.expiration_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.nameservers",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.raw",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.registrar",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.updated_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.whois_server",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.city",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.organization",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "domain",
                                        "column_order": 0,
                                        "data_path": "action_result.summary.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "status message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "whois domain"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def whois_domain(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('whois_domain() called')\n\n    # collect data for 'whois_domain' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationDnsDomain', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'whois_domain' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'domain': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"whois domain\", parameters=parameters, assets=['whois'], name=\"whois_domain\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "whois domain",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "13d2dbeb-d067-4726-a735-6b2a1a2f2997",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 159,
                        "line_start": 138,
                        "message": "Configuring now",
                        "name": "whois domain",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 980
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "whois_domain",
                        "required_params": {
                            "domain": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6998
                    },
                    {
                        "action": "whois ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.sourceAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.sourceAddress"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domaintools",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.whois.date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.whois.record",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.registrant",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.ref",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 10,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.source",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Address",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.0",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "City",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.1",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "State",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.2",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Postal Code",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.3",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.noc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.tech",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.abuse",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.created_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.updated_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "email",
                                        "column_order": 5,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.email",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.phone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.asn",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Organization",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.org",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.ref",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Range Low",
                                        "column_order": 14,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.to",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "CIDR",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.cidr",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Range Low",
                                        "column_order": 13,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.from",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.parent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.source",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.customer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.parent_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.noc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.org",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.tech",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.abuse",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Created Date",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.created_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.updated_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.record_source",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.organization",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "IP",
                                        "column_order": 1,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "whois ip"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def whois_ip(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('whois_ip() called')\n\n    # collect data for 'whois_ip' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'whois_ip' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"whois ip\", parameters=parameters, assets=['domaintools'], name=\"whois_ip\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "whois ip",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ff093ff3-4757-4d50-aadd-e2bf0302492e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 138,
                        "line_start": 117,
                        "message": "Configuring now",
                        "name": "whois ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 1120
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "whois_ip",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 6999
                    },
                    {
                        "action": "delete email",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "from": "artifact:*.cef.sourceUserName",
                            "id": "email_ids[]",
                            "ip_hostname": "exchange_server",
                            "subject": "container:name",
                            "user": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "from": "artifact:*.cef.sourceUserName",
                                    "ip_hostname": "exchange_server",
                                    "subject": "container:name",
                                    "user": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domainctrl1",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.user",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Mailbox Display Name",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.DisplayName",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Emails Matched",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.ResultItemsCount",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.Success",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.TargetMailbox",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.ResultItemsSize",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.TargetPSTFile",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.Identity",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.TargetFolder",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_mailboxes_matched",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_emails_matched",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "delete email"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def delete_email_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('delete_email_2() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    name_value = container.get('name', None)\n\n    # collect data for 'delete_email_2' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceUserName', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'delete_email_2' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'from': container_item[0],\n                'user': \"\",\n                'ip_hostname': \"exchange_server\",\n                'subject': name_value,\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"delete email\", parameters=parameters, assets=['domainctrl1'], name=\"delete_email_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "prompt 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "45bbe9e7-ed5e-4d30-b3a0-8efc89c476e0",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 597,
                        "line_end": 549,
                        "line_start": 521,
                        "message": "Configuring now",
                        "name": "delete email",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1860,
                            "y": 420
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "delete_email_2",
                        "required_params": {
                            "from": true,
                            "ip_hostname": true,
                            "subject": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": "",
                        "z": 7000
                    },
                    {
                        "action": "domain reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "domain": "artifact:*.cef.destinationDnsDomain"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "domain": "artifact:*.cef.destinationDnsDomain"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "opendns_investigate",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Domain",
                                        "column_order": 0,
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.parameter.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Categories",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.handlings.normal",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.geodiversity",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "DGA Score",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.security_info.dga_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.geoscore",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.asn_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.rip_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.securerank2",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.popularity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.ks_test",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.attack",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.pagerank",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.entropy",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.prefix_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.perplexity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.found",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.fastflux",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.threat_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.geodiversity_normalized",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category_info.status",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category_info.security_categories",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.status_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.tag_info.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.tag_info.*.period.begin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.tag_info.*.period.end",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_co_occurances",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.domain_status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_tag_info",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_relative_links",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "reputation"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "domain reputation 1"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def domain_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('domain_reputation_1() called')\n\n    # collect data for 'domain_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationDnsDomain', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'domain_reputation_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'domain': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"domain reputation\", parameters=parameters, assets=['opendns_investigate'], callback=filter_5, name=\"domain_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "domain reputation 1",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "77d8ce2c-70b2-4079-ab58-2dcc0e9de1f4",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 221,
                        "line_start": 200,
                        "message": "Configuring now",
                        "name": "domain reputation",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 180,
                            "y": 560
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "domain_reputation_1",
                        "required_params": {
                            "domain": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 7003
                    },
                    {
                        "action": "domain reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "domain": "lookup_ip_1:action_result.summary.hostname"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "domain": "lookup_ip_1:action_result.summary.hostname"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "opendns_investigate",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Domain",
                                        "column_order": 0,
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.parameter.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Categories",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.handlings.normal",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.geodiversity",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "DGA Score",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.security_info.dga_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.geoscore",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.asn_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.rip_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.securerank2",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.popularity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.ks_test",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.attack",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.pagerank",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.entropy",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.prefix_score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.perplexity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.found",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.fastflux",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.threat_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.security_info.geodiversity_normalized",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category_info.status",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category_info.security_categories",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.status_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.tag_info.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.tag_info.*.period.begin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.tag_info.*.period.end",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_co_occurances",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.domain_status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_tag_info",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_relative_links",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "reputation"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "domain reputation 2"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_error.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def domain_reputation_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('domain_reputation_2() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'domain_reputation_2' call\n    results_data_1 = phantom.collect2(container=container, datapath=['lookup_ip_1:action_result.summary.hostname', 'lookup_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'domain_reputation_2' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'domain': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"domain reputation\", parameters=parameters, assets=['opendns_investigate'], callback=filter_11, name=\"domain_reputation_2\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "lookup ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "domain reputation 2",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "04238772-5424-47f6-ba2a-c06759a8d0ee",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 684,
                        "line_start": 661,
                        "message": "Configuring now",
                        "name": "domain reputation",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 940,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "domain_reputation_2",
                        "required_params": {
                            "domain": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 7004
                    },
                    {
                        "action": "lookup ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "ip_reputation_1:filtered-action_result.parameter.ip"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "ip_reputation_1:filtered-action_result.parameter.ip"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "dns",
                                "output": [
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_order": 2,
                                        "data_path": "action_result.summary.canonical_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "IP Address",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.summary.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Hostname",
                                        "column_order": 1,
                                        "contains": [
                                            "host name",
                                            "domain"
                                        ],
                                        "data_path": "action_result.summary.hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "lookup ip"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def lookup_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('lookup_ip_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'lookup_ip_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"ip_reputation_1:filtered-action_result.parameter.ip\", \"ip_reputation_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'lookup_ip_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'ip': passed_filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"lookup ip\", parameters=parameters, assets=['dns'], callback=domain_reputation_2, name=\"lookup_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0b6f00e5-37b5-46f9-8fc5-b5997a577697",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 748,
                        "line_start": 725,
                        "message": "Configuring now",
                        "name": "lookup ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 700,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "lookup_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 7005
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "text": "START"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_error.svg"
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": false,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "def on_start(container):\n    urls = test_params(container, 'artifact:*.cef.requestURL', 'url')\n    domains = test_params(container,'artifact:*.cef.destinationDnsDomain', 'domain') \n    ips = test_params(container, 'artifact:*.cef.destinationAddress', 'ip') \n    file_hashs = test_params(container, 'artifact:*.cef.cs6', 'hash')\n    #if no file hashes this way, lets see if there is a vault item that has been added manually)\n    if not file_hashs:\n        vault_items = phantom.Vault.get_file_info(container_id=container['id'])\n        hashes = []\n        for vault_item in vault_items:            \n            hashes.append({'hash': vault_item['metadata']['sha256']})\n    if file_hashs:\n    # call 'file_reputation_1' block\n        file_reputation_1(container=container)\n    if urls:\n    # call 'url_reputation_1' block\n        url_reputation_1(container=container)\n    if domains:\n    # call 'domain_reputation_1' block\n        domain_reputation_1(container=container)\n    if ips:\n    # call 'ip_reputation_1' block\n        ip_reputation_1(container=container)\n    if domains:\n    # call 'whois_infoDomain' block\n        whois_domain(container=container)\n    if ips:\n    # call 'whois_infoIP' block\n        whois_ip(container=container)\n    if ips:\n    # call 'geolocate_ip_1' block\n        geolocate_ip_1(container=container)\n\n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c832baf3-7b79-4eab-a69c-d7fb5195d639",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 61,
                        "line_start": 26,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 40,
                            "y": 40
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 7006
                    }
                ]
            },
            "notes": ""
        },
        "schema": 3,
        "version": "3.5.137"
    },
    "create_time": "2018-02-12T22:37:34.315482+00:00",
    "draft_mode": false,
    "labels": [
        "campaign"
    ]
}