vmworld_c2_response.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Tech Sessions",
    "coa": {
        "data": {
            "clean": true,
            "code_block": "",
            "description": "This Playbook demonstrates a response to a command and control alert when an organization is operating a VMWare virtualized environment. The individual endpoints are vSphere guests and the network stack is virtualized with VMWare NSX. This allows unique response options including virtual machine snapshots and the flexible deployment of new firewall rules across dynamic infrastructure. We built this Playbook in a partnership with Rackspace and VMWare. As one of the largest vSphere service providers, Rackspace provides experienced insight into the deployment of security automation and orchestration in the virtualized datacenter.\n\nVMWorld 2017 Demonstration: https://rackconnection.rackspace.com/youtube-us-region/powering-next-level-security-with-vmware-technology",
            "hash": "df931ceda461ed1e78070041916166975375bc40",
            "joint": {
                "cells": [
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b78188c2-d1f3-47ff-b83c-0112988e8085",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c27728f9-79e9-4300-a49c-5e4766fbb76c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c2a183b7-49f3-4577-9cb2-97b488bd1802",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 8
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "81a1b4c3-5d05-4312-a20d-3f9a501cc827",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c2a183b7-49f3-4577-9cb2-97b488bd1802",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "1816632d-6b2a-4e3b-9a49-404e2abeb5db",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 10
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "801b84cb-bac9-4f1a-8cd2-8e1cf7975b33",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "821118fb-31b1-41c2-ba4b-586b16da582e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "9cdd9e3e-df9b-448b-bf0d-01b6c5f594fb",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 12
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "3ec5bae9-f9aa-4c0c-8808-51ead04e2ff9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "821118fb-31b1-41c2-ba4b-586b16da582e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c8cafab5-8536-4d2a-a88e-52d2c5eba3f3",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 14
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "a695037f-4f72-47a4-90ba-1cf0db73bc1e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "22ffe3c9-a408-4c2d-a56a-8e0ebea00ae7",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "61de1a0d-de58-45cb-bf1c-e764af57fad0",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 18
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "035a4901-ef35-41e8-994c-63faf23c29a4",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "22ffe3c9-a408-4c2d-a56a-8e0ebea00ae7",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "40db4f96-3a24-464c-89f8-f47eee61e718",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 19
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "4047bd73-500c-43b7-9de9-b27edc5211e3",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9cdd9e3e-df9b-448b-bf0d-01b6c5f594fb",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6a92a056-7f81-41fe-a255-2dc03ccdbe07",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 22
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f91c0bd8-d16c-4f41-9865-86b30078a899",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6a92a056-7f81-41fe-a255-2dc03ccdbe07",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "d0e0c5f4-1d2b-41b6-a14e-f9710fbbdf3a",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 24
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "a752d9b0-29c0-471d-ae22-f545849857e9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "40db4f96-3a24-464c-89f8-f47eee61e718",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "59612f5c-53f4-41a4-8195-571fd4be0a2d",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 26
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "16f279c0-6de1-4d9d-a13e-125813fb5c49",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "59612f5c-53f4-41a4-8195-571fd4be0a2d",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "52a68829-7b20-4cfb-a794-22fd606a774b",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 28
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f58fb965-2752-4b65-b222-aa023e6d8f3d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "40db4f96-3a24-464c-89f8-f47eee61e718",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "8f40ae3a-f32c-4359-945e-2e2572620831",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 30
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e51745eb-d45e-4bcf-b0db-c4b913dd1d48",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9cdd9e3e-df9b-448b-bf0d-01b6c5f594fb",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "8f40ae3a-f32c-4359-945e-2e2572620831",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 32
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "5d121074-d9fa-4ef2-b3bb-68e86dfc5908",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8f40ae3a-f32c-4359-945e-2e2572620831",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "1288d542-54ab-4eed-9cd0-da0c66afe519",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 34
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "bb849435-f2ce-46cf-aa20-0af69608a684",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8f40ae3a-f32c-4359-945e-2e2572620831",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6c43087c-a420-44ea-b2f8-af29b064c1d9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 37
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8db9279e-2e74-49d7-b128-a8ffc5abca89",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "1288d542-54ab-4eed-9cd0-da0c66afe519",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "488f9a97-1820-40ed-aadf-3828f4151789",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 39
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "812a8df5-dc66-4bc5-9988-226e2ea55f75",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6c43087c-a420-44ea-b2f8-af29b064c1d9",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ed9219e9-3fc5-4677-8557-5377f16a0ba2",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 41
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9536ebd6-f4b4-4f0d-8466-4b76ac06c064",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "488f9a97-1820-40ed-aadf-3828f4151789",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "098f4762-4732-4e5d-9bdc-a8777a7c4f7b",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 43
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8ac1c752-311a-4c85-afa4-9a0dab4cda07",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ed9219e9-3fc5-4677-8557-5377f16a0ba2",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "098f4762-4732-4e5d-9bdc-a8777a7c4f7b",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 44
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "3729790e-19e0-4394-a13a-a976eefb1daf",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2d9a376a-f95e-4c05-9be4-9ef197bc16e8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b48b78fd-516d-41c0-a19a-66e5d670a7be",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 68
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "939112ea-a594-4ea3-9958-7e4a7c1fb5a5",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "b48b78fd-516d-41c0-a19a-66e5d670a7be",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "db8d697e-e27e-463c-917c-ffebf0db2d8e",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 70
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "ref-y": 8,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'filter_3' block\n    filter_3(container=container)\n\n    # call 'filter_2' block\n    filter_2(container=container)\n\n    # call 'filter_1' block\n    filter_1(container=container)\n\n    # call 'list_vms_1' block\n    list_vms_1(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c27728f9-79e9-4300-a49c-5e4766fbb76c",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 27,
                        "line_start": 10,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 240,
                            "y": 100
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 83
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation, file reputation, ip reputation, file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "098f4762-4732-4e5d-9bdc-a8777a7c4f7b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 477,
                        "line_start": 464,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 22,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1380,
                            "y": 520
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 102
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_3() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation:action_result.data.*.detected_urls.*.positives\", \">=\", 15],\n            [\"ip_reputation:action_result.data.*.threatscore\", \">=\", 60],\n        ],\n        logical_operator='or')\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        set_severity_high(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 2\n    set_severity_low(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation, file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Use custom thresholds to categorize high and low severity events based on the IP reputation from Virustotal and Threatstream.",
                        "hasElse": true,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "8f40ae3a-f32c-4359-945e-2e2572620831",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_decision_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_decision_3() called')\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['ip_reputation', 'file_reputation']):\n        \n        # call connected block \"decision_3\"\n        decision_3(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 53,
                        "line_end": 64,
                        "line_start": 30,
                        "name": "decision",
                        "notes": "Use custom thresholds to categorize high and low severity events based on the IP reputation from Virustotal and Threatstream.",
                        "number": 3,
                        "order": 2,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">=",
                                        "data_type": "",
                                        "param": "ip_reputation:action_result.data.*.detected_urls.*.positives",
                                        "value": "15"
                                    },
                                    {
                                        "comparison": ">=",
                                        "data_type": "",
                                        "param": "ip_reputation:action_result.data.*.threatscore",
                                        "value": "60"
                                    }
                                ],
                                "display": "If",
                                "logic": "or",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "",
                                        "value": ""
                                    }
                                ],
                                "display": "Else",
                                "logic": "and",
                                "type": "else"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "decision_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 211
                    },
                    {
                        "action": "block hash",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "comment": "",
                            "hash": "file_reputation_1:action_result.parameter.hash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "Carbon Black Response",
                                "app_version": "1.2.80",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "comment": "",
                                    "hash": "file_reputation:action_result.parameter.hash"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.comment",
                                        "data_type": "string",
                                        "example_values": [
                                            "Sample comment"
                                        ]
                                    },
                                    {
                                        "column_name": "Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "180469AE0B239E31DB4C65F02FD70BC1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Block hash action succeeded. It might take some time for blacklisting to take effect."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "Carbon Black",
                                "product_vendor": "Bit9",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block hash"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_hash(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('block_hash() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_hash' call\n    results_data_1 = phantom.collect2(container=container, datapath=['file_reputation:action_result.parameter.hash', 'file_reputation:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'block_hash' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'hash': results_item_1[0],\n                'comment': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], name=\"block_hash\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "block hash",
                        "delay": 0,
                        "description": "Now that our Virustotal threshold has classified the file as malicious we will use CarbonBlack Response to block future executions of that file.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "d0e0c5f4-1d2b-41b6-a14e-f9710fbbdf3a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 91,
                        "line_start": 67,
                        "message": "Configuring now",
                        "name": "block hash",
                        "notes": "Now that our Virustotal threshold has classified the file as malicious we will use CarbonBlack Response to block future executions of that file.",
                        "number": 1,
                        "order": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 900,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "block_hash",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 223
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_1() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation:action_result.summary.positives\", \">=\", 20],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        block_hash(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Only proceed if 20 or more detection engines in Virustotal classified the file as malicious.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6a92a056-7f81-41fe-a255-2dc03ccdbe07",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 112,
                        "line_start": 94,
                        "name": "decision",
                        "notes": "Only proceed if 20 or more detection engines in Virustotal classified the file as malicious.",
                        "number": 1,
                        "order": 4,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">=",
                                        "data_type": "",
                                        "param": "file_reputation:action_result.summary.positives",
                                        "value": "20"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "decision_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 224
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_low(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_severity_low() called')\n\n    phantom.set_severity(container=container, severity=\"low\")\n    set_status_resolved_2(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "low"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "ip reputation, file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "set severity low",
                        "description": "Set the severity of this event to Low.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6c43087c-a420-44ea-b2f8-af29b064c1d9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 123,
                        "line_start": 115,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "Set the severity of this event to Low.",
                        "number": 2,
                        "order": 5,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 900,
                            "y": 500
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_low",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 233
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set status",
                        "attrs": {
                            ".api": {
                                "text": "set status"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_status_resolved(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_status_resolved() called')\n\n    phantom.set_status(container=container, status=\"closed\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-status",
                                "setStatusStatus": "closed"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "ip reputation, file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "set status resolved",
                        "description": "Resolve this event. The enrichment and the history of any blocking actions taken can still be reviewed in Mission Control and reopened if further action is necessary.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "488f9a97-1820-40ed-aadf-3828f4151789",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 133,
                        "line_start": 126,
                        "message": "Configuring now",
                        "name": "set status",
                        "notes": "Resolve this event. The enrichment and the history of any blocking actions taken can still be reviewed in Mission Control and reopened if further action is necessary.",
                        "number": 3,
                        "order": 6,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1140,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "set_status_resolved",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 234
                    },
                    {
                        "action": "file reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_2:condition_1:artifact:*.cef.fileHashMd5"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.37",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_2:condition_1:artifact:*.cef.fileHashMd5"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "6c1948f7edf115cd1f13cd170b882077930be150"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.md5",
                                        "data_type": "string",
                                        "example_values": [
                                            "494303294715f5ffad7ad3f43b73b00b"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.permalink",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.test.com/file/27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7/analysis/1548112684/"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            64
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.resource",
                                        "data_type": "string",
                                        "example_values": [
                                            "6c1948f7edf115cd1f13cd170b882077930be150"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scan_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-01-21 23:18:04"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "virustotal scan id"
                                        ],
                                        "data_path": "action_result.data.*.scan_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7-1548112684"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.detected",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ALYac.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ALYac.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ALYac.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.ALYac.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVG.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVG.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32:Parite"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVG.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVG.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "18.4.3895.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVware.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVware.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.b (v)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AVware.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20180925"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.AVware.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.6.0.52"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Acronis.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Acronis.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "suspicious"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Acronis.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190119"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Acronis.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.1.37"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ad-Aware.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ad-Aware.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ad-Aware.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ad-Aware.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "3.0.5.370"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AegisLab.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AegisLab.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AegisLab.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AegisLab.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "4.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AhnLab-V3.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AhnLab-V3.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32/Parite"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AhnLab-V3.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AhnLab-V3.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "3.14.1.22785"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Alibaba.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Alibaba.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Alibaba.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20180921"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Alibaba.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "0.1.0.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Antiy-AVL.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Antiy-AVL.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus/Win32.Parite.c"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Antiy-AVL.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Antiy-AVL.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "3.0.0.1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Arcabit.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Arcabit.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Arcabit.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Arcabit.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.0.837"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast-Mobile.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast-Mobile.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast-Mobile.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast-Mobile.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "190121-00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32:Parite"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avast.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "18.4.3895.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avira.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avira.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Parite"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avira.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Avira.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "8.3.3.8"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Babable.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Babable.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Babable.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20180918"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Babable.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "9107201"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Baidu.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Baidu.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Virus.Parite.d"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Baidu.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Baidu.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.0.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.BitDefender.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.BitDefender.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.BitDefender.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.BitDefender.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "7.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Bkav.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Bkav.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32.Pinfi.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Bkav.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Bkav.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.3.0.9899"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CAT-QuickHeal.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CAT-QuickHeal.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32.Perite.A"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CAT-QuickHeal.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CAT-QuickHeal.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "14.00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CMC.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CMC.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Parite.b!O"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CMC.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CMC.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.0.977"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ClamAV.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ClamAV.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Heuristics.W32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ClamAV.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.ClamAV.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "0.101.1.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Comodo.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Comodo.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Malware@#1b1651nqd7ivb"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Comodo.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Comodo.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "30310"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CrowdStrike.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CrowdStrike.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "malicious_confidence_100% (W)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CrowdStrike.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20181023"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CrowdStrike.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cybereason.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cybereason.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "malicious.94715f"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cybereason.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190109"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cybereason.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.2.27"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cylance.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cylance.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Unsafe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cylance.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Cylance.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2.3.1.101"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cyren.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cyren.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Virut.E.gen!Eldorado"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Cyren.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Cyren.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "6.2.0.1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.DrWeb.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.DrWeb.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Trojan.DownLoader20.25948"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.DrWeb.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.DrWeb.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "7.0.34.11020"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ESET-NOD32.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ESET-NOD32.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32/Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ESET-NOD32.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ESET-NOD32.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "18744"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Emsisoft.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Emsisoft.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B (B)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Emsisoft.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Emsisoft.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018.4.0.1029"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Endgame.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Endgame.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "malicious (high confidence)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Endgame.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20181108"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Endgame.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "3.0.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Prot.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Prot.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Virut.E.gen!Eldorado"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Prot.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.F-Prot.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "4.7.1.166"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Secure.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Secure.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Secure.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.F-Secure.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "11.0.19100.45"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Fortinet.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Fortinet.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Fortinet.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Fortinet.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "5.4.247.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.GData.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.GData.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.GData.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.GData.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "A:25.20275B:25.14197"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ikarus.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ikarus.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Virut"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Ikarus.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Ikarus.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "0.1.5.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Invincea.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Invincea.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "heuristic"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Invincea.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20181128"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Invincea.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "6.3.6.26157"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Jiangmin.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Jiangmin.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32/Parite.b"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Jiangmin.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Jiangmin.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "16.0.100"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7AntiVirus.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7AntiVirus.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus ( 00001b711 )"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7AntiVirus.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7AntiVirus.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "11.24.29740"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7GW.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7GW.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus ( 00001b711 )"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7GW.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7GW.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "11.24.29740"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kaspersky.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kaspersky.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Parite.b"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kaspersky.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Kaspersky.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "15.0.1.13"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kingsoft.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kingsoft.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.b.5756"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kingsoft.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kingsoft.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2013.8.14.323"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MAX.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MAX.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "malware (ai score=100)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MAX.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MAX.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018.9.12.1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwarebytes.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwarebytes.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Trojan.Agent.QQ"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwarebytes.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwarebytes.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2.1.1.1115"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee-GW-Edition.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee-GW-Edition.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "BehavesLike.Win32.Pate.hh"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee-GW-Edition.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee-GW-Edition.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "v2017.3010"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Pate.b"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.McAfee.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "6.0.6.653"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MicroWorld-eScan.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MicroWorld-eScan.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MicroWorld-eScan.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MicroWorld-eScan.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "14.0.297.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Microsoft.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Microsoft.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus:Win32/Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Microsoft.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Microsoft.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.15500.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.NANO-Antivirus.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.NANO-Antivirus.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Parite.bgvo"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.NANO-Antivirus.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.NANO-Antivirus.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.134.24576"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Paloalto.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Paloalto.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "generic.ml"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Paloalto.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Paloalto.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Panda.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Panda.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Panda.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Panda.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "4.6.4.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Qihoo-360.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Qihoo-360.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Parite.H"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Qihoo-360.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Qihoo-360.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.0.1120"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Rising.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Rising.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Parite!1.9B80 (CLOUD)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Rising.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Rising.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "25.0.0.24"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SUPERAntiSpyware.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SUPERAntiSpyware.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SUPERAntiSpyware.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190116"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SUPERAntiSpyware.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "5.6.0.1032"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SentinelOne.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SentinelOne.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "static engine - malicious"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SentinelOne.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190118"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SentinelOne.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.21.268"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sophos.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sophos.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Parite-B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sophos.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sophos.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "4.98.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Symantec.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Symantec.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Trojan.Gen.6"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Symantec.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Symantec.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.8.0.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TACHYON.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TACHYON.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus/W32.Parite.C"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TACHYON.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TACHYON.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-01-21.02"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Tencent.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Tencent.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Dropper.c"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Tencent.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Tencent.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.0.1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TheHacker.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TheHacker.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "W32/Pate.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TheHacker.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190118"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TheHacker.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "6.8.0.5.3962"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TotalDefense.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TotalDefense.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32/Pinfi.A"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TotalDefense.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.TotalDefense.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "37.1.62.1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trapmine.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trapmine.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "malicious.high.ml.score"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trapmine.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190103"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trapmine.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "3.0.34.707"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "PE_PARITE.A"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro-HouseCall.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "10.0.0.1040"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "PE_PARITE.A"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.TrendMicro.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "10.0.0.1040"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trustlook.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trustlook.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trustlook.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trustlook.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VBA32.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VBA32.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Parite.b"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VBA32.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VBA32.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "3.35.1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VIPRE.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VIPRE.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.b (v)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VIPRE.update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VIPRE.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "None"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ViRobot.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ViRobot.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.A"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ViRobot.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ViRobot.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2014.3.20.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Webroot.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Webroot.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Webroot.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Webroot.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0.0.403"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Yandex.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Yandex.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Yandex.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190120"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.scans.Yandex.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "5.5.1.3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zillya.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zillya.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Parite.Win32.9"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zillya.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190118"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zillya.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "2.0.0.3733"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZoneAlarm.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZoneAlarm.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Virus.Win32.Parite.b"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZoneAlarm.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZoneAlarm.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zoner.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zoner.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Win32.Parite.B"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zoner.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zoner.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.eGambit.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.eGambit.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.eGambit.update",
                                        "data_type": "string",
                                        "example_values": [
                                            "20190122"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.eGambit.version",
                                        "data_type": "string",
                                        "example_values": [
                                            "v4.3.5"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.sha1",
                                        "data_type": "string",
                                        "example_values": [
                                            "6c1948f7edf115cd1f13cd170b882077930be150"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "27ce020f7cdb4b775b80bd6e3ef1d16079401e0d45cfd28ffbd8c63ff2ddf7d7"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            72
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string",
                                        "example_values": [
                                            "Scan finished, information embedded"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            64
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.total_scans",
                                        "data_type": "numeric",
                                        "example_values": [
                                            72
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Positives: 64, Total scans: 72"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "file reputation"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def file_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('file_reputation() called')\n\n    # collect data for 'file_reputation' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_2:condition_1:artifact:*.cef.fileHashMd5', 'filtered-data:filter_2:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'file_reputation' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'hash': filtered_artifacts_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"file reputation\", parameters=parameters, assets=['virustotal'], callback=file_reputation_callback, name=\"file_reputation\")\n\n    return",
                        "callback_code": "def file_reputation_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('file_reputation_callback() called')\n    \n    decision_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    join_decision_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_start": 167,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "file reputation",
                        "delay": 0,
                        "description": "Query reputation aggregators to determine whether the given hashes represent known malware.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "9cdd9e3e-df9b-448b-bf0d-01b6c5f594fb",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 175,
                        "line_start": 146,
                        "message": "Configuring now",
                        "name": "file reputation",
                        "notes": "Query reputation aggregators to determine whether the given hashes represent known malware.",
                        "number": 1,
                        "order": 8,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "file_reputation",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 257
                    },
                    {
                        "action": "snapshot vm",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "download": "",
                            "vmx_path": "filtered-data:filter_4:condition_1:list_vms_1:action_result.data.*.vmx_path"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "vSphere",
                                "app_version": "1.2.25",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "download": "",
                                    "vmx_path": "filtered-data:filter_4:condition_1:list_vms_1:action_result.data.*.vmx_path"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "vmwarevsphere",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.download",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "vm"
                                        ],
                                        "data_path": "action_result.parameter.vmx_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "vSphere Server",
                                        "column_order": 1,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.host",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "File name",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Snapshot size",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Vault ID",
                                        "column_order": 0,
                                        "contains": [
                                            "vault id",
                                            "os memory dump",
                                            "vm snapshot file"
                                        ],
                                        "data_path": "action_result.data.*.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vm"
                                        ],
                                        "data_path": "action_result.data.*.vmx_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "vSphere",
                                "product_vendor": "VMware",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "snapshot vm"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def snapshot_vm_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('snapshot_vm_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'snapshot_vm_1' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_4:condition_1:list_vms_1:action_result.data.*.vmx_path\", \"filtered-data:filter_4:condition_1:list_vms_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'snapshot_vm_1' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'download': \"\",\n                'vmx_path': filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"snapshot vm\", parameters=parameters, assets=['vmwarevsphere'], name=\"snapshot_vm_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "list vms",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Take snapshots of the detected virtual machines in case they are needed for forensics or recovery.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "db8d697e-e27e-463c-917c-ffebf0db2d8e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 202,
                        "line_start": 178,
                        "message": "Configuring now",
                        "name": "snapshot vm",
                        "notes": "Take snapshots of the detected virtual machines in case they are needed for forensics or recovery.",
                        "number": 1,
                        "order": 9,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 900,
                            "y": 780
                        },
                        "previous_function": "",
                        "previous_name": "snapshot_vm_1",
                        "required_params": {
                            "vmx_path": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 277
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_high(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_severity_high() called')\n\n    phantom.set_severity(container=container, severity=\"high\")\n    set_status_resolved(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "high"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "ip reputation, file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "set severity high",
                        "description": "Set the severity of this event to High.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "1288d542-54ab-4eed-9cd0-da0c66afe519",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 213,
                        "line_start": 205,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "Set the severity of this event to High.",
                        "number": 1,
                        "order": 10,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 900,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_high",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 282
                    },
                    {
                        "action": "hunt ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "end_time": "",
                            "ip": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress",
                            "max_threat_count": "",
                            "start_time": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "PhishMe Intelligence",
                                "app_version": "1.0.17",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress",
                                    "max_threat_count": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "phishme",
                                "output": [
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.apiReportURL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.hasReport",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.threatDetailURL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.label",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "phishme threat id"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.firstPublished",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.campaignBrandSet.*.brand.id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.campaignBrandSet.*.brand.text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.campaignBrandSet.*.totalCount",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.threatType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executiveSummary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.lastPublished",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.role",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.impact",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.blockType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.malwareFamily.familyName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.malwareFamily.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.roleDescription",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.infrastructureTypeSubclass.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.userType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.asn",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.isp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.latitude",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.lookupOn",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.timeZone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.longitude",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.metroCode",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.postalCode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.countryName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.organization",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.continentCode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.continentName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.countryIsoCode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.asnOrganization",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.subdivisionName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.ipDetail.subdivisionIsoCode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data_1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data_1.url",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data_1.host",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data_1.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data_1.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.blockSet.*.data_1.protocol",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.reportURL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.malwareFamilySet.*.familyName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.malwareFamilySet.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_threats",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.max_threat_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "PhishMe Intelligence",
                                "product_vendor": "PhishMe",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt ip"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_ip_1() called')\n\n    # collect data for 'hunt_ip_1' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_ip_1' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'ip': filtered_artifacts_item_1[0],\n                'max_threat_count': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt ip\", parameters=parameters, assets=['phishme'], name=\"hunt_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Query for threat information and observations about the given IP address.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "61de1a0d-de58-45cb-bf1c-e764af57fad0",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 263,
                        "line_start": 241,
                        "message": "Configuring now",
                        "name": "hunt ip",
                        "notes": "Query for threat information and observations about the given IP address.",
                        "number": 1,
                        "order": 12,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 500
                        },
                        "previous_function": "",
                        "previous_name": "hunt_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 284
                    },
                    {
                        "action": "list vms",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {},
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "vSphere",
                                "app_version": "1.2.25",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {},
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "vmwarevsphere",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Ip",
                                        "column_order": 2,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "State",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "OS",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.vm_full_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Host Name",
                                        "column_order": 0,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.vm_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.vm_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "VM",
                                        "column_order": 5,
                                        "contains": [
                                            "vm"
                                        ],
                                        "data_path": "action_result.data.*.vmx_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.running_vms",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_vms",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "vSphere",
                                "product_vendor": "VMware",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "list vms"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def list_vms_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('list_vms_1() called')\n\n    parameters = []\n\n    phantom.act(action=\"list vms\", parameters=parameters, assets=['vmwarevsphere'], callback=filter_4, name=\"list_vms_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "List all VMWare virtual machines to check if any snap shots should be taken.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2d9a376a-f95e-4c05-9be4-9ef197bc16e8",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 275,
                        "line_start": 266,
                        "message": "Configuring now",
                        "name": "list vms",
                        "notes": "List all VMWare virtual machines to check if any snap shots should be taken.",
                        "number": 1,
                        "order": 13,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 780
                        },
                        "previous_function": "",
                        "previous_name": "list_vms_1",
                        "required_params": {},
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 293
                    },
                    {
                        "action": "hunt file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "end_time": "",
                            "hash": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHashSha256",
                            "start_time": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "ProtectWise",
                                "app_version": "1.0.17",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "end_time": "",
                                    "hash": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHashSha256",
                                    "ph": "",
                                    "start_time": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "protectwise",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.end_time",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.start_time",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.behavior.network.dns.*.hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.behavior.network.dns.*.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.hosts",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.body",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.host",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.uri",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.user-agent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.http.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.behavior.network.tcp.*.dport",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.behavior.network.tcp.*.dst",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.behavior.network.tcp.*.sport",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.behavior.network.tcp.*.src",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.udp.*.dport",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.udp.*.dst",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.udp.*.sport",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.behavior.network.udp.*.src",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.info.detectedFileSize",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.info.detectedType",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.info.hashes.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.info.hashes.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.info.hashes.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha512"
                                        ],
                                        "data_path": "action_result.data.*.info.hashes.sha512",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.info.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.info.isArchive",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.info.isEncrypted",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.info.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.facets.fields.fileExtractedName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.facets.fields.fileExtractedName.23.exe",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.nextOffset",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.agentId",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.direction",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.dstGeo.lat",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.dstGeo.lon",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.dstIp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.dstMac",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.dstPort",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.layer3Proto",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.layer4Proto",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.proto",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.srcIp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.srcMac",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.ip.srcPort",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.associatedId.flowId.startTime",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.cid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.dstIp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.dstMac",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.dstPort",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.layer3Proto",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.layer4Proto",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.proto",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.srcIp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.srcMac",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.connectionInfo.srcPort",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.advertisedType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.detectedFileSize",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.detectedType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.extractedName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.extractedPath",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.finding.score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.hashes.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.hashes.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.hashes.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.hashes.sha512",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.isArchive",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.isEncrypted",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.isTruncated",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.isTypeMismatched",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.serviceType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.transportProtocol",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.data.fileReputation.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.dstGeo.lat",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.dstGeo.lon",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.info.coordinates.*.lat",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.info.coordinates.*.lon",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.info.ips",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.info.ports",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.killChainStage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.netflowId",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.observationDirection",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.observedAt",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.observedStage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.occurredAt",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.sensorId",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.source",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.threatLevel",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.threatScore",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.observations.results.*.threatSubCategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.detected_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.file_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.observation_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "ProtectWise",
                                "product_vendor": "ProtectWise",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt file sha256"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_file_sha256(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_file_sha256() called')\n\n    # collect data for 'hunt_file_sha256' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_3:condition_1:artifact:*.cef.fileHashSha256', 'filtered-data:filter_3:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_sha256' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'ph': \"\",\n                'hash': filtered_artifacts_item_1[0],\n                'end_time': \"\",\n                'start_time': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt file\", parameters=parameters, assets=['protectwise'], name=\"hunt_file_sha256\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "hunt file sha256",
                        "delay": 0,
                        "description": "Query across all the data sources integrated into Protectwise for observations of the given SHA-256 file hash.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "1816632d-6b2a-4e3b-9a49-404e2abeb5db",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 302,
                        "line_start": 278,
                        "message": "Configuring now",
                        "name": "hunt file",
                        "notes": "Query across all the data sources integrated into Protectwise for observations of the given SHA-256 file hash.",
                        "number": 1,
                        "order": 14,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "hunt_file_sha256",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 295
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_3() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        conditions=[\n            [\"artifact:*.cef.fileHashSha256\", \"!=\", \"\"],\n        ],\n        name=\"filter_3:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        hunt_file_sha256(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Filter the artifacts with SHA-256 file hashes.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c2a183b7-49f3-4577-9cb2-97b488bd1802",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 322,
                        "line_start": 305,
                        "name": "filter",
                        "notes": "Filter the artifacts with SHA-256 file hashes.",
                        "number": 3,
                        "order": 15,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "artifact:*.cef.fileHashSha256",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "filter_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 299
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_2() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        conditions=[\n            [\"artifact:*.cef.fileHashMd5\", \"!=\", \"\"],\n        ],\n        name=\"filter_2:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        file_reputation(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        hunt_file_md5(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Filter the artifacts with MD5 file hashes.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "821118fb-31b1-41c2-ba4b-586b16da582e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 343,
                        "line_start": 325,
                        "name": "filter",
                        "notes": "Filter the artifacts with MD5 file hashes.",
                        "number": 2,
                        "order": 16,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "artifact:*.cef.fileHashMd5",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 302
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        conditions=[\n            [\"artifact:*.cef.destinationAddress\", \"!=\", \"\"],\n        ],\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        hunt_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        ip_reputation(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Filter the artifacts with destination IP addresses.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "22ffe3c9-a408-4c2d-a56a-8e0ebea00ae7",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 364,
                        "line_start": 346,
                        "name": "filter",
                        "notes": "Filter the artifacts with destination IP addresses.",
                        "number": 1,
                        "order": 17,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "artifact:*.cef.destinationAddress",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 500
                        },
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 303
                    },
                    {
                        "action": "ip reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.37",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "Ip",
                                        "column_order": 0,
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "example_values": [
                                            "8.8.8.8"
                                        ]
                                    },
                                    {
                                        "column_name": "As Owner",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.as_owner",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test Inc."
                                        ]
                                    },
                                    {
                                        "column_name": "Asn",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.asn",
                                        "data_type": "string",
                                        "example_values": [
                                            "15169"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.continent",
                                        "data_type": "string",
                                        "example_values": [
                                            "NA"
                                        ]
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "US"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 08:27:02"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "95aea1163cd742d895f048de9b7f7ae83149ba2515b174dc6d5cfd910cb07ee3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            61
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2017-09-28 14:00:34"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "2b977b6342a624097b669fd2347ffbcbdc8a814369b5f431835793dbaa2251c8"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            57
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-02-14 12:35:57"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            25
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "6c16bbddc9dcbf447c44afb11387115ac657852fcdf30cf068cf6e11e8786212"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            70
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.scan_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 07:31:41"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            67
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.detected_urls.*.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "http://vanmaulop10.com/now/index.php?mail="
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.network",
                                        "data_type": "string",
                                        "example_values": [
                                            "8.8.8.0/24"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.resolutions.*.hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "*.o365answers.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolutions.*.last_resolved",
                                        "data_type": "string",
                                        "example_values": [
                                            "2015-12-10 00:00:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 09:03:52"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "414296de0c223c28910d99797701d4fa192208f4e30c32b0dc07da7602d7a4fb"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            57
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-01-30 20:23:21"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "23926e9185d8d43c02807a838ffb373cc1977726094a4e46807c66ada9dd7660"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            71
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_referrer_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.undetected_referrer_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "01e110d94eec3ec8abed7c9bb34fd7bcc3bd06c397ec83676431fc193be3b68e"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_referrer_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            55
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_urls.*",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-01 03:53:53"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string",
                                        "example_values": [
                                            "IP address in dataset"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.communicating_samples",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.detected_urls",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.downloaded_samples",
                                        "data_type": "numeric",
                                        "example_values": [
                                            11
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Downloaded samples: 11, Detected urls: 100, Communicating samples: 100"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    }
                                ],
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "ip reputation"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def ip_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('ip_reputation() called')\n\n    # collect data for 'ip_reputation' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_1:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'ip_reputation' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'ip': filtered_artifacts_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"ip reputation\", parameters=parameters, assets=['virustotal'], callback=ip_reputation_callback, name=\"ip_reputation\")\n\n    return",
                        "callback_code": "def ip_reputation_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('ip_reputation_callback() called')\n    \n    decision_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    join_decision_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_start": 388,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "ip reputation",
                        "delay": 0,
                        "description": "Query reputation services to determine whether the given IP address is known-good, known-bad, or unknown.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "40db4f96-3a24-464c-89f8-f47eee61e718",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 396,
                        "line_start": 367,
                        "message": "Configuring now",
                        "name": "ip reputation",
                        "notes": "Query reputation services to determine whether the given IP address is known-good, known-bad, or unknown.",
                        "number": 1,
                        "order": 18,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 640
                        },
                        "previous_function": "",
                        "previous_name": "ip_reputation",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 304
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "be785de0-203d-48d7-9f8a-ec0fc0aed776",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c27728f9-79e9-4300-a49c-5e4766fbb76c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "821118fb-31b1-41c2-ba4b-586b16da582e",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 305
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "4ce7164d-93df-49cb-af92-e387197ad08b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c27728f9-79e9-4300-a49c-5e4766fbb76c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "22ffe3c9-a408-4c2d-a56a-8e0ebea00ae7",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 306
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8fa5c0e4-5a4e-4796-8113-b6a42faa391e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c27728f9-79e9-4300-a49c-5e4766fbb76c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2d9a376a-f95e-4c05-9be4-9ef197bc16e8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 340,
                                "y": 800
                            }
                        ],
                        "z": 307
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_4() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"list_vms_1:action_result.data.*.ip\", \"==\", \"artifact:*.cef.sourceAddress\"],\n        ],\n        name=\"filter_4:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        snapshot_vm_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "list vms",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Only proceed with source addresses of virtual machines.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "b48b78fd-516d-41c0-a19a-66e5d670a7be",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 417,
                        "line_start": 399,
                        "name": "filter",
                        "notes": "Only proceed with source addresses of virtual machines.",
                        "number": 4,
                        "order": 19,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "list_vms_1:action_result.data.*.ip",
                                        "value": "artifact:*.cef.sourceAddress"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 780
                        },
                        "previous_function": "",
                        "previous_name": "filter_4",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 308
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_2() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation:action_result.data.*.detected_urls.*.positives\", \">=\", 15],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        NSX_block_IP(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Only proceed for IP's that resolved to 15 or more positives.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "59612f5c-53f4-41a4-8195-571fd4be0a2d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 438,
                        "line_start": 420,
                        "name": "decision",
                        "notes": "Only proceed for IP's that resolved to 15 or more positives.",
                        "number": 2,
                        "order": 20,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">=",
                                        "data_type": "",
                                        "param": "ip_reputation:action_result.data.*.detected_urls.*.positives",
                                        "value": "15"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 640
                        },
                        "previous_function": "",
                        "previous_name": "decision_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 309
                    },
                    {
                        "action": "block ip",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "ip_reputation:action_result.data.*.ip",
                            "is_source_address": "",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "NSX",
                                "app_version": "1.0.1",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "ip_reputation:action_result.data.*.ip"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "vmwarensx",
                                "output": [
                                    {
                                        "column_name": "ip",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "NSX",
                                "product_vendor": "VMware",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "NSX block IP"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def NSX_block_IP(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('NSX_block_IP() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'NSX_block_IP' call\n    results_data_1 = phantom.collect2(container=container, datapath=['ip_reputation:action_result.data.*.ip', 'ip_reputation:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'NSX_block_IP' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'ip': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"block ip\", parameters=parameters, assets=['vmwarensx'], name=\"NSX_block_IP\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "NSX block IP",
                        "delay": 0,
                        "description": "Now that we have determined that an IP is probably malicious we can add an NSX rule to block access to it.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "52a68829-7b20-4cfb-a794-22fd606a774b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 464,
                        "line_start": 441,
                        "message": "Configuring now",
                        "name": "block ip",
                        "notes": "Now that we have determined that an IP is probably malicious we can add an NSX rule to block access to it.",
                        "number": 1,
                        "order": 21,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 900,
                            "y": 640
                        },
                        "previous_function": "",
                        "previous_name": "NSX_block_IP",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 310
                    },
                    {
                        "action": "hunt file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_2:condition_1:artifact:*.cef.fileHashMd5",
                            "max_threat_count": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "PhishMe Intelligence",
                                "app_version": "1.0.17",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_2:condition_1:artifact:*.cef.fileHashMd5",
                                    "max_threat_count": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "phishme",
                                "output": [
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.apiReportURL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.hasReport",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.vendorDetections.*.threatVendorName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.vendorDetections.*.detected",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.executableSubtype.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.md5Hex",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.ssdeep",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.sha1Hex",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.fileName",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha224"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.sha224Hex",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.sha256Hex",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha384"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.sha384Hex",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha512"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.sha512Hex",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.dateEntered",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.malwareFamily.familyName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.malwareFamily.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executableSet.*.fileNameExtension",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.threatDetailURL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.label",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "phishme threat id"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.firstPublished",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.campaignBrandSet.*.brand.id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.campaignBrandSet.*.brand.text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.campaignBrandSet.*.totalCount",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.threatType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.executiveSummary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.lastPublished",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.data.threats.*.reportURL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.malwareFamilySet.*.familyName",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.data.threats.*.malwareFamilySet.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_threats",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.max_threat_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "PhishMe Intelligence",
                                "product_vendor": "PhishMe",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt file md5"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_file_md5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_file_md5() called')\n\n    # collect data for 'hunt_file_md5' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_2:condition_1:artifact:*.cef.fileHashMd5', 'filtered-data:filter_2:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_md5' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'hash': filtered_artifacts_item_1[0],\n                'max_threat_count': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt file\", parameters=parameters, assets=['phishme'], name=\"hunt_file_md5\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "hunt file md5",
                        "delay": 0,
                        "description": "Query the PhishMe Intelligence platform for threat information about files with the given MD5 hash.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c8cafab5-8536-4d2a-a88e-52d2c5eba3f3",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 238,
                        "line_start": 216,
                        "message": "Configuring now",
                        "name": "hunt file",
                        "notes": "Query the PhishMe Intelligence platform for threat information about files with the given MD5 hash.",
                        "number": 2,
                        "order": 11,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "hunt_file_md5",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 311
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set status",
                        "attrs": {
                            ".api": {
                                "text": "set status"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_status_resolved_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_status_resolved_2() called')\n\n    phantom.set_status(container=container, status=\"closed\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-status",
                                "setStatusStatus": "closed"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "ip reputation, file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "set status resolved 2",
                        "description": "Resolve this event. The enrichment and the history of any blocking actions taken can still be reviewed in Mission Control and reopened if further action is necessary.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ed9219e9-3fc5-4677-8557-5377f16a0ba2",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 143,
                        "line_start": 136,
                        "message": "Configuring now",
                        "name": "set status",
                        "notes": "Resolve this event. The enrichment and the history of any blocking actions taken can still be reviewed in Mission Control and reopened if further action is necessary.",
                        "number": 4,
                        "order": 7,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1140,
                            "y": 500
                        },
                        "previous_function": "",
                        "previous_name": "set_status_resolved_2",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 312
                    }
                ]
            },
            "notes": "This playbook uses the following Apps:\n - VMWare vSphere (list vms, snapshot vm) [asset name = vmwaresphere] - enumerates and snapshots virtual machines\n - VMWare NSX (block ip) [asset name = vmwarensx] - allows control of the virtual firewall in NSX\n - CarbonBlack Response (block hash) [asset name = carbonblack] - denies execution of malware using the CarbonBlack Response banning blacklist\n - ProtectWise (hunt file, hunt ip) [asset name = protectwise] - supports queries across all data sources ingested into ProtectWise\n - PhishMe (hunt file, hunt ip) [asset name = phishme] - supports queries against PhishMe's threat intelligence database\n - ThreatStream (file reputation, ip reputation) [asset name = threatstream]  - provides threat intelligence data for reputation queries\n - VirusTotal (file reputation, ip reputation) [asset name = virustotal]  - supports reputation queries against a large set of detection engines\n\nDeployment notes:\n - the command and control alert that initiates this Playbook could come from a wide variety of SIEM's or other alerting systems. when available the alert should be configured to populate the following CEF fields:\n        fileHashSha256 and fileHashMd5 - the hashes of any files found associated with the communicating malware\n        destinationAddress - the external IP address of the detected command and control server\n        sourceAddress - the internal IP address of the machine found calling out to the command and control server\n - the thresholds for threat intelligence and reputation services can be adjusted according to desired sensitivity\n - virtual machine snapshots can be analyzed statically or resumed in a quarantined environment for further analysis"
        },
        "python_version": "3",
        "schema": 4,
        "version": "4.10.0.40961"
    },
    "create_time": "2021-02-11T21:29:13.214795+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ],
    "tags": [],
    "misc": {
        "apps_list": [
            "vSphere",
            "NSX",
            "Carbon Black Response",
            "ProtectWise",
            "PhishMe",
            "ThreatStream",
            "VirusTotal"
        ]
    }
}