zscaler_hunt_and_block_url.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Use Cases",
    "coa": {
        "data": {
            "clean": true,
            "code_block": "",
            "description": "When a suspicious URL is detected, this playbook can be used to identify internal devices that have accessed that URL and triage the organizational importance of those devices. Then, depending on the maliciousness of the URL and whether or not the affected device belongs to an executive in the organization,  the URL will be blocked and an appropriate ServiceNow ticket will be created.",
            "hash": "41a1e226234a41dae702cec95594751e8aa58b3e",
            "joint": {
                "cells": [
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "ref-y": 8,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'url_reputation_2' block\n    url_reputation_2(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5aaad0ee-9ffc-4bc3-9950-8645c3371f1e",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 16,
                        "line_start": 8,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 100,
                            "y": 100
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 1
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "create exec ticket, create regular ticket, quarantine exec device, block url",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6756bd6e-8b86-4e1d-955b-ba4d9cdd8237",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 574,
                        "line_start": 561,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 24,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1800,
                            "y": 740
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 2
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e114bb4f-ec17-43df-995d-caf3b2e891b0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5703dfbb-5e6d-4399-bcbd-8e4a9b0c4b94",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5d29573e-6f1c-4a3a-b0f6-c505f19063a3",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 13
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b7f5d040-f91f-4aec-b310-3fdc82ca1dab",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5aaad0ee-9ffc-4bc3-9950-8645c3371f1e",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5a47e570-9abd-4499-990f-c83b4057ceb9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 80
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c952bead-c064-4eb8-843c-b5f801631ce1",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5a47e570-9abd-4499-990f-c83b4057ceb9",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "10b2613c-8a2b-4376-894d-f61c6d7ee85e",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 82
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "23d3ab42-69ab-4539-9577-f4ff337d7c8e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "10b2613c-8a2b-4376-894d-f61c6d7ee85e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5703dfbb-5e6d-4399-bcbd-8e4a9b0c4b94",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 86
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "126a3c8a-72e5-4b13-b2c1-1bbf32f4d0b0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5d29573e-6f1c-4a3a-b0f6-c505f19063a3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "9dd5af6e-9e94-41fa-83be-1a2d5f47ef0c",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 95
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "98558904-927a-488b-b9c9-edfa02002d95",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6b3de355-ae9c-408b-aa5f-546bc289e82e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "36f6174e-144b-42fd-b08f-d7a6e6ec505f",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 171
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0121f317-8814-40b3-9e65-756a2bd65cce",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "36f6174e-144b-42fd-b08f-d7a6e6ec505f",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5572cced-9190-4895-8974-230379ffded9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 201
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "27fabe6a-c369-458f-a295-95fb12b527d9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "36f6174e-144b-42fd-b08f-d7a6e6ec505f",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "dc7df8ac-4a01-4d1a-baa5-f2a1e0ea74d0",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 214
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f96e8e79-8889-4866-ac06-2fc55e6f6d12",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "dc7df8ac-4a01-4d1a-baa5-f2a1e0ea74d0",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "32a52a63-f735-45bf-a82c-c561dc480d04",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 218
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "39ab88c8-4d21-4749-b340-4f3abcc15685",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6b3de355-ae9c-408b-aa5f-546bc289e82e",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2d50b550-cdb3-408a-8772-ab36d7243f14",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 224
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "59bcccba-934a-4b76-b797-74c720235470",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5572cced-9190-4895-8974-230379ffded9",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "79628831-7c59-4594-b7c2-f95d7475e301",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 228
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "45f88d43-4070-40df-8dff-24a30dee27e6",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "79628831-7c59-4594-b7c2-f95d7475e301",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e18bd7a1-44ee-4ebe-a136-0d1f924f2d28",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 230
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "194fcf3a-2272-4647-810a-21470fa68d23",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "e18bd7a1-44ee-4ebe-a136-0d1f924f2d28",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2eaca4dd-5849-422b-846d-14efd3f5425c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 232
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "6aaaf267-3e83-4e3d-b435-9b56ed222a5c",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "32a52a63-f735-45bf-a82c-c561dc480d04",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "51994229-aa8d-45b1-8abb-04fc8a979aa6",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 234
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0220d27f-4c38-4a73-a720-c8774bae30f9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "51994229-aa8d-45b1-8abb-04fc8a979aa6",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "7d381b5e-314c-4ff1-bf20-14e04bfd1445",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 237
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7f91bfb2-22aa-408b-976c-8237f313f3d8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "7d381b5e-314c-4ff1-bf20-14e04bfd1445",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0d179d3a-ded3-494c-9526-6c4572625f01",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 249
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "01a62efd-1d21-4ad2-872e-609dc13802b4",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5572cced-9190-4895-8974-230379ffded9",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "1d75e000-9241-49e8-a808-7ed151d996e0",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 257
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "a268861c-fffc-4794-921d-07e7a8a32f07",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "1d75e000-9241-49e8-a808-7ed151d996e0",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ddb2aa22-0bd5-44d3-a9c9-be43df0899e9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 260
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "38120def-9808-4a89-9aee-b79744a02937",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ddb2aa22-0bd5-44d3-a9c9-be43df0899e9",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "57675b11-5398-4275-967c-516b3757972b",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 262
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "361907ad-8094-49bb-8885-4af58b1721ba",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9dd5af6e-9e94-41fa-83be-1a2d5f47ef0c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6b3de355-ae9c-408b-aa5f-546bc289e82e",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 268
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e2e96420-41e2-4906-b44b-3668986ad2fa",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2eaca4dd-5849-422b-846d-14efd3f5425c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6756bd6e-8b86-4e1d-955b-ba4d9cdd8237",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 287
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b887c1fd-5d16-4ccb-b932-8bab59064352",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0d179d3a-ded3-494c-9526-6c4572625f01",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6756bd6e-8b86-4e1d-955b-ba4d9cdd8237",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 288
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "49682c0b-bbee-4829-aee3-722cae7a43ba",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "57675b11-5398-4275-967c-516b3757972b",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6756bd6e-8b86-4e1d-955b-ba4d9cdd8237",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 296
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "02a7130a-d2b5-4632-9a46-210929096e09",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "cbb5429a-4264-4d35-b1a6-939a110fe1f5",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6756bd6e-8b86-4e1d-955b-ba4d9cdd8237",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 297
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_1() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"url_reputation_2:action_result.summary.positives\", \">\", 4],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        format_splunk_query(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "url reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Continue if the URL has over 4 positive scans.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "10b2613c-8a2b-4376-894d-f61c6d7ee85e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 35,
                        "line_end": 61,
                        "line_start": 43,
                        "name": "decision",
                        "notes": "Continue if the URL has over 4 positive scans.",
                        "number": 1,
                        "order": 3,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "url_reputation_2:action_result.summary.positives",
                                        "value": "4"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 480,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "decision_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 340
                    },
                    {
                        "action": "get user attributes",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attribute": "",
                            "fields": "",
                            "username": "run_query_1:action_result.data.*.User"
                        },
                        "angle": 0,
                        "app": "LDAP",
                        "appid": "84110F27-6602-4DC8-A6F2-0311B1720BF8",
                        "approver": "",
                        "assets": [
                            {
                                "action": "get user attributes",
                                "active": true,
                                "app_name": "LDAP",
                                "app_version": "1.2.35",
                                "appid": "84110F27-6602-4DC8-A6F2-0311B1720BF8",
                                "config_type": "app",
                                "fields": {
                                    "attribute": "",
                                    "fields": "",
                                    "username": "run_query_1:action_result.data.*.User"
                                },
                                "has_app": true,
                                "id": 39,
                                "loaded": false,
                                "missing": false,
                                "name": "LDAP",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.parameter.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.fields",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.attribute",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Display Name",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.displayname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Distinguished Name",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.distinguishedname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Last Logon",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.lastlogon",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Last Logoff",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.lastlogoff",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Logon Count",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.logoncount",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Member Of",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.memberof",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Bad Pwd Count",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.badpwdcount",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "E-Mail",
                                        "column_order": 7,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.mail",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Title",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Street",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.streetaddress",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "City",
                                        "column_order": 10,
                                        "data_path": "action_result.data.*.l",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "State",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.st",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Zip",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.postalcode",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 13,
                                        "data_path": "action_result.data.*.co",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.accountexpires",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.badpasswordtime",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.countrycode",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.objectcategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.objectclass",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.objectguid",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Primary Group Id",
                                        "column_order": 14,
                                        "data_path": "action_result.data.*.primarygroupid",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Pwd Last Set",
                                        "column_order": 15,
                                        "data_path": "action_result.data.*.pwdlastset",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "User Account Control",
                                        "column_order": 16,
                                        "data_path": "action_result.data.*.useraccountcontrol",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "User Principal Name",
                                        "column_order": 17,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.userprincipalname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Object SID",
                                        "column_order": 18,
                                        "data_path": "action_result.data.*.objectsid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.whenchanged",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "When Created",
                                        "column_order": 19,
                                        "data_path": "action_result.data.*.whencreated",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cn",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.codepage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.dscorepropagationdata",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.givenname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.instancetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Username",
                                        "column_order": 0,
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.samaccountname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.samaccounttype",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sn",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.usnchanged",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.usncreated",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.telephoneNumber",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.manager",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.company",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.department",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.postOfficeBox",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.password_last_set",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.bad_password_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.last_logon",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "parameters": {
                                    "attribute": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Attribute name to match",
                                        "key": "attribute",
                                        "order": 1,
                                        "primary": false,
                                        "required": false
                                    },
                                    "fields": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Get fields (comma separated)",
                                        "key": "fields",
                                        "order": 2,
                                        "required": false
                                    },
                                    "username": {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Username or Attribute value to match",
                                        "key": "username",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Windows Server",
                                "product_vendor": "Microsoft",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get user attributes"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def get_user_attributes_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('get_user_attributes_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_user_attributes_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['run_query_1:action_result.data.*.User', 'run_query_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'get_user_attributes_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'fields': \"\",\n                'username': results_item_1[0],\n                'attribute': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"get user attributes\", parameters=parameters, app={ \"name\": 'LDAP' }, callback=decision_5, name=\"get_user_attributes_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "run query",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Query Active Directory for information about the username retrieved from Splunk.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "9dd5af6e-9e94-41fa-83be-1a2d5f47ef0c",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 223,
                        "line_start": 198,
                        "message": "Configuring now",
                        "name": "get user attributes",
                        "notes": "Query Active Directory for information about the username retrieved from Splunk.",
                        "number": 1,
                        "order": 10,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1100,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "get_user_attributes_1",
                        "required_params": {
                            "username": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_config",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 347
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 5
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_5() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"run_query_1:action_result.data.*.policy_action\", \"==\", \"Allowed\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        filter_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        lookup_url_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Only proceed if the URL request was allowed by zScaler.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6b3de355-ae9c-408b-aa5f-546bc289e82e",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 245,
                        "line_start": 226,
                        "name": "decision",
                        "notes": "Only proceed if the URL request was allowed by zScaler.",
                        "number": 5,
                        "order": 11,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "run_query_1:action_result.data.*.policy_action",
                                        "value": "Allowed"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 480,
                            "y": 300
                        },
                        "previous_function": "",
                        "previous_name": "decision_5",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 349
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_2() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"run_query_1:action_result.data.*.User\", \"==\", \"filtered-data:filter_1:condition_1:get_user_attributes_1:action_result.parameter.username\"],\n        ],\n        name=\"filter_2:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        exec_short_description(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        prompt_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Match back to the username of the executive.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5572cced-9190-4895-8974-230379ffded9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 83,
                        "line_start": 64,
                        "name": "filter",
                        "notes": "Match back to the username of the executive.",
                        "number": 2,
                        "order": 4,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "run_query_1:action_result.data.*.User",
                                        "value": "filtered-data:filter_1:condition_1:get_user_attributes_1:action_result.parameter.username"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 300
                        },
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 354
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 7
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_7(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_7() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"prompt_1:action_result.summary.responses.0\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        quarantine_exec_device(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "prompt 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Check the prompt response.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ddb2aa22-0bd5-44d3-a9c9-be43df0899e9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 125,
                        "line_start": 107,
                        "name": "decision",
                        "notes": "Check the prompt response.",
                        "number": 7,
                        "order": 6,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "prompt_1:action_result.summary.responses.0",
                                        "value": "Yes"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1040,
                            "y": 300
                        },
                        "previous_function": "",
                        "previous_name": "decision_7",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 358
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_3() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"run_query_1:action_result.data.*.User\", \"==\", \"filtered-data:filter_1:condition_2:get_user_attributes_1:action_result.parameter.username\"],\n        ],\n        name=\"filter_3:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        quarantine_regular_device(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Match back to the non-executive username.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "dc7df8ac-4a01-4d1a-baa5-f2a1e0ea74d0",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 104,
                        "line_start": 86,
                        "name": "filter",
                        "notes": "Match back to the non-executive username.",
                        "number": 3,
                        "order": 5,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "run_query_1:action_result.data.*.User",
                                        "value": "filtered-data:filter_1:condition_2:get_user_attributes_1:action_result.parameter.username"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 700,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "filter_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 362
                    },
                    {
                        "action": "quarantine device",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "filtered-data:filter_3:condition_1:run_query_1:action_result.data.*.client_ip"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "quarantine device",
                                "active": true,
                                "app_name": "Carbon Black Response",
                                "app_version": "1.2.86",
                                "appid": "",
                                "asset_name": "carbonblack",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "ip_hostname": "filtered-data:filter_3:condition_1:run_query_1:action_result.data.*.client_ip"
                                },
                                "has_app": true,
                                "id": 100,
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "Name/IP",
                                        "column_order": 0,
                                        "contains": [
                                            "host name",
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "cb-lab"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Quarantine action succeeded. It might take some time for endpoint to get isolated."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "ip_hostname": {
                                        "contains": [
                                            "host name",
                                            "ip"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Hostname/IP of endpoint to quarantine",
                                        "key": "ip_hostname",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Carbon Black",
                                "product_vendor": "Bit9",
                                "targets": "61",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "quarantine regular device"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def quarantine_regular_device(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_regular_device() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'quarantine_regular_device' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_3:condition_1:run_query_1:action_result.data.*.client_ip\", \"filtered-data:filter_3:condition_1:run_query_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'quarantine_regular_device' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'ip_hostname': filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"quarantine device\", parameters=parameters, assets=['carbonblack'], callback=regular_short_description, name=\"quarantine_regular_device\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "quarantine regular device",
                        "delay": 0,
                        "description": "Quarantine the non-executive device.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "32a52a63-f735-45bf-a82c-c561dc480d04",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 540,
                        "line_start": 517,
                        "message": "Configuring now",
                        "name": "quarantine device",
                        "notes": "Quarantine the non-executive device.",
                        "number": 4,
                        "order": 22,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "quarantine_regular_device",
                        "required_params": {
                            "ip_hostname": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 363
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "exec short description"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def exec_short_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('exec_short_description() called')\n    \n    template = \"\"\"Please Investigate Executive Workstation - {0}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_2:condition_1:run_query_1:action_result.data.*.client_ip\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"exec_short_description\")\n\n    exec_long_description(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "exec short description",
                        "description": "Format the short description (title) of the ticket.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "79628831-7c59-4594-b7c2-f95d7475e301",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 428,
                        "line_start": 412,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format the short description (title) of the ticket.",
                        "number": 2,
                        "order": 18,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "filtered-data:filter_2:condition_1:run_query_1:action_result.data.*.client_ip"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1080,
                            "y": 440
                        },
                        "previous_function": "",
                        "previous_name": "exec_short_description",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "Please Investigate Executive Workstation - {0}",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 366
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "regular short description"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def regular_short_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('regular_short_description() called')\n    \n    template = \"\"\"Endpoint connected to malicious URL - {0}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_3:condition_1:run_query_1:action_result.data.*.client_ip\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"regular_short_description\")\n\n    regular_long_description(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "quarantine regular device",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "regular short description",
                        "description": "Format the short description (title) of the ticket.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "51994229-aa8d-45b1-8abb-04fc8a979aa6",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 351,
                        "line_start": 335,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format the short description (title) of the ticket.",
                        "number": 4,
                        "order": 15,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "filtered-data:filter_3:condition_1:run_query_1:action_result.data.*.client_ip"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1080,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "regular_short_description",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "Endpoint connected to malicious URL - {0}",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 367
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "exec long description"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def exec_long_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('exec_long_description() called')\n    \n    template = \"\"\"Executive was trying to access a known bad URL:\n{0}\n\nPositives from VirusTotal: {1}\n\nLink to Phantom Incident: \nhttps://172.16.22.128/mission/{3}\n\nSplunk Results: \n{2}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.requestURL\",\n        \"url_reputation_2:action_result.summary.positives\",\n        \"filtered-data:filter_2:condition_1:run_query_1:action_result.data.*._raw\",\n        \"container:id\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"exec_long_description\")\n\n    create_exec_ticket(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "exec long description",
                        "description": "Format the long-form description of the ticket.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "e18bd7a1-44ee-4ebe-a136-0d1f924f2d28",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 459,
                        "line_start": 431,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format the long-form description of the ticket.",
                        "number": 3,
                        "order": 19,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "artifact:*.cef.requestURL"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "url_reputation_2:action_result.summary.positives"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "filtered-data:filter_2:condition_1:run_query_1:action_result.data.*._raw"
                            },
                            {
                                "position": 3,
                                "type": "",
                                "value": "container:id"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1320,
                            "y": 440
                        },
                        "previous_function": "",
                        "previous_name": "exec_long_description",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "Executive was trying to access a known bad URL:\n{0}\n\nPositives from VirusTotal: {1}\n\nLink to Phantom Incident: \nhttps://172.16.22.128/mission/{3}\n\nSplunk Results: \n{2}",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 368
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "regular long description"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def regular_long_description(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('regular_long_description() called')\n    \n    template = \"\"\"Endpoint as trying to access a known bad URL:\n{0}\n\nPositives from VirusTotal: {1}\n\nLink to Phantom Incident: \nhttps://172.16.22.128/mission/{3}\n\nSplunk Results: \n{2}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"artifact:*.cef.requestURL\",\n        \"url_reputation_2:action_result.summary.positives\",\n        \"filtered-data:filter_3:condition_1:run_query_1:action_result.data.*._raw\",\n        \"container:id\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"regular_long_description\")\n\n    create_regular_ticket(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "quarantine regular device",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "regular long description",
                        "description": "Format the long-form description of the ticket.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "7d381b5e-314c-4ff1-bf20-14e04bfd1445",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 382,
                        "line_start": 354,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format the long-form description of the ticket.",
                        "number": 5,
                        "order": 16,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "artifact:*.cef.requestURL"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "url_reputation_2:action_result.summary.positives"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "filtered-data:filter_3:condition_1:run_query_1:action_result.data.*._raw"
                            },
                            {
                                "position": 3,
                                "type": "",
                                "value": "container:id"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1320,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "regular_long_description",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "Endpoint as trying to access a known bad URL:\n{0}\n\nPositives from VirusTotal: {1}\n\nLink to Phantom Incident: \nhttps://172.16.22.128/mission/{3}\n\nSplunk Results: \n{2}",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 369
                    },
                    {
                        "action": "create ticket",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "description": "Executive_Long_Description:formatted_data",
                            "fields": "{\"urgency\":\"1\"}",
                            "short_description": "Executive_Short_Description:formatted_data",
                            "table": "incident",
                            "vault_id": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "create ticket",
                                "active": true,
                                "app_name": "ServiceNow",
                                "app_version": "1.2.36",
                                "appid": "",
                                "asset_name": "personal dev snow",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "description": "exec_long_description:formatted_data",
                                    "fields": "{\"urgency\":\"1\"}",
                                    "short_description": "exec_short_description:formatted_data",
                                    "table": "incident",
                                    "vault_id": ""
                                },
                                "has_app": true,
                                "id": 85,
                                "loaded": false,
                                "missing": false,
                                "name": "servicenow",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.description",
                                        "data_type": "string",
                                        "example_values": [
                                            "Investigative actions to check for the presence of phapp_servicenow"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.fields",
                                        "data_type": "string",
                                        "example_values": [
                                            "{\"made_sla\":true,\"severity\":3,\"description\":\"This is testing description\"}"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.short_description",
                                        "data_type": "string",
                                        "example_values": [
                                            "phapp_servicenow, Multiple action need to be taken"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "servicenow table"
                                        ],
                                        "data_path": "action_result.parameter.table",
                                        "data_type": "string",
                                        "example_values": [
                                            "incident"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "8d0b13046973703f5783977c41a76ac31b4bf8ad"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.service_offering",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.u_short_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.stockroom",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://dev78070.service-now.com/api/now/table/cmdb_model/phantomqa"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.model.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "phantomqa"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.ci",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cost",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.due_in",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.vendor",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.retired",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.lease_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.owned_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.quantity",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.residual",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.asset_tag",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.po_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.skip_sync",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.substatus",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.checked_in",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.department",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.gl_account",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.managed_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.old_status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.order_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.beneficiary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.checked_out",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cost_center",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.depreciation",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.display_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.install_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.request_line",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resale_price",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.reserved_for",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.supported_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.justification",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.old_substatus",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.pre_allocated",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.purchase_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.residual_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.salvage_value",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.serial_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.support_group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.install_status",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.invoice_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model_category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.disposal_reason",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.retirement_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.expenditure_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.depreciation_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.acquisition_method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.depreciated_amount",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.warranty_expiration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "254395830ef2e6c1ef61063b2cc734a008c645dc8455c498633eecef85324158"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.rights",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.location.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://dev78070.service-now.com/api/now/table/cmn_location/25b3d04b0a0a0bb300176b546c22db27"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.location.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "25b3d04b0a0a0bb300176b546c22db27"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.license_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.merged_into",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model_category.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://dev78070.service-now.com/api/now/table/cmdb_model_category/35bf2d4137101000deeabfc8bcbe5dbd"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.model_category.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "35bf2d4137101000deeabfc8bcbe5dbd"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.is_merged_license",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_condition",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.entitlement_condition",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.active",
                                        "data_type": "string",
                                        "example_values": [
                                            "true"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.activity_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.additional_assignee_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval",
                                        "data_type": "string",
                                        "example_values": [
                                            "not requested"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_set",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://devtest2704.service-now.com/api/now/table/sys_user/d8f57f140b20220050192f15d6673a98"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "d8f57f140b20220050192f15d6673a98"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.assignment_group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.average_image_color",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.chunk_size_bytes",
                                        "data_type": "string",
                                        "example_values": [
                                            "734003"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.content_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.download_link",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_height",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_width",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_bytes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "available"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_mod_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.caller_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string",
                                        "example_values": [
                                            "inquiry"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.caused_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.child_incidents",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Closed On",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.closed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.closed_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cmdb_ci",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments_and_work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.company",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contact_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_plan",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_task",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Description",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.description",
                                        "data_type": "string",
                                        "example_values": [
                                            "Investigative actions to check for the presence of phapp_servicenow\n\nAdded by Splunk for container id: 495"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.due_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.escalation",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.expected_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.follow_up",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.group_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.hold_reason",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.impact",
                                        "data_type": "string",
                                        "example_values": [
                                            "3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.incident_state",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.knowledge",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.location",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.made_sla",
                                        "data_type": "string",
                                        "example_values": [
                                            "true"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.notify",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "column_name": "Ticket Number",
                                        "column_order": 0,
                                        "contains": [
                                            "servicenow ticket number"
                                        ],
                                        "data_path": "action_result.data.*.number",
                                        "data_type": "string",
                                        "example_values": [
                                            "INC0000001"
                                        ]
                                    },
                                    {
                                        "column_name": "Opened On",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.opened_at",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-11-22 09:57:05"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.opened_by.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://devtest.service-now.com/api/now/table/sys_user/6816f79cc0a8016401c5a33be04be441"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.opened_by.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "6816f79cc0a8016401c5a33be04be441"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.order",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent_incident",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Priority",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.priority",
                                        "data_type": "string",
                                        "example_values": [
                                            "5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.problem_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reassignment_count",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopen_count",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopened_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopened_time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.rfc",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Severity",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.severity",
                                        "data_type": "string",
                                        "example_values": [
                                            "3"
                                        ]
                                    },
                                    {
                                        "column_name": "Short Description",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.short_description",
                                        "data_type": "string",
                                        "example_values": [
                                            "phapp_servicenow, Multiple action need to be taken"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sla_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.subcategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_class_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "incident"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_by",
                                        "data_type": "string",
                                        "example_values": [
                                            "admin"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_on",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-11-22 09:57:05"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.sys_domain.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://devtest.service-now.com/api/now/table/sys_user_group/global"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "global"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.sys_domain_path",
                                        "data_type": "string",
                                        "example_values": [
                                            "/"
                                        ]
                                    },
                                    {
                                        "column_name": "ID",
                                        "column_order": 3,
                                        "contains": [
                                            "servicenow ticket sysid",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.sys_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "e19eff67db716300134cd100cf961915"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_mod_count",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_by",
                                        "data_type": "string",
                                        "example_values": [
                                            "admin"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_on",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-11-22 09:57:05"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.time_worked",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_approval",
                                        "data_type": "string",
                                        "example_values": [
                                            "proceed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_reject",
                                        "data_type": "string",
                                        "example_values": [
                                            "cancel"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.urgency",
                                        "data_type": "string",
                                        "example_values": [
                                            "3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.user_input",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.watch_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_end",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_added",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_error",
                                        "data_type": "string",
                                        "example_values": [
                                            "File not found in Vault"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "servicenow ticket sysid",
                                            "md5"
                                        ],
                                        "data_path": "action_result.summary.created_ticket_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "e19eff67db716300134cd100cf961915"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Created ticket id: e19eff67db716300134cd100cf961915"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "description": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Ticket description",
                                        "key": "description",
                                        "order": 1,
                                        "required": false
                                    },
                                    "fields": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "JSON containing field values",
                                        "key": "fields",
                                        "order": 3,
                                        "required": false
                                    },
                                    "short_description": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Ticket short description",
                                        "key": "short_description",
                                        "order": 0,
                                        "required": false
                                    },
                                    "table": {
                                        "contains": [
                                            "servicenow table"
                                        ],
                                        "data_type": "string",
                                        "default": "incident",
                                        "description": "Table to add to",
                                        "key": "table",
                                        "order": 2,
                                        "required": false
                                    },
                                    "vault_id": {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Vault ID of file to attach to ticket",
                                        "key": "vault_id",
                                        "order": 4,
                                        "required": false
                                    }
                                },
                                "product_name": "ServiceNow",
                                "product_vendor": "ServiceNow",
                                "targets": "160",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "create exec ticket"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def create_exec_ticket(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('create_exec_ticket() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'create_exec_ticket' call\n    formatted_data_1 = phantom.get_format_data(name='exec_long_description')\n    formatted_data_2 = phantom.get_format_data(name='exec_short_description')\n\n    parameters = []\n    \n    # build parameters list for 'create_exec_ticket' call\n    parameters.append({\n        'table': \"incident\",\n        'fields': \"{\\\"urgency\\\":\\\"1\\\"}\",\n        'vault_id': \"\",\n        'description': formatted_data_1,\n        'short_description': formatted_data_2,\n    })\n\n    phantom.act(action=\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_exec_ticket\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "create exec ticket",
                        "delay": 0,
                        "description": "Create the ServiceNow ticket with the formatted short description and long description.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2eaca4dd-5849-422b-846d-14efd3f5425c",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 486,
                        "line_start": 462,
                        "message": "Configuring now",
                        "name": "create ticket",
                        "notes": "Create the ServiceNow ticket with the formatted short description and long description.",
                        "number": 4,
                        "order": 20,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1560,
                            "y": 440
                        },
                        "previous_function": "",
                        "previous_name": "create_exec_ticket",
                        "required_params": {},
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 370
                    },
                    {
                        "action": "create ticket",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "description": "Standard_Long_Description:formatted_data",
                            "fields": "{\"urgency\":\"2\"}",
                            "short_description": "Standard_Short_Description:formatted_data",
                            "table": "incident",
                            "vault_id": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "create ticket",
                                "active": true,
                                "app_name": "ServiceNow",
                                "app_version": "1.2.36",
                                "appid": "",
                                "asset_name": "personal dev snow",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "description": "regular_long_description:formatted_data",
                                    "fields": "{\"urgency\":\"2\"}",
                                    "short_description": "regular_short_description:formatted_data",
                                    "table": "incident",
                                    "vault_id": ""
                                },
                                "has_app": true,
                                "id": 85,
                                "loaded": false,
                                "missing": false,
                                "name": "servicenow",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.description",
                                        "data_type": "string",
                                        "example_values": [
                                            "Investigative actions to check for the presence of phapp_servicenow"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.fields",
                                        "data_type": "string",
                                        "example_values": [
                                            "{\"made_sla\":true,\"severity\":3,\"description\":\"This is testing description\"}"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.short_description",
                                        "data_type": "string",
                                        "example_values": [
                                            "phapp_servicenow, Multiple action need to be taken"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "servicenow table"
                                        ],
                                        "data_path": "action_result.parameter.table",
                                        "data_type": "string",
                                        "example_values": [
                                            "incident"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "8d0b13046973703f5783977c41a76ac31b4bf8ad"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.service_offering",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.u_short_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.stockroom",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://dev78070.service-now.com/api/now/table/cmdb_model/phantomqa"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.model.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "phantomqa"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.ci",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cost",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.due_in",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.vendor",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.retired",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.lease_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.owned_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.quantity",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.residual",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.asset_tag",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.po_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.skip_sync",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.substatus",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.checked_in",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.department",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.gl_account",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.managed_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.old_status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.order_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.beneficiary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.checked_out",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cost_center",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.depreciation",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.display_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.install_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.request_line",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resale_price",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.reserved_for",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.supported_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.justification",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.old_substatus",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.pre_allocated",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.purchase_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.residual_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.salvage_value",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.serial_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.support_group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.install_status",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.invoice_number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model_category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.disposal_reason",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.retirement_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.expenditure_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.depreciation_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.acquisition_method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.depreciated_amount",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.warranty_expiration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "254395830ef2e6c1ef61063b2cc734a008c645dc8455c498633eecef85324158"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.rights",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.location.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://dev78070.service-now.com/api/now/table/cmn_location/25b3d04b0a0a0bb300176b546c22db27"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.location.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "25b3d04b0a0a0bb300176b546c22db27"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.license_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.merged_into",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.model_category.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://dev78070.service-now.com/api/now/table/cmdb_model_category/35bf2d4137101000deeabfc8bcbe5dbd"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.model_category.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "35bf2d4137101000deeabfc8bcbe5dbd"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.is_merged_license",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_condition",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.entitlement_condition",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.active",
                                        "data_type": "string",
                                        "example_values": [
                                            "true"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.activity_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.additional_assignee_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval",
                                        "data_type": "string",
                                        "example_values": [
                                            "not requested"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_set",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://devtest2704.service-now.com/api/now/table/sys_user/d8f57f140b20220050192f15d6673a98"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "d8f57f140b20220050192f15d6673a98"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.assignment_group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.average_image_color",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.chunk_size_bytes",
                                        "data_type": "string",
                                        "example_values": [
                                            "734003"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.content_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.download_link",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_height",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_width",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_bytes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "available"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_mod_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.caller_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string",
                                        "example_values": [
                                            "inquiry"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.caused_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.child_incidents",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Closed On",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.closed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.closed_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cmdb_ci",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments_and_work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.company",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contact_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_plan",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_task",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Description",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.description",
                                        "data_type": "string",
                                        "example_values": [
                                            "Investigative actions to check for the presence of phapp_servicenow\n\nAdded by Splunk for container id: 495"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.due_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.escalation",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.expected_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.follow_up",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.group_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.hold_reason",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.impact",
                                        "data_type": "string",
                                        "example_values": [
                                            "3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.incident_state",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.knowledge",
                                        "data_type": "string",
                                        "example_values": [
                                            "false"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.location",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.made_sla",
                                        "data_type": "string",
                                        "example_values": [
                                            "true"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.notify",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "column_name": "Ticket Number",
                                        "column_order": 0,
                                        "contains": [
                                            "servicenow ticket number"
                                        ],
                                        "data_path": "action_result.data.*.number",
                                        "data_type": "string",
                                        "example_values": [
                                            "INC0000001"
                                        ]
                                    },
                                    {
                                        "column_name": "Opened On",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.opened_at",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-11-22 09:57:05"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.opened_by.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://devtest.service-now.com/api/now/table/sys_user/6816f79cc0a8016401c5a33be04be441"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.opened_by.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "6816f79cc0a8016401c5a33be04be441"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.order",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent_incident",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Priority",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.priority",
                                        "data_type": "string",
                                        "example_values": [
                                            "5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.problem_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reassignment_count",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopen_count",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopened_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopened_time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.rfc",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Severity",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.severity",
                                        "data_type": "string",
                                        "example_values": [
                                            "3"
                                        ]
                                    },
                                    {
                                        "column_name": "Short Description",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.short_description",
                                        "data_type": "string",
                                        "example_values": [
                                            "phapp_servicenow, Multiple action need to be taken"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sla_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.subcategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_class_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "incident"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_by",
                                        "data_type": "string",
                                        "example_values": [
                                            "admin"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_on",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-11-22 09:57:05"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.sys_domain.link",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://devtest.service-now.com/api/now/table/sys_user_group/global"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "global"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.sys_domain_path",
                                        "data_type": "string",
                                        "example_values": [
                                            "/"
                                        ]
                                    },
                                    {
                                        "column_name": "ID",
                                        "column_order": 3,
                                        "contains": [
                                            "servicenow ticket sysid",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.sys_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "e19eff67db716300134cd100cf961915"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_mod_count",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_by",
                                        "data_type": "string",
                                        "example_values": [
                                            "admin"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_on",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-11-22 09:57:05"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.time_worked",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_approval",
                                        "data_type": "string",
                                        "example_values": [
                                            "proceed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_reject",
                                        "data_type": "string",
                                        "example_values": [
                                            "cancel"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.urgency",
                                        "data_type": "string",
                                        "example_values": [
                                            "3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.user_input",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.watch_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_end",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_added",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_error",
                                        "data_type": "string",
                                        "example_values": [
                                            "File not found in Vault"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "servicenow ticket sysid",
                                            "md5"
                                        ],
                                        "data_path": "action_result.summary.created_ticket_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "e19eff67db716300134cd100cf961915"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Created ticket id: e19eff67db716300134cd100cf961915"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "description": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Ticket description",
                                        "key": "description",
                                        "order": 1,
                                        "required": false
                                    },
                                    "fields": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "JSON containing field values",
                                        "key": "fields",
                                        "order": 3,
                                        "required": false
                                    },
                                    "short_description": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Ticket short description",
                                        "key": "short_description",
                                        "order": 0,
                                        "required": false
                                    },
                                    "table": {
                                        "contains": [
                                            "servicenow table"
                                        ],
                                        "data_type": "string",
                                        "default": "incident",
                                        "description": "Table to add to",
                                        "key": "table",
                                        "order": 2,
                                        "required": false
                                    },
                                    "vault_id": {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Vault ID of file to attach to ticket",
                                        "key": "vault_id",
                                        "order": 4,
                                        "required": false
                                    }
                                },
                                "product_name": "ServiceNow",
                                "product_vendor": "ServiceNow",
                                "targets": "160",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "create regular ticket"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def create_regular_ticket(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('create_regular_ticket() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'create_regular_ticket' call\n    formatted_data_1 = phantom.get_format_data(name='regular_long_description')\n    formatted_data_2 = phantom.get_format_data(name='regular_short_description')\n\n    parameters = []\n    \n    # build parameters list for 'create_regular_ticket' call\n    parameters.append({\n        'table': \"incident\",\n        'fields': \"{\\\"urgency\\\":\\\"2\\\"}\",\n        'vault_id': \"\",\n        'description': formatted_data_1,\n        'short_description': formatted_data_2,\n    })\n\n    phantom.act(action=\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_regular_ticket\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "quarantine regular device",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "create regular ticket",
                        "delay": 0,
                        "description": "Create the ServiceNow ticket with the formatted short description and long description.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0d179d3a-ded3-494c-9526-6c4572625f01",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 409,
                        "line_start": 385,
                        "message": "Configuring now",
                        "name": "create ticket",
                        "notes": "Create the ServiceNow ticket with the formatted short description and long description.",
                        "number": 5,
                        "order": 17,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1560,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "create_regular_ticket",
                        "required_params": {},
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 371
                    },
                    {
                        "action": "lookup url",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "url": "artifact:*.cef.requestURL"
                        },
                        "angle": 0,
                        "app": "Zscaler",
                        "appid": "ee475421-d2e4-4d8e-addb-a2ce1465d6a3",
                        "approver": "",
                        "assets": [
                            {
                                "action": "lookup url",
                                "active": true,
                                "app_name": "Zscaler",
                                "app_version": "1.0.14",
                                "appid": "",
                                "config_type": "app",
                                "fields": {
                                    "url": "artifact:*.cef.requestURL"
                                },
                                "has_app": true,
                                "id": 72,
                                "loaded": false,
                                "missing": false,
                                "name": "Zscaler",
                                "output": [
                                    {
                                        "contains": [
                                            "url",
                                            "url list"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "facebook.com",
                                            "facebook.com, bbc.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "column_name": "ip/url",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "bbc.com"
                                        ]
                                    },
                                    {
                                        "column_name": "Classifications",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.urlClassifications",
                                        "data_type": "string",
                                        "example_values": [
                                            "NEWS_AND_MEDIA"
                                        ]
                                    },
                                    {
                                        "column_name": "Security Alerts",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.urlClassificationsWithSecurityAlert",
                                        "data_type": "string"
                                    }
                                ],
                                "parameters": {
                                    "url": {
                                        "allow_list": true,
                                        "contains": [
                                            "url",
                                            "url list"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "A comma seperated list of URLs",
                                        "key": "url",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Zscaler",
                                "product_vendor": "Zscaler",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "lookup url"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def lookup_url_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('lookup_url_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'lookup_url_2' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.requestURL', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'lookup_url_2' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'url': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"lookup url\", parameters=parameters, app={ \"name\": 'Zscaler' }, callback=zscaler_category_filter, name=\"lookup_url_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Query zScaler to retrieve the URL classification and categorization.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2d50b550-cdb3-408a-8772-ab36d7243f14",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 271,
                        "line_start": 248,
                        "message": "Configuring now",
                        "name": "lookup url",
                        "notes": "Query zScaler to retrieve the URL classification and categorization.",
                        "number": 2,
                        "order": 12,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 720
                        },
                        "previous_function": "",
                        "previous_name": "lookup_url_2",
                        "required_params": {
                            "url": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_config",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 382
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "dc051ad6-2818-4aa7-a955-fb1bb1227f83",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2d50b550-cdb3-408a-8772-ab36d7243f14",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bd0b63d2-92c7-41f8-a2b6-769e22d2e023",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 383
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9da56c9e-135f-4cd2-afab-08ae587cc128",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bd0b63d2-92c7-41f8-a2b6-769e22d2e023",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "cbb5429a-4264-4d35-b1a6-939a110fe1f5",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 387
                    },
                    {
                        "action": "block url",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "url": "filtered-data:filter_4:condition_1:lookup_url_2:action_result.parameter.url",
                            "url_category": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "block url",
                                "active": true,
                                "app_name": "Zscaler",
                                "app_version": "1.0.14",
                                "appid": "",
                                "asset_name": "zscaler",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "url": "filtered-data:zscaler_category_filter:condition_1:lookup_url_2:action_result.parameter.url",
                                    "url_category": ""
                                },
                                "has_app": true,
                                "id": 72,
                                "loaded": false,
                                "missing": false,
                                "name": "zscaler",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "column_name": "URL",
                                        "column_order": 0,
                                        "contains": [
                                            "url",
                                            "domain",
                                            "url list"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "www.test.com",
                                            "www.test.com, www.test123.com"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "zscaler url category"
                                        ],
                                        "data_path": "action_result.parameter.url_category",
                                        "data_type": "string",
                                        "example_values": [
                                            "CUSTOM_01"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.type",
                                        "data_type": "string",
                                        "example_values": [
                                            "URL_CATEGORY"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.editable",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.customUrlsCount",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.urlsRetainingParentCategoryCount",
                                        "data_type": "numeric",
                                        "example_values": [
                                            4
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.configuredName",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test-Block"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.customCategory",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.dbCategorizedUrls",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "string",
                                        "example_values": [
                                            "CUSTOM_01"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.val",
                                        "data_type": "numeric",
                                        "example_values": [
                                            128
                                        ]
                                    },
                                    {
                                        "column_name": "Ignored",
                                        "column_order": 2,
                                        "data_path": "action_result.summary.ignored",
                                        "data_type": "string",
                                        "example_values": [
                                            "www.test.com"
                                        ]
                                    },
                                    {
                                        "column_name": "Updated",
                                        "column_order": 1,
                                        "data_path": "action_result.summary.updated",
                                        "data_type": "string",
                                        "example_values": [
                                            "www.test123.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Ignored: ['www.test.com'], Updated: ['www.test123.com']"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "url": {
                                        "allow_list": true,
                                        "contains": [
                                            "url",
                                            "url list"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "A comma seperated list of URLs",
                                        "key": "url",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    },
                                    "url_category": {
                                        "contains": [
                                            "zscaler url category"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Add to this category",
                                        "key": "url_category",
                                        "order": 1,
                                        "primary": false,
                                        "required": false
                                    }
                                },
                                "product_name": "Zscaler",
                                "product_vendor": "Zscaler",
                                "targets": "29",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block url"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def block_url_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('block_url_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_url_2' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:zscaler_category_filter:condition_1:lookup_url_2:action_result.parameter.url\", \"filtered-data:zscaler_category_filter:condition_1:lookup_url_2:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'block_url_2' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'url': filtered_results_item_1[0],\n                'url_category': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"block url\", parameters=parameters, assets=['zscaler'], name=\"block_url_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "lookup url",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Block URL's with security classifications.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "cbb5429a-4264-4d35-b1a6-939a110fe1f5",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 298,
                        "line_start": 274,
                        "message": "Configuring now",
                        "name": "block url",
                        "notes": "Block URL's with security classifications.",
                        "number": 2,
                        "order": 13,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1560,
                            "y": 720
                        },
                        "previous_function": "",
                        "previous_name": "block_url_2",
                        "required_params": {
                            "url": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 390
                    },
                    {
                        "action": "run query",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "display": "client_ip, url, url_category, url_class, User",
                            "query": "create_splunk_proxy_log_query:formatted_data"
                        },
                        "angle": 0,
                        "app": "Splunk",
                        "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
                        "approver": "",
                        "assets": [
                            {
                                "action": "run query",
                                "active": true,
                                "app_name": "Splunk",
                                "app_version": "1.3.21",
                                "appid": "",
                                "asset_name": "splunk_es",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "command": "",
                                    "display": "client_ip, url, url_category, url_class, User",
                                    "parse_only": "",
                                    "query": "format_splunk_query:formatted_data"
                                },
                                "has_app": true,
                                "id": 3,
                                "loaded": false,
                                "missing": false,
                                "name": "splunk_es",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.command",
                                        "data_type": "string",
                                        "example_values": [
                                            "savedsearch"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.parse_only",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "splunk query"
                                        ],
                                        "data_path": "action_result.parameter.query",
                                        "data_type": "string",
                                        "example_values": [
                                            "\"Send to Phantom\""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*._bkt",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._cd",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._indextime",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Raw",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*._raw",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._serial",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._si",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._sourcetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Time",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*._time",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Host",
                                        "column_order": 0,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.host",
                                        "data_type": "string",
                                        "example_values": [
                                            "10.1.67.187:8088"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.index",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.linecount",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.source",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sourcetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.splunk_server",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_events",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Total events: 2"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "display": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Display fields (comma separated)",
                                        "key": "display",
                                        "order": 1,
                                        "primary": false,
                                        "required": false
                                    },
                                    "query": {
                                        "contains": [
                                            "splunk query"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Query to run (in Splunk search language)",
                                        "key": "query",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Splunk Enterprise",
                                "product_vendor": "Splunk Inc.",
                                "targets": "88",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "run query"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def run_query_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('run_query_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'run_query_1' call\n    formatted_data_1 = phantom.get_format_data(name='format_splunk_query')\n\n    parameters = []\n    \n    # build parameters list for 'run_query_1' call\n    parameters.append({\n        'query': formatted_data_1,\n        'command': \"\",\n        'display': \"client_ip, url, url_category, url_class, User\",\n        'parse_only': \"\",\n    })\n\n    phantom.act(action=\"run query\", parameters=parameters, assets=['splunk_es'], callback=get_user_attributes_1, name=\"run_query_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 143,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "url reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Run the Splunk query built in the previous format block.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5d29573e-6f1c-4a3a-b0f6-c505f19063a3",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 195,
                        "line_start": 173,
                        "message": "Configuring now",
                        "name": "run query",
                        "notes": "Run the Splunk query built in the previous format block.",
                        "number": 1,
                        "order": 9,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 860,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "run_query_1",
                        "required_params": {
                            "query": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 392
                    },
                    {
                        "action": "quarantine device",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "filtered-data:filter_2:condition_1:run_query_1:action_result.data.*.client_ip"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "quarantine device",
                                "active": true,
                                "app_name": "Carbon Black Response",
                                "app_version": "1.2.86",
                                "appid": "",
                                "asset_name": "carbonblack",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "ip_hostname": "filtered-data:filter_2:condition_1:run_query_1:action_result.data.*.client_ip"
                                },
                                "has_app": true,
                                "id": 100,
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "Name/IP",
                                        "column_order": 0,
                                        "contains": [
                                            "host name",
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "cb-lab"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Quarantine action succeeded. It might take some time for endpoint to get isolated."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "ip_hostname": {
                                        "contains": [
                                            "host name",
                                            "ip"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Hostname/IP of endpoint to quarantine",
                                        "key": "ip_hostname",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Carbon Black",
                                "product_vendor": "Bit9",
                                "targets": "61",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "quarantine exec device"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def quarantine_exec_device(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_exec_device() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'quarantine_exec_device' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_2:condition_1:run_query_1:action_result.data.*.client_ip\", \"filtered-data:filter_2:condition_1:run_query_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'quarantine_exec_device' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'ip_hostname': filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"quarantine device\", parameters=parameters, assets=['carbonblack'], name=\"quarantine_exec_device\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "prompt 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "quarantine exec device",
                        "delay": 0,
                        "description": "Since the prompt was confirmed, quarantine the executive's device.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "57675b11-5398-4275-967c-516b3757972b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 151,
                        "line_start": 128,
                        "message": "Configuring now",
                        "name": "quarantine device",
                        "notes": "Since the prompt was confirmed, quarantine the executive's device.",
                        "number": 5,
                        "order": 7,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1560,
                            "y": 300
                        },
                        "previous_function": "",
                        "previous_name": "quarantine_exec_device",
                        "required_params": {
                            "ip_hostname": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 393
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"get_user_attributes_1:action_result.data.*.department\", \"==\", \"Executives\"],\n        ],\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        filter_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"get_user_attributes_1:action_result.data.*.department\", \"!=\", \"Executives\"],\n        ],\n        name=\"filter_1:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Handle the situation differently if the user is in the Executives department.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "36f6174e-144b-42fd-b08f-d7a6e6ec505f",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 332,
                        "line_start": 301,
                        "name": "filter",
                        "notes": "Handle the situation differently if the user is in the Executives department.",
                        "number": 1,
                        "order": 14,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "get_user_attributes_1:action_result.data.*.department",
                                        "value": "Executives"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "get_user_attributes_1:action_result.data.*.department",
                                        "value": "Executives"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 620,
                            "y": 300
                        },
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 394
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "format splunk query"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def format_splunk_query(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_splunk_query() called')\n    \n    template = \"\"\"host=\\\"zscalertwo-phantom\\\" index=\\\"proxy_logs_zscaler\\\" sourcetype=\\\"csv\\\"  | eval cleansed_url=replace(\\\"{0}\\\", \\\"http[s]*\\\\:\\\\/\\\\/\\\", \\\"\\\") | where URL=cleansed_url | rename \\\"Client IP\\\" as client_ip \\\"Policy Action\\\" as policy_action, \\\"URL Class\\\" as url_class, \\\"URL Category\\\" as url_category | fields client_ip, policy_action, url_class, url_category, User\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"url_reputation_2:artifact:*.cef.requestURL\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_splunk_query\")\n\n    run_query_1(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "url reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "format splunk query",
                        "description": "Build a Splunk query to check the zScaler proxy logs for events where the given URL was requested.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5703dfbb-5e6d-4399-bcbd-8e4a9b0c4b94",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 170,
                        "line_start": 154,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Build a Splunk query to check the zScaler proxy logs for events where the given URL was requested.",
                        "number": 1,
                        "order": 8,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "url_reputation_2:artifact:*.cef.requestURL"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 620,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "format_splunk_query",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "host=\"zscalertwo-phantom\" index=\"proxy_logs_zscaler\" sourcetype=\"csv\"  | eval cleansed_url=replace(\"{0}\", \"http[s]*\\:\\/\\/\", \"\") | where URL=cleansed_url | rename \"Client IP\" as client_ip \"Policy Action\" as policy_action, \"URL Class\" as url_class, \"URL Category\" as url_category | fields client_ip, policy_action, url_class, url_category, User",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 395
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "approver": "admin",
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def prompt_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('prompt_1() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"High priority asset has visited malicious URL. Please review and determine if device should be quarantined?\"\"\"\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"prompt_1\", response_types=response_types, callback=decision_7)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "connected_to_start": true,
                        "connection_name": "get user attributes",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Since this is an executive, prompt an analyst before quarantining.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "1d75e000-9241-49e8-a808-7ed151d996e0",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 514,
                        "line_start": 489,
                        "message": "High priority asset has visited malicious URL. Please review and determine if device should be quarantined?",
                        "name": "prompt",
                        "notes": "Since this is an executive, prompt an analyst before quarantining.",
                        "number": 1,
                        "order": 21,
                        "outPorts": [
                            "out"
                        ],
                        "parameters": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 900,
                            "y": 300
                        },
                        "previous_function": "",
                        "previous_name": "prompt_1",
                        "respond_in": "30",
                        "response_key": "Yes/No",
                        "response_options": [
                            "Yes",
                            "No"
                        ],
                        "response_type": "list",
                        "responses": [
                            {
                                "response_key": "Yes/No",
                                "response_options": [
                                    "Yes",
                                    "No"
                                ],
                                "response_prompt": "",
                                "response_type": "list"
                            }
                        ],
                        "show_number": true,
                        "size": {
                            "height": 80,
                            "width": 80
                        },
                        "state": "prompt",
                        "status": "",
                        "type": "coa.Prompt",
                        "warn": false,
                        "z": 396
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def zscaler_category_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('zscaler_category_filter() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"lookup_url_2:action_result.data.*.urlClassificationsWithSecurityAlert\", \"!=\", \"\"],\n        ],\n        name=\"zscaler_category_filter:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        block_url_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "lookup url",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "zscaler_category_filter",
                        "description": "If there is a security classification, meaning zScaler has identified something malicious about the URL, then proceed to block it.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bd0b63d2-92c7-41f8-a2b6-769e22d2e023",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 561,
                        "line_start": 543,
                        "name": "filter",
                        "notes": "If there is a security classification, meaning zScaler has identified something malicious about the URL, then proceed to block it.",
                        "number": 4,
                        "order": 23,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "lookup_url_2:action_result.data.*.urlClassificationsWithSecurityAlert",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1080,
                            "y": 720
                        },
                        "previous_function": "",
                        "previous_name": "zscaler_category_filter",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 399
                    },
                    {
                        "action": "url reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "url": "artifact:*.cef.requestURL"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "url reputation",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.40",
                                "appid": "",
                                "asset_name": "virustotal",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "url": "artifact:*.cef.requestURL"
                                },
                                "has_app": true,
                                "id": 143,
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.parameter.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.test.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.filescan_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.permalink",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.test.com/url/d0e196a0c25d35dd0a84593cbae0f38333aa58529936444ea26453eab28dfc86/analysis/1549011607/"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "column_name": "Url",
                                        "column_order": 0,
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.resource",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.test.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scan_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 09:00:07"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "virustotal scan id"
                                        ],
                                        "data_path": "action_result.data.*.scan_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "d0e196a0c25d35dd0a84593cbae0f38333aa58529936444ea26453eab28dfc86-1549011607"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.detected",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ADMINUSLabs.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ADMINUSLabs.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AegisLab WebGuard.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AegisLab WebGuard.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AlienVault.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AlienVault.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Antiy-AVL.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Antiy-AVL.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AutoShun.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.AutoShun.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avira.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Avira.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Baidu-International.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Baidu-International.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.BitDefender.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.BitDefender.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Blueliv.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Blueliv.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.C-SIRT.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.C-SIRT.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CLEAN MX.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CLEAN MX.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Certly.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Certly.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Comodo Site Inspector.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Comodo Site Inspector.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CyRadar.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CyRadar.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CyberCrime.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.CyberCrime.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.DNS8.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.DNS8.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Dr.Web.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Dr.Web.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ESET.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ESET.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Emsisoft.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Emsisoft.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Forcepoint ThreatSeeker.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Forcepoint ThreatSeeker.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Fortinet.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Fortinet.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.FraudScore.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.FraudScore.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.FraudSense.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.FraudSense.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.G-Data.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.G-Data.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Google Safebrowsing.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Google Safebrowsing.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7AntiVirus.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.K7AntiVirus.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kaspersky.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Kaspersky.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.scans.Malc0de Database.detail",
                                        "data_type": "string",
                                        "example_values": [
                                            "http://malc0de.com/database/index.php?search=www.test.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malc0de Database.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malc0de Database.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malekal.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malekal.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malware Domain Blocklist.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malware Domain Blocklist.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.scans.MalwareDomainList.detail",
                                        "data_type": "string",
                                        "example_values": [
                                            "http://www.malwaredomainlist.com/mdl.php?search=www.test.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MalwareDomainList.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MalwareDomainList.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MalwarePatrol.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.MalwarePatrol.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwarebytes hpHosts.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwarebytes hpHosts.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwared.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Malwared.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Netcraft.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Netcraft.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.NotMining.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.NotMining.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Nucleon.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Nucleon.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.OpenPhish.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.OpenPhish.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Opera.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Opera.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.PhishLabs.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.PhishLabs.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Phishtank.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Phishtank.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Quttera.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Quttera.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Rising.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Rising.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SCUMWARE.org.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SCUMWARE.org.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SecureBrain.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.SecureBrain.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sophos.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sophos.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Spam404.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Spam404.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.StopBadware.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.StopBadware.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sucuri SiteCheck.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Sucuri SiteCheck.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Tencent.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Tencent.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ThreatHive.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ThreatHive.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trustwave.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Trustwave.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.URLQuery.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.URLQuery.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "unrated site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VX Vault.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.VX Vault.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Virusdie External Site Scan.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Virusdie External Site Scan.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Web Security Guard.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Web Security Guard.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.scans.Yandex Safebrowsing.detail",
                                        "data_type": "string",
                                        "example_values": [
                                            "http://yandex.com/infected?l10n=en&url=https://www.test.com/"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Yandex Safebrowsing.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Yandex Safebrowsing.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZCloudsec.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZCloudsec.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZDB Zeus.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZDB Zeus.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZeroCERT.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZeroCERT.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zerofox.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.Zerofox.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.scans.ZeusTracker.detail",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://zeustracker.abuse.ch/monitor.php?host=www.test.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZeusTracker.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.ZeusTracker.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.desenmascara.me.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.desenmascara.me.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.malwares.com URL checker.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.malwares.com URL checker.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.securolytics.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.securolytics.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.zvelo.detected",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.zvelo.result",
                                        "data_type": "string",
                                        "example_values": [
                                            "clean site"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            66
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://www.test.com/"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string",
                                        "example_values": [
                                            "Scan finished, scan information embedded in this object"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.detections",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.summary.found",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "Positives",
                                        "column_order": 2,
                                        "data_path": "action_result.summary.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "column_name": "Total Scans",
                                        "column_order": 1,
                                        "data_path": "action_result.summary.total_scans",
                                        "data_type": "numeric",
                                        "example_values": [
                                            66
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Positives: 0, Total scans: 66"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "url": {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "URL to query",
                                        "key": "url",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "targets": "32",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "url reputation"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def url_reputation_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('url_reputation_2() called')\n\n    # collect data for 'url_reputation_2' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.requestURL', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'url_reputation_2' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'url': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"url reputation\", parameters=parameters, assets=['virustotal'], callback=decision_1, name=\"url_reputation_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Check for existing scans of this URL on Virustotal.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5a47e570-9abd-4499-990f-c83b4057ceb9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 40,
                        "line_start": 19,
                        "message": "Configuring now",
                        "name": "url reputation",
                        "notes": "Check for existing scans of this URL on Virustotal.",
                        "number": 2,
                        "order": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 240,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "url_reputation_2",
                        "required_params": {
                            "url": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 401
                    }
                ]
            },
            "notes": "This playbook uses the following Apps:\n - VirusTotal (url reputation) [asset name = virustotal] - look up scan results and metadata about the URL\n - zScaler (lookup url, block url) [asset name = zscaler] - lookup URL categorization, stream logs to Splunk for searches, and block URL's\n - Splunk (run query) [asset name = splunk_es] - query zScaler proxy logs that are streamed to Splunk\n - Carbon Black Response (quarantine device) [asset name =  carbonblack] - quarantine the affected device from the network\n - LDAP (get user attributes) - gather basic information about the affected users\n - ServiceNow (create ticket) [asset name = servicenow] - create a ticket for further incident tracking\n\nDeployment Notes:\n - This playbook is designed to be run in ad hoc hunting or called from other playbooks whenever a suspicious URL is detected\n - The organizational group called \"Executives\" should be replaced by one or more groups that are considered high priority within LDAP\n - The index, sourcetype, and host should be customized to match the configuration of zScaler logs indexed in Splunk\n - If \"admin\" is not the appropriate user the prompt block should be changed to the appropriate user or role\n - The filter called \"zscaler_category_filter\" can be customized to any security categories deemed blockable according to zScaler policy, or left as currently configured to block URL's that match any security category"
        },
        "python_version": "3",
        "schema": 4,
        "version": "4.10.0.40961"
    },
    "create_time": "2021-02-17T16:16:19.609322+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ],
    "tags": [],
    "misc": {
        "apps_list": [
            "zScaler",
            "Splunk",
            "VirusTotal",
            "Carbon Black Response",
            "LDAP",
            "ServiceNow"
        ]
    }
}