gcp_unusual_serviceaccount_usage.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Use Cases",
    "misc": { "apps_list": ["Google Cloud IAM", "Google Cloud Compute Engine"] },
    "coa": {
        "data": {
            "clean": true,
            "code_block": "\n",
            "description": "Investigate and respond to an unusual service account usage alert in Google Cloud Platform. Gather information about the service account keys associated with the service account in question, as well as the compute instance involved in the activity, if applicable. According to a prompt response from an analyst, optionally delete the service account keys and/or stop the compute instance.",
            "hash": "b2efbacea9283281cbfd18814186c57169deb496",
            "joint": {
                "cells": [
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "delete keys 1, stop instance, delete keys 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5e313998-daab-4408-a6d2-0359ed498011",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 496,
                        "line_start": 483,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 18,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 920,
                            "y": 380
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 2
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c3913128-0e77-4b20-8818-3e82a2c98fd3",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "f5237416-98b0-437a-9c43-6af582df4a5a",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f8f616b9-9932-4711-94c7-a0ba7c78aa31",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 12
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "ref-y": 8,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'artifact_check' block\n    artifact_check(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "8678c52a-9fb2-4b0d-8d76-674fa41238c1",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 25,
                        "line_start": 17,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -380,
                            "y": 100
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 27
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c159fd78-6610-464d-8c43-6335f10bd323",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8678c52a-9fb2-4b0d-8d76-674fa41238c1",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "93b5a5e7-6a6c-4c3d-9b80-a24823aac1f7",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 57
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7379f746-74ad-4566-bce7-c7169273ec17",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "93b5a5e7-6a6c-4c3d-9b80-a24823aac1f7",
                            "port": "out-1",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f5237416-98b0-437a-9c43-6af582df4a5a",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 59
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0ee08c34-89a5-4cba-9d12-30dad3f290c5",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "93b5a5e7-6a6c-4c3d-9b80-a24823aac1f7",
                            "port": "out-1",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "528e17de-f46f-497c-8486-cf10005c6104",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 61
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ead22bff-0b4e-44c5-b296-f7e20417a466",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "93b5a5e7-6a6c-4c3d-9b80-a24823aac1f7",
                            "port": "out-2",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bbeca1cf-3040-410a-83d8-32f88075220b",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 65
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "04a79861-40ef-4d61-8b4e-2d45eb2a184c",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "93b5a5e7-6a6c-4c3d-9b80-a24823aac1f7",
                            "port": "out-3",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "1a625f81-b3c5-4d6f-81cb-a0f958ee5495",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 68
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "612e4531-ff57-4d79-888f-9d028d022852",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "528e17de-f46f-497c-8486-cf10005c6104",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "7944ee23-46b6-4f72-8f17-0be5e62cb011",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 76
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "736d5123-0a20-416c-bb8c-5018cf1b9f17",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bbeca1cf-3040-410a-83d8-32f88075220b",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "576fbfb8-6951-4fe6-b482-6b40b9be36ea",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 84
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "60c04455-b438-4697-85fe-59cc09f57d09",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "f8f616b9-9932-4711-94c7-a0ba7c78aa31",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "14992fd6-1c22-4218-8d1b-75a1ff714740",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 96
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9b700f95-c430-4f86-8ea4-0f8699d698ac",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "7944ee23-46b6-4f72-8f17-0be5e62cb011",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "14992fd6-1c22-4218-8d1b-75a1ff714740",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 97
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "cbacf59d-b06a-48ee-8f45-18378d05979e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "14992fd6-1c22-4218-8d1b-75a1ff714740",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "8385101a-db55-4a5e-b89e-5723d26c9a44",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 101
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7655ea2a-10a2-4751-b2b3-c4228e9f4786",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8385101a-db55-4a5e-b89e-5723d26c9a44",
                            "port": "out-1",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "61427d23-dce9-440e-8cdf-8defb2919452",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 103
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "55584c06-8f8c-4cba-a7f6-c3da60fe045d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "14992fd6-1c22-4218-8d1b-75a1ff714740",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ebb47c62-d70f-498c-805b-3ce0e1d7efeb",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 106
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0174bf53-6b94-46dc-a116-d9ddf395f63f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ebb47c62-d70f-498c-805b-3ce0e1d7efeb",
                            "port": "out-1",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a1095b20-2a0c-47bb-ad99-c0f6dba8e8a3",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 108
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8c457ea3-7554-4298-ad14-c7f6e81abd9f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "576fbfb8-6951-4fe6-b482-6b40b9be36ea",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "3282f317-77af-4d77-b1bb-30ad1486492b",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 110
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7bbf1f09-6d07-4f58-9398-d4e0a8e45aa7",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "3282f317-77af-4d77-b1bb-30ad1486492b",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0a136c89-d67a-4313-ae01-cf87ea2ee07d",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 117
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f0cf6875-2620-46c4-a97e-f337ef153d5f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0a136c89-d67a-4313-ae01-cf87ea2ee07d",
                            "port": "out-1",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "4418e12a-2971-4247-8248-e543a6a8338f",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 122
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7c709a39-1009-420b-bf04-d709848505c9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "61427d23-dce9-440e-8cdf-8defb2919452",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5e313998-daab-4408-a6d2-0359ed498011",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 127
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ceb8a3bb-bda0-4060-a9ff-10296b3f7695",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a1095b20-2a0c-47bb-ad99-c0f6dba8e8a3",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5e313998-daab-4408-a6d2-0359ed498011",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 128
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#818D99",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#818D99",
                                "stroke": "#818D99"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "749b3915-098f-4cc3-82cc-389ce0854b25",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "4418e12a-2971-4247-8248-e543a6a8338f",
                            "selector": "> g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5e313998-daab-4408-a6d2-0359ed498011",
                            "selector": "> g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 129
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-2": {
                                "port": {
                                    "id": "out-3",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": -2
                            },
                            ".outPorts>.port-2>.port-body": {
                                "port": {
                                    "id": "out-3",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def artifact_check(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('artifact_check() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        conditions=[\n            [\"artifact:*.cef.sourceUserId\", \"!=\", \"\"],\n            [\"artifact:*.cef.data_resource_labels_instance_id\", \"!=\", \"\"],\n        ],\n        logical_operator='and')\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        list_serviceaccountkey_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        describe_instance_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # check for 'elif' condition 2\n    matched = phantom.decision(\n        container=container,\n        conditions=[\n            [\"artifact:*.cef.sourceUserId\", \"!=\", \"\"],\n            [\"artifact:*.cef.data_resource_labels_instance_id\", \"==\", \"\"],\n        ],\n        logical_operator='and')\n\n    # call connected blocks if condition 2 matched\n    if matched:\n        list_serviceaccountkey_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    # call connected blocks for 'else' condition 3\n    add_comment_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "artifact_check",
                        "description": "Check the event for the service account ID and compute instance ID needed to run the actions. This splits into one of three paths:\n\n1. events without a service account ID\n2. events with a service account ID but no compute instance ID\n3. events with both a service account ID and a compute instance ID",
                        "hasElse": true,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "93b5a5e7-6a6c-4c3d-9b80-a24823aac1f7",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 254,
                        "line_start": 217,
                        "name": "decision",
                        "notes": "Check the event for the service account ID and compute instance ID needed to run the actions. This splits into one of three paths:\n\n1. events without a service account ID\n2. events with a service account ID but no compute instance ID\n3. events with both a service account ID and a compute instance ID",
                        "number": 2,
                        "order": 8,
                        "outPorts": [
                            "out-1",
                            "out-2",
                            "out-3"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "artifact:*.cef.sourceUserId",
                                        "value": ""
                                    },
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "artifact:*.cef.data_resource_labels_instance_id",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "artifact:*.cef.sourceUserId",
                                        "value": ""
                                    },
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "artifact:*.cef.data_resource_labels_instance_id",
                                        "value": ""
                                    }
                                ],
                                "display": "Else If",
                                "logic": "and",
                                "type": "elif"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "",
                                        "value": ""
                                    }
                                ],
                                "display": "Else",
                                "logic": "and",
                                "type": "else"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -240,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "artifact_check",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 132
                    },
                    {
                        "action": "list serviceaccountkey",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "account": "artifact:*.cef.sourceUserId"
                        },
                        "angle": 0,
                        "app": "Google Cloud IAM",
                        "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                        "approver": "",
                        "assets": [
                            {
                                "action": "list serviceaccountkey",
                                "actions": [
                                    "create serviceaccountkey",
                                    "delete serviceaccountkey",
                                    "get serviceaccountkey",
                                    "list serviceaccountkey",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Google Cloud IAM",
                                "app_version": "1.0.0",
                                "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                                "asset_name": "gcp-iam-splunkconf20",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "account": "artifact:*.cef.sourceUserId"
                                },
                                "has_app": true,
                                "id": 8,
                                "loaded": false,
                                "missing": false,
                                "name": "gcp_iam",
                                "output": [
                                    {
                                        "column_name": "Account",
                                        "column_order": 0,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.account",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.keyAlgorithm",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.keyOrigin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.keyType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.validAfterTime",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.validBeforeTime",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "account": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Email address or the uniqueId of the service account",
                                        "key": "account",
                                        "order": 0,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    }
                                },
                                "product_name": "Cloud IAM",
                                "product_vendor": "Google",
                                "targets": "8",
                                "type": "devops"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "list serviceaccountkey 2"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def list_serviceaccountkey_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('list_serviceaccountkey_2() called')\n\n    # collect data for 'list_serviceaccountkey_2' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceUserId', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'list_serviceaccountkey_2' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'account': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"list serviceaccountkey\", parameters=parameters, assets=['gcp_iam'], callback=format_key_info_2, name=\"list_serviceaccountkey_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Show the keys that belong to the service account in question.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bbeca1cf-3040-410a-83d8-32f88075220b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 278,
                        "line_start": 257,
                        "message": "Configuring now",
                        "name": "list serviceaccountkey",
                        "notes": "Show the keys that belong to the service account in question.",
                        "number": 2,
                        "order": 9,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -100,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "list_serviceaccountkey_2",
                        "required_params": {
                            "account": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 135
                    },
                    {
                        "action": "describe instance",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "project": "artifact:*.cef.account",
                            "resourceid": "artifact:*.cef.data_resource_labels_instance_id",
                            "zone": "artifact:*.cef.data_resource_labels_zone"
                        },
                        "angle": 0,
                        "app": "Google Cloud Compute Engine",
                        "appid": "75fc6f53-dffd-4b1a-9083-0313b3d0178e",
                        "approver": "",
                        "assets": [
                            {
                                "action": "describe instance",
                                "actions": [
                                    "start instance",
                                    "stop instance",
                                    "describe instance",
                                    "tag instance",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Google Cloud Compute Engine",
                                "app_version": "1.0.0",
                                "appid": "75fc6f53-dffd-4b1a-9083-0313b3d0178e",
                                "asset_name": "gcp-compute-splunkconf20",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "id": "",
                                    "zone": "artifact:*.cef.data_resource_labels_zone"
                                },
                                "has_app": true,
                                "id": 7,
                                "loaded": false,
                                "missing": false,
                                "name": "gcp_compute",
                                "output": [
                                    {
                                        "column_name": "Zone",
                                        "column_order": 0,
                                        "contains": [
                                            "gcloud computeengine zone"
                                        ],
                                        "data_path": "action_result.parameter.zone",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ID",
                                        "column_order": 1,
                                        "contains": [
                                            "gcloud computeengine id"
                                        ],
                                        "data_path": "action_result.parameter.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.machineType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cpuPlatform",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.canIpForward",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.creationTimestamp",
                                        "data_type": "string",
                                        "example_values": [
                                            "2020-07-09T01:51:13.393-07:00"
                                        ]
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.machineType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "project": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Project ID",
                                        "key": "project",
                                        "order": 0,
                                        "primary": false,
                                        "required": true,
                                        "value_list": []
                                    },
                                    "resourceid": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Resource ID of the instance",
                                        "key": "resourceid",
                                        "order": 2,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    },
                                    "zone": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Zone of the instance",
                                        "key": "zone",
                                        "order": 1,
                                        "primary": false,
                                        "required": true,
                                        "value_list": []
                                    }
                                },
                                "product_name": "Compute Engine",
                                "product_vendor": "Google",
                                "targets": "7",
                                "type": "virtualization"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "describe instance"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def describe_instance_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('describe_instance_1() called')\n\n    # collect data for 'describe_instance_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.data_resource_labels_zone', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'describe_instance_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'id': \"\",\n                'zone': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"describe instance\", parameters=parameters, assets=['gcp_compute'], callback=format_vm_info, name=\"describe_instance_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Gather metadata about the compute instance referenced in the event.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "528e17de-f46f-497c-8486-cf10005c6104",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 210,
                        "line_start": 188,
                        "message": "Configuring now",
                        "name": "describe instance",
                        "notes": "Gather metadata about the compute instance referenced in the event.",
                        "number": 1,
                        "order": 7,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -100,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "describe_instance_1",
                        "required_params": {
                            "id": true,
                            "zone": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 136
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "approver": "admin",
                        "approver_display": "admin",
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def gcp_unusual_usage_keys_and_vm(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('gcp_unusual_usage_keys_and_vm() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"Unusual Google Cloud Compute Engine activity was detected. The service account in use has the following service account keys:\n{0}\n\nThe following Compute Engine VM instance was associated with the activity:\n{1}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"format_key_info_1:formatted_data\",\n        \"format_vm_info:formatted_data\",\n    ]\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"Should the associated service account keys be deleted to disable further access?\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n        {\n            \"prompt\": \"Should the associated virtual machine be stopped?\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"gcp_unusual_usage_keys_and_vm\", separator=\", \", parameters=parameters, response_types=response_types, callback=gcp_unusual_usage_keys_and_vm_callback)\n\n    return",
                        "callback_code": "def gcp_unusual_usage_keys_and_vm_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('gcp_unusual_usage_keys_and_vm_callback() called')\n    \n    decision_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    decision_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_start": 139,
                        "callsback": true,
                        "connected_to_start": true,
                        "connection_name": "list serviceaccountkey 1, describe instance",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "gcp_unusual_usage_keys_and_vm",
                        "delimiter": ", ",
                        "description": "Use the formatted messages to prompt the analyst.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "14992fd6-1c22-4218-8d1b-75a1ff714740",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_gcp_unusual_usage_keys_and_vm(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_gcp_unusual_usage_keys_and_vm() called')\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['list_serviceaccountkey_1', 'describe_instance_1']):\n        \n        # call connected block \"gcp_unusual_usage_keys_and_vm\"\n        gcp_unusual_usage_keys_and_vm(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 147,
                        "line_end": 158,
                        "line_start": 94,
                        "message": "Unusual Google Cloud Compute Engine activity was detected. The service account in use has the following service account keys:\n{0}\n\nThe following Compute Engine VM instance was associated with the activity:\n{1}",
                        "name": "prompt",
                        "notes": "Use the formatted messages to prompt the analyst.",
                        "number": 1,
                        "order": 5,
                        "outPorts": [
                            "out"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "format_key_info_1:formatted_data"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "format_vm_info:formatted_data"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "gcp_unusual_usage_keys_and_vm",
                        "respond_in": "30",
                        "response_key": "Message",
                        "response_options": [],
                        "response_type": "list",
                        "responses": [
                            {
                                "response_key": "Yes/No",
                                "response_options": [
                                    "Yes",
                                    "No"
                                ],
                                "response_prompt": "Should the associated service account keys be deleted to disable further access?",
                                "response_type": "list"
                            },
                            {
                                "response_key": "Yes/No",
                                "response_options": [
                                    "Yes",
                                    "No"
                                ],
                                "response_prompt": "Should the associated virtual machine be stopped?",
                                "response_type": "list"
                            }
                        ],
                        "show_number": true,
                        "size": {
                            "height": 80,
                            "width": 80
                        },
                        "state": "prompt",
                        "status": "",
                        "type": "coa.Prompt",
                        "warn": false,
                        "z": 146
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_3() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"gcp_unusual_usage_keys_and_vm:action_result.summary.responses.0\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        delete_keys_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "gcp_unusual_usage_keys_and_vm",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Check the prompt response.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "8385101a-db55-4a5e-b89e-5723d26c9a44",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 356,
                        "line_start": 338,
                        "name": "decision",
                        "notes": "Check the prompt response.",
                        "number": 3,
                        "order": 12,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "gcp_unusual_usage_keys_and_vm:action_result.summary.responses.0",
                                        "value": "Yes"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "decision_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 149
                    },
                    {
                        "action": "delete serviceaccountkey",
                        "action_type": "correct",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "account": "list_serviceaccountkey_1:action_result.parameter.account",
                            "key": "list_serviceaccountkey_1:action_result.data.0.keys.*.name"
                        },
                        "angle": 0,
                        "app": "Google Cloud IAM",
                        "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                        "approver": "",
                        "assets": [
                            {
                                "action": "delete serviceaccountkey",
                                "actions": [
                                    "create serviceaccountkey",
                                    "delete serviceaccountkey",
                                    "get serviceaccountkey",
                                    "list serviceaccountkey",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Google Cloud IAM",
                                "app_version": "1.0.0",
                                "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                                "asset_name": "gcp-iam-splunkconf20",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "account": "list_serviceaccountkey_1:action_result.parameter.account",
                                    "key": "list_serviceaccountkey_1:action_result.data.0.keys.*.name"
                                },
                                "has_app": true,
                                "id": 8,
                                "loaded": false,
                                "missing": false,
                                "name": "gcp_iam",
                                "output": [
                                    {
                                        "column_name": "Account",
                                        "column_order": 0,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.account",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Key",
                                        "column_order": 1,
                                        "contains": [
                                            "gcloudiam key"
                                        ],
                                        "data_path": "action_result.parameter.key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "account": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Email address or the uniqueId of the service account",
                                        "key": "account",
                                        "order": 0,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    },
                                    "key": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Name of key",
                                        "key": "key",
                                        "order": 1,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    }
                                },
                                "product_name": "Cloud IAM",
                                "product_vendor": "Google",
                                "targets": "8",
                                "type": "devops"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "delete keys 1"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Correct"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_correct.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def delete_keys_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('delete_keys_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'delete_keys_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['list_serviceaccountkey_1:action_result.data.0.keys.*.name', 'list_serviceaccountkey_1:action_result.parameter.account', 'list_serviceaccountkey_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'delete_keys_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0] and results_item_1[1]:\n            parameters.append({\n                'key': results_item_1[0],\n                'account': results_item_1[1],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[2]},\n            })\n\n    phantom.act(action=\"delete serviceaccountkey\", parameters=parameters, assets=['gcp_iam'], name=\"delete_keys_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "gcp_unusual_usage_keys_and_vm",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "delete keys 1",
                        "delay": 0,
                        "description": "Delete each of the offending service account keys.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "61427d23-dce9-440e-8cdf-8defb2919452",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 185,
                        "line_start": 161,
                        "message": "Configuring now",
                        "name": "delete serviceaccountkey",
                        "notes": "Delete each of the offending service account keys.",
                        "number": 1,
                        "order": 6,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 660,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "delete_keys_1",
                        "required_params": {
                            "account": true,
                            "key": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Correct",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 153
                    },
                    {
                        "action": "delete serviceaccountkey",
                        "action_type": "correct",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "account": "list_serviceaccountkey_2:action_result.parameter.account",
                            "key": "list_serviceaccountkey_2:action_result.data.0.keys.*.name"
                        },
                        "angle": 0,
                        "app": "Google Cloud IAM",
                        "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                        "approver": "",
                        "assets": [
                            {
                                "action": "delete serviceaccountkey",
                                "actions": [
                                    "create serviceaccountkey",
                                    "delete serviceaccountkey",
                                    "get serviceaccountkey",
                                    "list serviceaccountkey",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Google Cloud IAM",
                                "app_version": "1.0.0",
                                "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                                "asset_name": "gcp-iam-splunkconf20",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "account": "list_serviceaccountkey_2:action_result.parameter.account",
                                    "key": "list_serviceaccountkey_2:action_result.data.0.keys.*.name"
                                },
                                "has_app": true,
                                "id": 8,
                                "loaded": false,
                                "missing": false,
                                "name": "gcp_iam",
                                "output": [
                                    {
                                        "column_name": "Account",
                                        "column_order": 0,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.account",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Key",
                                        "column_order": 1,
                                        "contains": [
                                            "gcloudiam key"
                                        ],
                                        "data_path": "action_result.parameter.key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "account": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Email address or the uniqueId of the service account",
                                        "key": "account",
                                        "order": 0,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    },
                                    "key": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Name of key",
                                        "key": "key",
                                        "order": 1,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    }
                                },
                                "product_name": "Cloud IAM",
                                "product_vendor": "Google",
                                "targets": "8",
                                "type": "devops"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "delete keys 2"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Correct"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_correct.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def delete_keys_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('delete_keys_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'delete_keys_2' call\n    results_data_1 = phantom.collect2(container=container, datapath=['list_serviceaccountkey_2:action_result.data.0.keys.*.name', 'list_serviceaccountkey_2:action_result.parameter.account', 'list_serviceaccountkey_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'delete_keys_2' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0] and results_item_1[1]:\n            parameters.append({\n                'key': results_item_1[0],\n                'account': results_item_1[1],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[2]},\n            })\n\n    phantom.act(action=\"delete serviceaccountkey\", parameters=parameters, assets=['gcp_iam'], name=\"delete_keys_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "gcp_unusual_usage_keys",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "delete keys 2",
                        "delay": 0,
                        "description": "Delete each of the offending service account keys.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "4418e12a-2971-4247-8248-e543a6a8338f",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 483,
                        "line_start": 459,
                        "message": "Configuring now",
                        "name": "delete serviceaccountkey",
                        "notes": "Delete each of the offending service account keys.",
                        "number": 2,
                        "order": 17,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 660,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "delete_keys_2",
                        "required_params": {
                            "account": true,
                            "key": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Correct",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 154
                    },
                    {
                        "action": "stop instance",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "project": "describe_instance_1:action_result.parameter.project",
                            "resourceid": "describe_instance_1:action_result.parameter.resourceid",
                            "zone": "describe_instance_1:action_result.parameter.zone"
                        },
                        "angle": 0,
                        "app": "Google Cloud Compute Engine",
                        "appid": "75fc6f53-dffd-4b1a-9083-0313b3d0178e",
                        "approver": "",
                        "assets": [
                            {
                                "action": "stop instance",
                                "actions": [
                                    "start instance",
                                    "stop instance",
                                    "describe instance",
                                    "tag instance",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Google Cloud Compute Engine",
                                "app_version": "1.0.0",
                                "appid": "75fc6f53-dffd-4b1a-9083-0313b3d0178e",
                                "asset_name": "gcp-compute-splunkconf20",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "id": "",
                                    "zone": "describe_instance_1:action_result.parameter.zone"
                                },
                                "has_app": true,
                                "id": 7,
                                "loaded": false,
                                "missing": false,
                                "name": "gcp_compute",
                                "output": [
                                    {
                                        "column_name": "Zone",
                                        "column_order": 0,
                                        "contains": [
                                            "gcloud computeengine zone"
                                        ],
                                        "data_path": "action_result.parameter.zone",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ID",
                                        "column_order": 1,
                                        "contains": [
                                            "gcloud computeengine id"
                                        ],
                                        "data_path": "action_result.parameter.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "DONE"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.zone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.targetId",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.startTime",
                                        "data_type": "string",
                                        "example_values": [
                                            "2020-07-14T04:42:34.287-07:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.endTime",
                                        "data_type": "string",
                                        "example_values": [
                                            "2020-07-14T04:42:34.287-07:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.operationType",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "project": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Project ID",
                                        "key": "project",
                                        "order": 0,
                                        "primary": false,
                                        "required": true,
                                        "value_list": []
                                    },
                                    "resourceid": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Resource ID of the instance",
                                        "key": "resourceid",
                                        "order": 2,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    },
                                    "zone": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Zone of the instance",
                                        "key": "zone",
                                        "order": 1,
                                        "primary": false,
                                        "required": true,
                                        "value_list": []
                                    }
                                },
                                "product_name": "Compute Engine",
                                "product_vendor": "Google",
                                "targets": "7",
                                "type": "virtualization"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "stop instance"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def stop_instance_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('stop_instance_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'stop_instance_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['describe_instance_1:action_result.parameter.zone', 'describe_instance_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'stop_instance_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'id': \"\",\n                'zone': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"stop instance\", parameters=parameters, assets=['gcp_compute'], name=\"stop_instance_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "gcp_unusual_usage_keys_and_vm",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Stop the compute instance referenced in the event.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a1095b20-2a0c-47bb-ad99-c0f6dba8e8a3",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 404,
                        "line_start": 380,
                        "message": "Configuring now",
                        "name": "stop instance",
                        "notes": "Stop the compute instance referenced in the event.",
                        "number": 1,
                        "order": 14,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 660,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "stop_instance_1",
                        "required_params": {
                            "id": true,
                            "zone": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 155
                    },
                    {
                        "action": "list serviceaccountkey",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "account": "artifact:*.cef.sourceUserId"
                        },
                        "angle": 0,
                        "app": "Google Cloud IAM",
                        "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                        "approver": "",
                        "assets": [
                            {
                                "action": "list serviceaccountkey",
                                "actions": [
                                    "create serviceaccountkey",
                                    "delete serviceaccountkey",
                                    "get serviceaccountkey",
                                    "list serviceaccountkey",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Google Cloud IAM",
                                "app_version": "1.0.0",
                                "appid": "2991cab9-e159-4d32-b74e-025030db746e",
                                "asset_name": "gcp-iam-splunkconf20",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "account": "artifact:*.cef.sourceUserId"
                                },
                                "has_app": true,
                                "id": 8,
                                "loaded": false,
                                "missing": false,
                                "name": "gcp_iam",
                                "output": [
                                    {
                                        "column_name": "Account",
                                        "column_order": 0,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.account",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.keyAlgorithm",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.keyOrigin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.keyType",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.validAfterTime",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.0.keys.*.validBeforeTime",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "account": {
                                        "contains": [],
                                        "data_type": "string",
                                        "default": "",
                                        "description": "Email address or the uniqueId of the service account",
                                        "key": "account",
                                        "order": 0,
                                        "primary": true,
                                        "required": true,
                                        "value_list": []
                                    }
                                },
                                "product_name": "Cloud IAM",
                                "product_vendor": "Google",
                                "targets": "8",
                                "type": "devops"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "list serviceaccountkey 1"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def list_serviceaccountkey_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('list_serviceaccountkey_1() called')\n\n    # collect data for 'list_serviceaccountkey_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceUserId', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'list_serviceaccountkey_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'account': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"list serviceaccountkey\", parameters=parameters, assets=['gcp_iam'], callback=format_key_info_1, name=\"list_serviceaccountkey_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 63,
                        "callsback": true,
                        "color": "",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "Show the keys that belong to the service account in question.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "f5237416-98b0-437a-9c43-6af582df4a5a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 59,
                        "line_start": 38,
                        "message": "Configuring now",
                        "name": "list serviceaccountkey",
                        "notes": "Show the keys that belong to the service account in question.",
                        "number": 1,
                        "order": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -100,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "list_serviceaccountkey_1",
                        "required_params": {
                            "account": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "app_action_assets",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 157
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "add comment",
                        "attrs": {
                            ".api": {
                                "text": "add comment"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def add_comment_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('add_comment_1() called')\n\n    phantom.comment(container=container, comment=\"An unusual serviceaccount alert was triggered but no serviceaccount name was found in the sourceUserId field of the alert, so manual investigation is needed.\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "addCommentComment": "An unusual serviceaccount alert was triggered but no serviceaccount name was found in the sourceUserId field of the alert, so manual investigation is needed.",
                                "key": "add-comment"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Leave a comment and stop playbook execution.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "1a625f81-b3c5-4d6f-81cb-a0f958ee5495",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 35,
                        "line_start": 28,
                        "message": "Configuring now",
                        "name": "add comment",
                        "notes": "Leave a comment and stop playbook execution.",
                        "number": 1,
                        "order": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -100,
                            "y": -60
                        },
                        "previous_function": "",
                        "previous_name": "add_comment_1",
                        "show_number": false,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 158
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "format key info 1"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def format_key_info_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_key_info_1() called')\n    \n    template = \"\"\"%%\nKey Name: {0}\nKey Type: {1}\nKey Origin: {2}\nKey Algorithm: {3}\nValid After Time: {4}\nValid Before Time: {5}\n\n%%\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"list_serviceaccountkey_1:action_result.data.0.keys.*.name\",\n        \"list_serviceaccountkey_1:action_result.data.0.keys.*.keyType\",\n        \"list_serviceaccountkey_1:action_result.data.0.keys.*.keyOrigin\",\n        \"list_serviceaccountkey_1:action_result.data.0.keys.*.keyAlgorithm\",\n        \"list_serviceaccountkey_1:action_result.data.0.keys.*.validAfterTime\",\n        \"list_serviceaccountkey_1:action_result.data.0.keys.*.validBeforeTime\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_key_info_1\", separator=\", \")\n\n    join_gcp_unusual_usage_keys_and_vm(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "list serviceaccountkey 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "format key info 1",
                        "delimiter": ", ",
                        "description": "Format information about each service account key so it can be used in a prompt.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "f8f616b9-9932-4711-94c7-a0ba7c78aa31",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 91,
                        "line_start": 62,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format information about each service account key so it can be used in a prompt.",
                        "number": 1,
                        "order": 4,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "list_serviceaccountkey_1:action_result.data.0.keys.*.name"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "list_serviceaccountkey_1:action_result.data.0.keys.*.keyType"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "list_serviceaccountkey_1:action_result.data.0.keys.*.keyOrigin"
                            },
                            {
                                "position": 3,
                                "type": "",
                                "value": "list_serviceaccountkey_1:action_result.data.0.keys.*.keyAlgorithm"
                            },
                            {
                                "position": 4,
                                "type": "",
                                "value": "list_serviceaccountkey_1:action_result.data.0.keys.*.validAfterTime"
                            },
                            {
                                "position": 5,
                                "type": "",
                                "value": "list_serviceaccountkey_1:action_result.data.0.keys.*.validBeforeTime"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 140,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "format_key_info_1",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "%%\nKey Name: {0}\nKey Type: {1}\nKey Origin: {2}\nKey Algorithm: {3}\nValid After Time: {4}\nValid Before Time: {5}\n\n%%",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 159
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "format key info 2"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def format_key_info_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_key_info_2() called')\n    \n    template = \"\"\"%%\nKey Name: {0}\nKey Type: {1}\nKey Origin: {2}\nKey Algorithm: {3}\nValid After Time: {4}\nValid Before Time: {5}\n\n%%\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"list_serviceaccountkey_2:action_result.data.0.keys.*.name\",\n        \"list_serviceaccountkey_2:action_result.data.0.keys.*.keyType\",\n        \"list_serviceaccountkey_2:action_result.data.0.keys.*.keyOrigin\",\n        \"list_serviceaccountkey_2:action_result.data.0.keys.*.keyAlgorithm\",\n        \"list_serviceaccountkey_2:action_result.data.0.keys.*.validAfterTime\",\n        \"list_serviceaccountkey_2:action_result.data.0.keys.*.validBeforeTime\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_key_info_2\", separator=\", \")\n\n    gcp_unusual_usage_keys(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "list serviceaccountkey 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "format key info 2",
                        "delimiter": ", ",
                        "description": "Format information about each service account key so it can be used in a prompt.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "576fbfb8-6951-4fe6-b482-6b40b9be36ea",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 335,
                        "line_start": 306,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format information about each service account key so it can be used in a prompt.",
                        "number": 3,
                        "order": 11,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 1,
                                "type": "",
                                "value": "list_serviceaccountkey_2:action_result.data.0.keys.*.name"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "list_serviceaccountkey_2:action_result.data.0.keys.*.keyType"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "list_serviceaccountkey_2:action_result.data.0.keys.*.keyOrigin"
                            },
                            {
                                "position": 3,
                                "type": "",
                                "value": "list_serviceaccountkey_2:action_result.data.0.keys.*.keyAlgorithm"
                            },
                            {
                                "position": 4,
                                "type": "",
                                "value": "list_serviceaccountkey_2:action_result.data.0.keys.*.validAfterTime"
                            },
                            {
                                "position": 5,
                                "type": "",
                                "value": "list_serviceaccountkey_2:action_result.data.0.keys.*.validBeforeTime"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 140,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "format_key_info_2",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "%%\nKey Name: {0}\nKey Type: {1}\nKey Origin: {2}\nKey Algorithm: {3}\nValid After Time: {4}\nValid Before Time: {5}\n\n%%",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 161
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".format": {
                                "text": "format vm info"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "opacity": 0,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out-1": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out-1>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "format"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def format_vm_info(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('format_vm_info() called')\n    \n    template = \"\"\"Instance ID: {0}\nInstance Name: {1}\nMachine Type: {2}\nInstance IP: {3}\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"describe_instance_1:action_result.summary.id\",\n        \"describe_instance_1:action_result.summary.name\",\n        \"describe_instance_1:action_result.summary.machineType\",\n        \"describe_instance_1:action_result.data.0.networkInterfaces.*.networkIP\",\n    ]\n\n    phantom.format(container=container, template=template, parameters=parameters, name=\"format_vm_info\", separator=\", \")\n\n    join_gcp_unusual_usage_keys_and_vm(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "describe instance",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "format vm info",
                        "delimiter": ", ",
                        "description": "Format key fields from the compute instance metadata so they can be displayed in a prompt.",
                        "format": "format",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "7944ee23-46b6-4f72-8f17-0be5e62cb011",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 303,
                        "line_start": 281,
                        "message": "Configuring now",
                        "name": "format",
                        "notes": "Format key fields from the compute instance metadata so they can be displayed in a prompt.",
                        "number": 2,
                        "order": 10,
                        "outPorts": [
                            "out-1"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "describe_instance_1:action_result.summary.id"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "describe_instance_1:action_result.summary.name"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "describe_instance_1:action_result.summary.machineType"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "describe_instance_1:action_result.data.0.networkInterfaces.*.networkIP"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 140,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "format_vm_info",
                        "show_number": true,
                        "size": {
                            "height": 100,
                            "width": 180
                        },
                        "state": "format",
                        "status": "",
                        "template": "Instance ID: {0}\nInstance Name: {1}\nMachine Type: {2}\nInstance IP: {3}",
                        "title": "format",
                        "type": "coa.Format",
                        "warn": false,
                        "z": 162
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "approver": "admin",
                        "approver_display": "admin",
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def gcp_unusual_usage_keys(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('gcp_unusual_usage_keys() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"Unusual Google Cloud Compute Engine activity was detected. The service account in use has the following service account keys:\n{0}\n\nShould the associated service account keys be deleted to disable further access?\"\"\"\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"gcp_unusual_usage_keys\", separator=\", \", response_types=response_types, callback=decision_5)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "connected_to_start": true,
                        "connection_name": "list serviceaccountkey 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "gcp_unusual_usage_keys",
                        "delimiter": ", ",
                        "description": "Use the formatted messages to prompt the analyst.",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "3282f317-77af-4d77-b1bb-30ad1486492b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 435,
                        "line_start": 407,
                        "message": "Unusual Google Cloud Compute Engine activity was detected. The service account in use has the following service account keys:\n{0}\n\nShould the associated service account keys be deleted to disable further access?",
                        "name": "prompt",
                        "notes": "Use the formatted messages to prompt the analyst.",
                        "number": 2,
                        "order": 15,
                        "outPorts": [
                            "out"
                        ],
                        "parameters": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "gcp_unusual_usage_keys",
                        "respond_in": "30",
                        "response_key": "Message",
                        "response_options": [],
                        "response_type": "list",
                        "responses": [
                            {
                                "response_key": "Yes/No",
                                "response_options": [
                                    "Yes",
                                    "No"
                                ],
                                "response_prompt": "",
                                "response_type": "list"
                            }
                        ],
                        "show_number": true,
                        "size": {
                            "height": 80,
                            "width": 80
                        },
                        "state": "prompt",
                        "status": "",
                        "type": "coa.Prompt",
                        "warn": false,
                        "z": 163
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "block"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_4() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"gcp_unusual_usage_keys_and_vm:action_result.summary.responses.1\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        stop_instance_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "gcp_unusual_usage_keys_and_vm",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "Check the prompt response.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ebb47c62-d70f-498c-805b-3ce0e1d7efeb",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 377,
                        "line_start": 359,
                        "name": "decision",
                        "notes": "Check the prompt response.",
                        "number": 4,
                        "order": 13,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "gcp_unusual_usage_keys_and_vm:action_result.summary.responses.1",
                                        "value": "Yes"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "decision_4",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 164
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#A30014",
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 5
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 1
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_error.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('decision_5() called')\n\n    # check for 'if' condition 1\n    matched = phantom.decision(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"gcp_unusual_usage_keys:action_result.summary.responses.0\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched:\n        delete_keys_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "gcp_unusual_usage_keys",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "decision_5",
                        "description": "Check the prompt response.",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0a136c89-d67a-4313-ae01-cf87ea2ee07d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 456,
                        "line_start": 438,
                        "name": "decision",
                        "notes": "Check the prompt response.",
                        "number": 5,
                        "order": 16,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "gcp_unusual_usage_keys:action_result.summary.responses.0",
                                        "value": "Yes"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 520,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "decision_5",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 165
                    }
                ]
            },
            "notes": "This playbook uses the following Apps:\n -  Google Cloud IAM (list serviceaccountkey, delete key) [asset name = gcp_iam] - Investigate and prevent suspicious service account key usage\n - Google Cloud Compute Engine (describe instance, stop instance) [asset name = gcp_compute] - Gather metadata about and potentially stop suspicious compute instance usage\n\nDeployment Notes:\n - Change the prompt user from \"admin\" to the appropriate individual or role\n - If possible, add a mechanism to gather information about the legitimate usage of service account keys and compute instances to prevent disruption of vital services"
        },
        "python_version": "3",
        "schema": 4,
        "version": "4.10.4.56260"
    },
    "create_time": "2021-06-16T17:30:15.188180+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ],
    "tags": []
}