ip_investigate_and_report.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Use Cases",
    "coa": {
        "data": {
            "clean": true,
            "code_block": "import ipaddress\ndef ipfilter(ip):\n    ranges =  ['192.168.0.0/24',]\n    for item in ranges:\n        if phantom.is_ip(ip) and ipaddress.ip_address(ip) not in ipaddress.ip_network(item):\n            return ip\n    return None",
            "description": "This playbook executes multiple investigative actions to determine if an IP address is malicious and sends a summary of the output in an email.",
            "hash": "be2d28d3176d206f09057e8600e611e815d68a25",
            "joint": {
                "cells": [
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b47e7947-439f-4b5c-b57c-c83fc42f64ce",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "02d1cb61-4111-47d1-8c44-3ce7ed79fcb1",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a0430d22-410d-46e8-a695-d85b73c55708",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 17
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "87184413-0819-48c7-aca0-d5b233729b44",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a0430d22-410d-46e8-a695-d85b73c55708",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "15a77eb1-d782-4037-b878-303d1a9176e4",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 33
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "a568ef57-92a1-4404-8768-5ad9fa51c23e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a0430d22-410d-46e8-a695-d85b73c55708",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ae9dfa56-47a3-4932-bbdf-c9706f3238f0",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 61
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c8891019-5600-4ba7-ad33-ab0da671080e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ae9dfa56-47a3-4932-bbdf-c9706f3238f0",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c706012c-8e99-44d9-a1d8-262d8e585884",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 102
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e8665a61-1d3f-4793-88cf-815d4e8a43c3",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "15a77eb1-d782-4037-b878-303d1a9176e4",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c706012c-8e99-44d9-a1d8-262d8e585884",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 122
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "fa88acb2-3362-474b-86b1-769c80859b73",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "868eb913-c7c8-4ad5-9c08-14b5b4b07062",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "9c155d1e-38e1-446c-89e8-68fa25ae0c3d",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 261
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "fb1ee6ca-3ae1-4225-8960-1a11a68a7a40",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "caca1d96-9678-48af-aa06-367f44a01e70",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bbbae210-6e66-442b-add9-898540966f64",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 715
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "09ce9a9d-3a20-4df4-8f16-bd270afe649c",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bbbae210-6e66-442b-add9-898540966f64",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "02d1cb61-4111-47d1-8c44-3ce7ed79fcb1",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 728
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0a8972bc-385d-4471-b9f8-62923b291af0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a0430d22-410d-46e8-a695-d85b73c55708",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "9472a2c6-960e-438f-b658-a2355bb10867",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 744
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "79ce1ca5-a4c6-4f68-b80a-49b58fd54771",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9472a2c6-960e-438f-b658-a2355bb10867",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c706012c-8e99-44d9-a1d8-262d8e585884",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 762
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7fded657-b908-43d4-924e-a0312c48a8d9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bbbae210-6e66-442b-add9-898540966f64",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "868eb913-c7c8-4ad5-9c08-14b5b4b07062",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 789
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0f88bc81-ea2f-424f-95d3-ef0990776472",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9c155d1e-38e1-446c-89e8-68fa25ae0c3d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0a8e9c3d-7624-4489-baa2-850ed42fb5b0",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 976
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b7f4db6b-c798-4448-b899-1ba9f076deb3",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0a8e9c3d-7624-4489-baa2-850ed42fb5b0",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bda24ef4-87ad-4370-914e-255feadaf697",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1119
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "938ba294-bbc4-4d0a-8bc4-b05b2c4fc8e8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0a8e9c3d-7624-4489-baa2-850ed42fb5b0",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "3ac8bba5-7b6f-4b09-aad8-540fcc9ea750",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1130
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ef012fe8-cdd7-45ab-83eb-2caf2fc7b5ee",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0a8e9c3d-7624-4489-baa2-850ed42fb5b0",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b36f4b24-4260-4aca-aabc-048b168aaa78",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1154
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d329ba79-69cf-4232-b27b-b2ee821b52a4",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bda24ef4-87ad-4370-914e-255feadaf697",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f333f499-2563-421c-a1bf-f41217c1c908",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1387
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "70950154-f663-46d0-8412-30aa2b93605e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "3ac8bba5-7b6f-4b09-aad8-540fcc9ea750",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f333f499-2563-421c-a1bf-f41217c1c908",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1422
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "fc71359d-4738-4b91-92ff-9abf3a9a6cae",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "b36f4b24-4260-4aca-aabc-048b168aaa78",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f333f499-2563-421c-a1bf-f41217c1c908",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1424
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "4ad88801-9928-4bb0-a771-d5bd50de571c",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "02d1cb61-4111-47d1-8c44-3ce7ed79fcb1",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b9ec3971-bbab-4283-9e30-09e2fc2c1fe9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1627
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "5f494768-6c58-42f4-9e2c-784f4b3b3e8b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "b9ec3971-bbab-4283-9e30-09e2fc2c1fe9",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "be8d9a62-17ed-49cf-bf7b-8a6e33b39af5",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1650
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0d473970-a80c-4e90-a645-4ebe29895818",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "9c155d1e-38e1-446c-89e8-68fa25ae0c3d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b9ec3971-bbab-4283-9e30-09e2fc2c1fe9",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1659
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "8abcae7d-d5cd-4669-80c9-c83813485555",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bbbae210-6e66-442b-add9-898540966f64",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "be8d9a62-17ed-49cf-bf7b-8a6e33b39af5",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 2256
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "adc24fe2-6e93-42fa-b0f6-ae3e71dc2507",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0a8e9c3d-7624-4489-baa2-850ed42fb5b0",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2eb8ca54-9648-486b-aa1c-ddd4c65ffdc2",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2477
                    },
                    {
                        "action": "whois ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "ip_reputation_1:filtered-action_result.parameter.ip"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "ip_reputation_1:filtered-action_result.parameter.ip"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domaintools",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "IP",
                                        "column_order": 1,
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.1",
                                            "203.88.139.34",
                                            "10.0.1.20"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.abuse_mailbox",
                                        "data_type": "string",
                                        "example_values": [
                                            "test@test.net"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address",
                                        "data_type": "string",
                                        "example_values": [
                                            "Australia",
                                            "India",
                                            "90292"
                                        ]
                                    },
                                    {
                                        "column_name": "Address",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.0",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "City",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.1",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "State",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.2",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Postal Code",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.address.3",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.abuse",
                                        "data_type": "string",
                                        "example_values": [
                                            "IANA-IP-ARIN"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.admin",
                                        "data_type": "string",
                                        "example_values": [
                                            "AH256-AP"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.noc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.contact_keys.tech",
                                        "data_type": "string",
                                        "example_values": [
                                            "AH256-AP",
                                            "IANA-IP-ARIN"
                                        ]
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "in",
                                            "us"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.created_date",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "column_name": "email",
                                        "column_order": 5,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.email",
                                        "data_type": "string",
                                        "example_values": [
                                            "research@test.net",
                                            "test@splunk.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.fax",
                                        "data_type": "string",
                                        "example_values": [
                                            "61738583199",
                                            "912612789501"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.id",
                                        "data_type": "string",
                                        "example_values": [
                                            "IRT-APNICRANDNET-AU",
                                            "NI23-AP",
                                            "IANA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.mnt_keys.by",
                                        "data_type": "string",
                                        "example_values": [
                                            "MAINT-APNIC-AP",
                                            "MAINT-IN-YOU"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.mnt_keys.ref",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC-HM"
                                        ]
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 10,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "NOC IQARA",
                                            "Internet Assigned Numbers Authority"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.other.auth",
                                        "data_type": "string",
                                        "example_values": [
                                            "# Filtered"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.phone",
                                        "data_type": "string",
                                        "example_values": [
                                            "61738583188",
                                            "912612789500",
                                            "13103015820"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.ref",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "https://rdap.arin.net/registry/entity/IANA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.remarks",
                                        "data_type": "string",
                                        "example_values": [
                                            "-----------------------------------------"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.source",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC",
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.type",
                                        "data_type": "string",
                                        "example_values": [
                                            "irt",
                                            "person",
                                            "organization"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.*.updated_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2011-09-22T03:53:02+00:00",
                                            "2010-04-07T10:10:28+00:00",
                                            "2012-08-31T00:00:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.asn",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.abuse",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.admin",
                                        "data_type": "string",
                                        "example_values": [
                                            "AR302-AP",
                                            "SG135-AP"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.noc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.org",
                                        "data_type": "string",
                                        "example_values": [
                                            "IANA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.contact_keys.tech",
                                        "data_type": "string",
                                        "example_values": [
                                            "AR302-AP",
                                            "NI23-AP"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "au",
                                            "in",
                                            ""
                                        ]
                                    },
                                    {
                                        "column_name": "Created Date",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.created_date",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.customer",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.descr",
                                        "data_type": "string",
                                        "example_values": [
                                            "Research prefix for APNIC Labs",
                                            "YOU Telecom India Pvt Ltd",
                                            "http://datatracker.ietf.org/doc/rfc1918"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.id",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "NET-10-0-0-0-1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.mnt_keys.by",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC-HM",
                                            "MAINT-IN-YOU"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.mnt_keys.irt",
                                        "data_type": "string",
                                        "example_values": [
                                            "IRT-APNICRANDNET-AU"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.mnt_keys.routes",
                                        "data_type": "string",
                                        "example_values": [
                                            "MAINT-AU-APNIC-GM85-AP"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC-LABS",
                                            "YOUTELE",
                                            "PRIVATE-ADDRESS-ABLK-RFC1918-IANA-RESERVED"
                                        ]
                                    },
                                    {
                                        "column_name": "Organization",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.org",
                                        "data_type": "string",
                                        "example_values": [
                                            "ORG-ARAD1-AP",
                                            "",
                                            "Internet Assigned Numbers Authority (IANA)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.parent",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "()"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.parent_id",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "column_name": "CIDR",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.cidr",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.0/24",
                                            "203.88.128.0/20",
                                            "10.0.0.0/8"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            256,
                                            4096,
                                            16777216
                                        ]
                                    },
                                    {
                                        "column_name": "Range Low",
                                        "column_order": 13,
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.from",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.0",
                                            "203.88.128.0",
                                            "10.0.0.0"
                                        ]
                                    },
                                    {
                                        "column_name": "Range Low",
                                        "column_order": 14,
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.range.to",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.255",
                                            "203.88.143.255",
                                            "10.255.255.255"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.ref",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "https://rdap.arin.net/registry/ip/10.0.0.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.remarks",
                                        "data_type": "string",
                                        "example_values": [
                                            "---------------"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.source",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC",
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "ASSIGNED PORTABLE",
                                            "ASSIGNED NON-PORTABLE",
                                            "IANA Special Use"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.networks.*.updated_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-03-30T01:51:28+00:00",
                                            "2009-12-10T05:27:14+00:00",
                                            "2013-08-30T00:00:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.asn",
                                        "data_type": "string",
                                        "example_values": [
                                            "AS13335",
                                            "AS18207"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.country",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.created_date",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.descr",
                                        "data_type": "string",
                                        "example_values": [
                                            "6 Cordelia St",
                                            "Splunk Inc."
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.id",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.0/24",
                                            "203.88.128.0/24"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.mnt_keys.by",
                                        "data_type": "string",
                                        "example_values": [
                                            "MAINT-AU-APNIC-GM85-AP",
                                            "MAINT-IN-YOU"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.mnt_keys.lower",
                                        "data_type": "string",
                                        "example_values": [
                                            "MAINT-IN-YOU"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.mnt_keys.routes",
                                        "data_type": "string",
                                        "example_values": [
                                            "MAINT-IN-YOU"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.org",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.ref",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.source",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.status",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.routes.*.updated_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-03-16T16:58:06+00:00",
                                            "2011-12-03T11:08:14+00:00"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.data.*.record_source",
                                        "data_type": "string",
                                        "example_values": [
                                            "1.1.1.1",
                                            "203.88.128.214",
                                            "10.3.88.37"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registrant",
                                        "data_type": "string",
                                        "example_values": [
                                            "ORG-ARAD1-AP",
                                            "YOUTELE",
                                            "Internet Assigned Numbers Authority (IANA)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.source",
                                        "data_type": "string",
                                        "example_values": [
                                            "APNIC",
                                            "ARIN"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.whois.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-23",
                                            "2018-10-07"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.whois.record",
                                        "data_type": "string",
                                        "example_values": [
                                            "inetnum:        1.1.1.0 - 1.1.1.255\nnetname:        APNIC-LABS\ndescr:          APNIC and Cloudflare DNS Resolver project\ndescr:          Routed globally by AS13335/Cloudflare\ndescr:          Research prefix for APNIC Labs\ncountry:        AU\norg:            ORG-ARAD1-AP\nadmin-c:        AR302-AP\ntech-c:         AR302-AP\nmnt-by:         APNIC-HM\nmnt-routes:     MAINT-AU-APNIC-GM85-AP\nmnt-irt:        IRT-APNICRANDNET-AU\nstatus:         ASSIGNED PORTABLE\nremarks:        ---------------\nremarks:        All Cloudflare abuse reporting can be done via\nremarks:        resolver-abuse@cloudflare.com\nremarks:        ---------------\nlast-modified:  2018-03-30T01:51:28Z\nsource:         APNIC\n\nirt:            IRT-APNICRANDNET-AU\naddress:        PO Box 3646\naddress:        South Brisbane, QLD 4101\naddress:        Australia\ne-mail:         abuse@apnic.net\nabuse-mailbox:  abuse@apnic.net\nadmin-c:        AR302-AP\ntech-c:         AR302-AP\nauth:           # Filtered\nmnt-by:         MAINT-AU-APNIC-GM85-AP\nlast-modified:  2011-09-22T03:53:02Z\nsource:         APNIC\n\norganisation:   ORG-ARAD1-AP\norg-name:       APNIC Research and Development\ncountry:        AU\naddress:        6 Cordelia St\nphone:          +61-7-38583100\nfax-no:         +61-7-38583199\ne-mail:         helpdesk@apnic.net\nmnt-ref:        APNIC-HM\nmnt-by:         APNIC-HM\nlast-modified:  2017-10-11T01:28:39Z\nsource:         APNIC\n\nrole:           APNIC RESEARCH\naddress:        PO Box 3646\naddress:        South Brisbane, QLD 4101\naddress:        Australia\ncountry:        AU\nphone:          +61-7-3858-3188\nfax-no:         +61-7-3858-3199\ne-mail:         research@apnic.net\nnic-hdl:        AR302-AP\ntech-c:         AH256-AP\nadmin-c:        AH256-AP\nmnt-by:         MAINT-APNIC-AP\nlast-modified:  2018-04-04T04:26:04Z\nsource:         APNIC\n\nroute:          1.1.1.0/24\norigin:         AS13335\ndescr:          APNIC Research and Development\n                6 Cordelia St\nmnt-by:         MAINT-AU-APNIC-GM85-AP\nlast-modified:  2018-03-16T16:58:06Z\nsource:         APNIC\n",
                                            "inetnum:        203.88.128.0 - 203.88.143.255\nnetname:        YOUTELE\ndescr:          Splunk Inc\ncountry:        US\nadmin-c:        SG135-AP\ntech-c:         NI23-AP\nstatus:         ASSIGNED NON-PORTABLE\nmnt-by:         MAINT-IN-YOU\nlast-modified:  2009-12-10T05:27:14Z\nsource:         APNIC\n\nperson:         NOC IQARA\nnic-hdl:        NI23-AP\ne-mail:         network@SPLUNK.COM\naddress:        Splunk Inc.\naddress:        Iqara Center\naddress:        San-Jose\naddress:        San jose\nphone:          +1-261-2789500\nfax-no:         +1-261-2789501\ncountry:        US\nmnt-by:         MAINT-US-YOU\nlast-modified:  2010-04-07T10:10:28Z\nsource:         APNIC\n\nperson:         SRIDHAR G\nnic-hdl:        SG135-AP\ne-mail:         test@splunk.com\nremarks:        -----------------------------------------\nremarks:        send abuse and spam report to\nremarks:        test@splunk.com or test@splunk.com\nremarks:        -----------------------------------------\naddress:        Splunk Inc.\naddress:        Millenium Arcade, 2nd floor\naddress:        San Jose\naddress:        CA\naddress:        US\nphone:          +91-261-2789500\nfax-no:         +91-261-2789501\ncountry:        IN\nmnt-by:         MAINT-IN-YOU\nlast-modified:  2010-05-13T04:40:07Z\nsource:         APNIC\n\nroute:          203.88.128.0/24\ndescr:          Splunk Inc.\norigin:         AS18207\nmnt-lower:      MAINT-IN-YOU\nmnt-routes:     MAINT-IN-YOU\nmnt-by:         MAINT-IN-YOU\nlast-modified:  2011-12-03T11:08:14Z\nsource:         APNIC\n",
                                            "NetRange:       10.0.0.0 - 10.255.255.255\nCIDR:           10.0.0.0/8\nNetName:        PRIVATE-ADDRESS-ABLK-RFC1918-IANA-RESERVED\nNetHandle:      NET-10-0-0-0-1\nParent:          ()\nNetType:        IANA Special Use\nOriginAS:       \nOrganization:   Internet Assigned Numbers Authority (IANA)\nRegDate:        \nUpdated:        2013-08-30\nComment:        These addresses are in use by many millions of independently operated networks, which might be as small as a single computer connected to a home gateway, and are automatically configured in hundreds of millions of devices.  They are only intended for use within a private context  and traffic that needs to cross the Internet will need to use a different, unique address.\nComment:        \nComment:        These addresses can be used by anyone without any need to coordinate with IANA or an Internet registry.  The traffic from these addresses does not come from ICANN or IANA.  We are not the source of activity you may see on logs or in e-mail records.  Please refer to http://www.iana.org/abuse/answers\nComment:        \nComment:        These addresses were assigned by the IETF, the organization that develops Internet protocols, in the Best Current Practice document, RFC 1918 which can be found at:\nComment:        http://datatracker.ietf.org/doc/rfc1918\nRef:            https://rdap.arin.net/registry/ip/10.0.0.0\n\nOrgName:        Internet Assigned Numbers Authority\nOrgId:          IANA\nAddress:        12025 Waterfront Drive\nAddress:        Suite 300\nCity:           Los Angeles\nStateProv:      CA\nPostalCode:     90292\nCountry:        US\nRegDate:        \nUpdated:        2012-08-31\nRef:            https://rdap.arin.net/registry/entity/IANA\n\nOrgAbuseHandle: IANA-IP-ARIN\nOrgAbuseName:   ICANN\nOrgAbusePhone:  +1-310-301-5820 \nOrgAbuseEmail:  abuse@iana.org\nOrgAbuseRef:    https://rdap.arin.net/registry/entity/IANA-IP-ARIN\n\nOrgTechHandle: IANA-IP-ARIN\nOrgTechName:   ICANN\nOrgTechPhone:  +1-310-301-5820 \nOrgTechEmail:  abuse@iana.org\nOrgTechRef:    https://rdap.arin.net/registry/entity/IANA-IP-ARIN\n"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.city",
                                        "data_type": "string",
                                        "example_values": []
                                    },
                                    {
                                        "data_path": "action_result.summary.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "in",
                                            "us"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.organization",
                                        "data_type": "string",
                                        "example_values": [
                                            "ORG-ARAD1-AP",
                                            "YOUTELE",
                                            "Internet Assigned Numbers Authority (IANA)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Organization: ORG-ARAD1-AP, City: None, Country: ",
                                            "Organization: YOUTELE, City: None, Country: in",
                                            "Organization: Internet Assigned Numbers Authority (IANA), City: None, Country: us"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "whois ip"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def whois_ip_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('whois_ip_3() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'whois_ip_3' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"ip_reputation_1:filtered-action_result.parameter.ip\", \"ip_reputation_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'whois_ip_3' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'ip': passed_filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"whois ip\", parameters=parameters, assets=['domaintools'], callback=join_send_email_bad_ip, name=\"whois_ip_3\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": false,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "9472a2c6-960e-438f-b658-a2355bb10867",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 53,
                        "line_start": 30,
                        "message": "Configuring now",
                        "name": "whois ip",
                        "notes": "",
                        "number": 3,
                        "order": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 320
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "whois_ip_3",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3014
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c4cb14b7-65ec-450d-a8aa-50395fa5e994",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c706012c-8e99-44d9-a1d8-262d8e585884",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2b8db314-5e36-4198-8e69-697b291e7b38",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 3060
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "5bfbd0b3-383a-4957-b4ca-26a2db8c8110",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2b8db314-5e36-4198-8e69-697b291e7b38",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b7b279ab-91c7-4491-bbb3-a0688cebf9b3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3094
                    },
                    {
                        "action": "reverse ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.sourceAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.sourceAddress"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domaintools",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "Query IP",
                                        "column_order": 1,
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "example_values": [
                                            "52.91.186.198",
                                            "8.8.8.8"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.ip_addresses.domain_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            8044
                                        ]
                                    },
                                    {
                                        "column_name": "Related Domain Names",
                                        "column_order": 2,
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.ip_addresses.domain_names",
                                        "data_type": "string",
                                        "example_values": [
                                            "TEST.TODAY"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.data.*.ip_addresses.ip_address",
                                        "data_type": "string",
                                        "example_values": [
                                            "8.8.8.8"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.summary.total_domains",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0,
                                            8044
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "No Reverse IP data found for that IP / domain name.",
                                            "Total domains: 8044"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "reverse ip"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def reverse_ip_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('reverse_ip_2() called')\n\n    # collect data for 'reverse_ip_2' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'reverse_ip_2' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"reverse ip\", parameters=parameters, assets=['domaintools'], callback=domain_reputation_2, name=\"reverse_ip_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": false,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "868eb913-c7c8-4ad5-9c08-14b5b4b07062",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 74,
                        "line_start": 53,
                        "message": "Configuring now",
                        "name": "reverse ip",
                        "notes": "",
                        "number": 2,
                        "order": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 140,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "reverse_ip_2",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3102
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "1e1aa166-9973-4fa2-bb58-443ff0013b6b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "be8d9a62-17ed-49cf-bf7b-8a6e33b39af5",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b4f679d1-6885-4071-8834-fd6e1d09dc91",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 3203
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "fd22df48-fd2b-4006-aacc-4fdb536f8160",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "b4f679d1-6885-4071-8834-fd6e1d09dc91",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "670f4bfd-72fa-4645-85cc-6a16c0d308a8",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 3211
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "bb013725-9549-4298-b0ac-dc2c48063a4f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "670f4bfd-72fa-4645-85cc-6a16c0d308a8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b7b279ab-91c7-4491-bbb3-a0688cebf9b3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3226
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "aea0ef4e-6c4b-4867-ad1a-d4957692a33e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "f333f499-2563-421c-a1bf-f41217c1c908",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "1c02b905-3b34-4791-ba88-02e5a8079468",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 3250
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "466fca36-a9a4-4b96-9b6b-cf21b92f5245",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "1c02b905-3b34-4791-ba88-02e5a8079468",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b7b279ab-91c7-4491-bbb3-a0688cebf9b3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3260
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "send email bad ip, send email safe, send email bad domain, send email unknown",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "b7b279ab-91c7-4491-bbb3-a0688cebf9b3",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 548,
                        "line_start": 535,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 25,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1480,
                            "y": 220
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 3262
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 0.7
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_severity_4() called')\n\n    phantom.set_severity(container=container, severity=\"high\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "high"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "send email bad domain",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "1c02b905-3b34-4791-ba88-02e5a8079468",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 106,
                        "line_start": 99,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "",
                        "number": 4,
                        "order": 5,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1240,
                            "y": 720
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_4",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 3269
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "87a01570-7eac-4c1a-bc78-f7eb0e9f326b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2eb8ca54-9648-486b-aa1c-ddd4c65ffdc2",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "24be9c02-03ec-4839-97cc-912a124df65d",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 3271
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "53493f03-61fe-4b4c-aa04-be730e925eda",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "24be9c02-03ec-4839-97cc-912a124df65d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "88af435b-87bc-424c-9070-37dfc0332239",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 3279
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_severity_2() called')\n\n    phantom.set_severity(container=container, severity=\"low\")\n    set_status_3(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "low"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "send email safe",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "b4f679d1-6885-4071-8834-fd6e1d09dc91",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 114,
                        "line_start": 106,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "",
                        "number": 2,
                        "order": 6,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1000,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_2",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 3285
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set status",
                        "attrs": {
                            ".api": {
                                "text": "set status"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_status_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_status_3() called')\n\n    phantom.set_status(container=container, status=\"closed\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-status",
                                "setStatusStatus": "closed"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "send email safe",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "670f4bfd-72fa-4645-85cc-6a16c0d308a8",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 121,
                        "line_start": 114,
                        "message": "Configuring now",
                        "name": "set status",
                        "notes": "",
                        "number": 3,
                        "order": 7,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1240,
                            "y": 580
                        },
                        "previous_function": "",
                        "previous_name": "set_status_3",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 3289
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_severity_5() called')\n\n    phantom.set_severity(container=container, severity=\"low\")\n    set_status_6(container=container)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "low"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "send email unknown",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "24be9c02-03ec-4839-97cc-912a124df65d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 129,
                        "line_start": 121,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "",
                        "number": 5,
                        "order": 8,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1000,
                            "y": 1100
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_5",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 3291
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set status",
                        "attrs": {
                            ".api": {
                                "text": "set status"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_status_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_status_6() called')\n\n    phantom.set_status(container=container, status=\"closed\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-status",
                                "setStatusStatus": "closed"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "send email unknown",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "88af435b-87bc-424c-9070-37dfc0332239",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 136,
                        "line_start": 129,
                        "message": "Configuring now",
                        "name": "set status",
                        "notes": "",
                        "number": 6,
                        "order": 9,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1240,
                            "y": 1100
                        },
                        "previous_function": "",
                        "previous_name": "set_status_6",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 3295
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f37e1b7a-035b-4452-b437-0475fbbdd421",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "88af435b-87bc-424c-9070-37dfc0332239",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b7b279ab-91c7-4491-bbb3-a0688cebf9b3",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3296
                    },
                    {
                        "action": "ip reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.sourceAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "ip reputation",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.40",
                                "appid": "",
                                "asset_name": "virustotal",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "ip": "artifact:*.cef.sourceAddress"
                                },
                                "has_app": true,
                                "id": 142,
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "Ip",
                                        "column_order": 0,
                                        "contains": [
                                            "ip",
                                            "ipv6"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "example_values": [
                                            "8.8.8.8"
                                        ]
                                    },
                                    {
                                        "column_name": "As Owner",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.as_owner",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test Inc."
                                        ]
                                    },
                                    {
                                        "column_name": "Asn",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.asn",
                                        "data_type": "string",
                                        "example_values": [
                                            "15169"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.continent",
                                        "data_type": "string",
                                        "example_values": [
                                            "NA"
                                        ]
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "US"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 08:27:02"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "95aea1163cd742d895f048de9b7f7ae83149ba2515b174dc6d5cfd910cb07ee3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_communicating_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            61
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2017-09-28 14:00:34"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "2b977b6342a624097b669fd2347ffbcbdc8a814369b5f431835793dbaa2251c8"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_downloaded_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            57
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-02-14 12:35:57"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            25
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "6c16bbddc9dcbf447c44afb11387115ac657852fcdf30cf068cf6e11e8786212"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_referrer_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            70
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.scan_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 07:31:41"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.detected_urls.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            67
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.detected_urls.*.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "http://vanmaulop10.com/now/index.php?mail="
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.network",
                                        "data_type": "string",
                                        "example_values": [
                                            "8.8.8.0/24"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.resolutions.*.hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "*.o365answers.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolutions.*.last_resolved",
                                        "data_type": "string",
                                        "example_values": [
                                            "2015-12-10 00:00:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-02-01 09:03:52"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "414296de0c223c28910d99797701d4fa192208f4e30c32b0dc07da7602d7a4fb"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_communicating_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            57
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-01-30 20:23:21"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "23926e9185d8d43c02807a838ffb373cc1977726094a4e46807c66ada9dd7660"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_downloaded_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            71
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_referrer_samples.*.positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.undetected_referrer_samples.*.sha256",
                                        "data_type": "string",
                                        "example_values": [
                                            "01e110d94eec3ec8abed7c9bb34fd7bcc3bd06c397ec83676431fc193be3b68e"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_referrer_samples.*.total",
                                        "data_type": "numeric",
                                        "example_values": [
                                            55
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.undetected_urls.*",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-01 03:53:53"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string",
                                        "example_values": [
                                            "IP address in dataset"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.communicating_samples",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.detected_urls",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.downloaded_samples",
                                        "data_type": "numeric",
                                        "example_values": [
                                            11
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Downloaded samples: 11, Detected urls: 100, Communicating samples: 100"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "ip": {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "IP to query",
                                        "key": "ip",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "targets": "34",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "ip reputation"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('ip_reputation_1() called')\n\n    # collect data for 'ip_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'ip_reputation_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(action=\"ip reputation\", parameters=parameters, assets=['virustotal'], callback=ip_reputation_1_callback, name=\"ip_reputation_1\")\n\n    return",
                        "callback_code": "def ip_reputation_1_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('ip_reputation_1_callback() called')\n    \n    filter_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    join_filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_start": 157,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "02d1cb61-4111-47d1-8c44-3ce7ed79fcb1",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 165,
                        "line_start": 136,
                        "message": "Configuring now",
                        "name": "ip reputation",
                        "notes": "",
                        "number": 1,
                        "order": 10,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 500
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "ip_reputation_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3297
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('set_severity_1() called')\n\n    phantom.set_severity(container=container, severity=\"high\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "high"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "send email bad ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2b8db314-5e36-4198-8e69-697b291e7b38",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 172,
                        "line_start": 165,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "",
                        "number": 1,
                        "order": 11,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1240,
                            "y": 200
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_1",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 3298
                    },
                    {
                        "action": "send email",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attachments": "",
                            "body": "A safe port scan was detected, see Phantom for details.",
                            "from": "admin@phantom.us",
                            "subject": "Port Scan determined safe",
                            "to": "michael@phantom.us"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "attachments": "",
                                    "bcc": "",
                                    "body": "A safe port scan was detected, see Phantom for details.",
                                    "cc": "",
                                    "from": "admin@phantom.us",
                                    "headers": "",
                                    "subject": "Port Scan determined safe",
                                    "to": "michael@phantom.us"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "smtp",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 0,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.attachments",
                                        "data_type": "string",
                                        "example_values": [
                                            "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.bcc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test1@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.body",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test body"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.cc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test2@testdomain.com"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string",
                                        "example_values": [
                                            "sender@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.headers",
                                        "data_type": "string",
                                        "example_values": [
                                            "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.to",
                                        "data_type": "string",
                                        "example_values": [
                                            "receiver@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Email sent"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "email"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "send email safe"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def send_email_safe(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('send_email_safe() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'send_email_safe' call\n\n    parameters = []\n    \n    # build parameters list for 'send_email_safe' call\n    parameters.append({\n        'cc': \"\",\n        'to': \"michael@phantom.us\",\n        'bcc': \"\",\n        'body': \"A safe port scan was detected, see Phantom for details.\",\n        'from': \"admin@phantom.us\",\n        'headers': \"\",\n        'subject': \"Port Scan determined safe\",\n        'attachments': \"\",\n    })\n\n    phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], callback=set_severity_2, name=\"send_email_safe\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 237,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "ip reputation, domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "send email safe",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "be8d9a62-17ed-49cf-bf7b-8a6e33b39af5",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_send_email_safe(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_send_email_safe() called')\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['ip_reputation_1', 'domain_reputation_2']):\n        \n        # call connected block \"send_email_safe\"\n        send_email_safe(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 197,
                        "line_end": 208,
                        "line_start": 172,
                        "message": "Configuring now",
                        "name": "send email",
                        "notes": "",
                        "number": 1,
                        "order": 12,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 580
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "send_email_safe",
                        "required_params": {
                            "body": true,
                            "to": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3300
                    },
                    {
                        "action": "send email",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attachments": "",
                            "body": "Please see the results of the phantom PB run",
                            "from": "notifications@phantom.us",
                            "subject": "Unknown Domain Port Scan",
                            "to": "notifications@phantom.us"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "attachments": "",
                                    "bcc": "",
                                    "body": "Please see the results of the phantom PB run",
                                    "cc": "",
                                    "from": "notifications@phantom.us",
                                    "headers": "",
                                    "subject": "Unknown Domain Port Scan",
                                    "to": "notifications@phantom.us"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "smtp",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 0,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.attachments",
                                        "data_type": "string",
                                        "example_values": [
                                            "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.bcc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test1@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.body",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test body"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.cc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test2@testdomain.com"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string",
                                        "example_values": [
                                            "sender@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.headers",
                                        "data_type": "string",
                                        "example_values": [
                                            "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.to",
                                        "data_type": "string",
                                        "example_values": [
                                            "receiver@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Email sent"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "email"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "send email unknown"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def send_email_unknown(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('send_email_unknown() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'send_email_unknown' call\n\n    parameters = []\n    \n    # build parameters list for 'send_email_unknown' call\n    parameters.append({\n        'cc': \"\",\n        'to': \"notifications@phantom.us\",\n        'bcc': \"\",\n        'body': \"Please see the results of the phantom PB run\",\n        'from': \"notifications@phantom.us\",\n        'headers': \"\",\n        'subject': \"Unknown Domain Port Scan\",\n        'attachments': \"\",\n    })\n\n    phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], callback=set_severity_5, name=\"send_email_unknown\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 74,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "send email unknown",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2eb8ca54-9648-486b-aa1c-ddd4c65ffdc2",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 233,
                        "line_start": 208,
                        "message": "Configuring now",
                        "name": "send email",
                        "notes": "",
                        "number": 4,
                        "order": 13,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 1100
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "send_email_unknown",
                        "required_params": {
                            "body": true,
                            "to": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3301
                    },
                    {
                        "action": "send email",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attachments": "",
                            "body": "Check phantom to see output results for bad port scan.",
                            "from": "notifications@phantom.us",
                            "subject": "Port Scan detected from bad domain",
                            "to": "notifications@phantom.us"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "attachments": "",
                                    "bcc": "",
                                    "body": "Check phantom to see output results for bad port scan.",
                                    "cc": "",
                                    "from": "notifications@phantom.us",
                                    "headers": "",
                                    "subject": "Port Scan detected from bad domain",
                                    "to": "notifications@phantom.us"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "smtp",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 0,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.attachments",
                                        "data_type": "string",
                                        "example_values": [
                                            "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.bcc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test1@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.body",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test body"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.cc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test2@testdomain.com"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string",
                                        "example_values": [
                                            "sender@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.headers",
                                        "data_type": "string",
                                        "example_values": [
                                            "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.to",
                                        "data_type": "string",
                                        "example_values": [
                                            "receiver@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Email sent"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "email"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "send email bad domain"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def send_email_bad_domain(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('send_email_bad_domain() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'send_email_bad_domain' call\n\n    parameters = []\n    \n    # build parameters list for 'send_email_bad_domain' call\n    parameters.append({\n        'cc': \"\",\n        'to': \"notifications@phantom.us\",\n        'bcc': \"\",\n        'body': \"Check phantom to see output results for bad port scan.\",\n        'from': \"notifications@phantom.us\",\n        'headers': \"\",\n        'subject': \"Port Scan detected from bad domain\",\n        'attachments': \"\",\n    })\n\n    phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], callback=set_severity_4, name=\"send_email_bad_domain\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 325,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "run query 2, whois domain, hunt domain",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "send email bad domain",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "f333f499-2563-421c-a1bf-f41217c1c908",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_send_email_bad_domain(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_send_email_bad_domain() called')\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['run_query_2', 'whois_domain_1', 'hunt_domain_1']):\n        \n        # call connected block \"send_email_bad_domain\"\n        send_email_bad_domain(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 271,
                        "line_end": 282,
                        "line_start": 246,
                        "message": "Configuring now",
                        "name": "send email",
                        "notes": "",
                        "number": 3,
                        "order": 15,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1000,
                            "y": 720
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "send_email_bad_domain",
                        "required_params": {
                            "body": true,
                            "to": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3307
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation_1:action_result.summary.detected_urls\", \">\", 0],\n        ],\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        run_query_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        hunt_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        whois_ip_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a0430d22-410d-46e8-a695-d85b73c55708",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 302,
                        "line_start": 282,
                        "name": "filter",
                        "notes": "",
                        "number": 1,
                        "order": 16,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "ip_reputation_1:action_result.summary.detected_urls",
                                        "value": "0"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 620,
                            "y": 320
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 3308
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_4() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation_1:action_result.summary.detected_urls\", \"==\", 0],\n            [\"domain_reputation_2:action_result.data.*.Webutation domain info.Safety score\", \"==\", 100],\n        ],\n        logical_operator='and',\n        name=\"filter_4:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        join_send_email_safe(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation, domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "b9ec3971-bbab-4283-9e30-09e2fc2c1fe9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_filter_4() called')\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['ip_reputation_1', 'domain_reputation_2']):\n        \n        # call connected block \"filter_4\"\n        filter_4(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 322,
                        "line_end": 333,
                        "line_start": 302,
                        "name": "filter",
                        "notes": "",
                        "number": 4,
                        "order": 17,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "ip_reputation_1:action_result.summary.detected_urls",
                                        "value": "0"
                                    },
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "domain_reputation_2:action_result.data.*.Webutation domain info.Safety score",
                                        "value": "100"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 620,
                            "y": 580
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_4",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 3309
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_3() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"domain_reputation_2:action_result.data.*.Webutation domain info.Safety score\", \"!=\", \"\"],\n            [\"domain_reputation_2:action_result.data.*.Webutation domain info.Safety score\", \"<\", 100],\n        ],\n        logical_operator='and',\n        name=\"filter_3:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        run_query_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        whois_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        hunt_domain_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"domain_reputation_2:action_result.data.*.Webutation domain info.Safety score\", \"==\", \"\"],\n        ],\n        name=\"filter_3:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        send_email_unknown(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0a8e9c3d-7624-4489-baa2-850ed42fb5b0",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 368,
                        "line_start": 333,
                        "name": "filter",
                        "notes": "",
                        "number": 3,
                        "order": 18,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "domain_reputation_2:action_result.data.*.Webutation domain info.Safety score",
                                        "value": ""
                                    },
                                    {
                                        "comparison": "<",
                                        "data_type": "",
                                        "param": "domain_reputation_2:action_result.data.*.Webutation domain info.Safety score",
                                        "value": "100"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "domain_reputation_2:action_result.data.*.Webutation domain info.Safety score",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 620,
                            "y": 840
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 3310
                    },
                    {
                        "action": "hunt ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "ip_reputation_1:filtered-action_result.parameter.ip"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "ip_reputation_1:filtered-action_result.parameter.ip"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "isightpartners",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Report Title",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ThreatScape",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.threatscape_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.ThreatScape",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reportLink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.webLink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publishDate",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.matchedOn.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.matchedOn.*.key",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Published Date",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.published_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Report ID",
                                        "column_order": 4,
                                        "contains": [
                                            "isightpartners report id"
                                        ],
                                        "data_path": "action_result.data.*.reportId",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.reports_matched",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "threat intel"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt ip"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_ip_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_ip_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"ip_reputation_1:filtered-action_result.parameter.ip\", \"ip_reputation_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'hunt_ip_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'ip': passed_filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt ip\", parameters=parameters, assets=['isightpartners'], callback=join_send_email_bad_ip, name=\"hunt_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ae9dfa56-47a3-4932-bbdf-c9706f3238f0",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 391,
                        "line_start": 368,
                        "message": "Configuring now",
                        "name": "hunt ip",
                        "notes": "",
                        "number": 1,
                        "order": 19,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 440
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3311
                    },
                    {
                        "action": "whois domain",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "domain": "domain_reputation_2:filtered-action_result.parameter.domain"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "domain": "domain_reputation_2:filtered-action_result.parameter.domain"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domaintools",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 2,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.parameter.domain",
                                        "data_type": "string",
                                        "example_values": [
                                            "SPLUNK.COM"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.name_servers",
                                        "data_type": "string",
                                        "example_values": [
                                            "NS4.SPLUNK.US"
                                        ]
                                    },
                                    {
                                        "column_name": "Admin City",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.city",
                                        "data_type": "string",
                                        "example_values": [
                                            "San Jose"
                                        ]
                                    },
                                    {
                                        "column_name": "Admin Country",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "US"
                                        ]
                                    },
                                    {
                                        "column_name": "Admin Email",
                                        "column_order": 5,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.email",
                                        "data_type": "string",
                                        "example_values": [
                                            "idc@splunk.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.fax",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "column_name": "Admin Name",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Jhon Smith"
                                        ]
                                    },
                                    {
                                        "column_name": "Admin Organization",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.org",
                                        "data_type": "string",
                                        "example_values": [
                                            "Splunk Inc."
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.phone",
                                        "data_type": "string",
                                        "example_values": [
                                            "866-434-1111"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.postal",
                                        "data_type": "string",
                                        "example_values": [
                                            "94086"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "CA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.admin.street",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.city",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.country",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.email",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.fax",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.name",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.org",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.phone",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.postal",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.billing.state",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "column_name": "Registrant City",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.city",
                                        "data_type": "string",
                                        "example_values": [
                                            "San Jose"
                                        ]
                                    },
                                    {
                                        "column_name": "Registrant Country",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "US"
                                        ]
                                    },
                                    {
                                        "column_name": "Registrant Email",
                                        "column_order": 10,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.email",
                                        "data_type": "string",
                                        "example_values": [
                                            "idc@splunk.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.fax",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "column_name": "Registrant Name",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Jhon Smith"
                                        ]
                                    },
                                    {
                                        "column_name": "Registrant Organization",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.org",
                                        "data_type": "string",
                                        "example_values": [
                                            "Splunk Inc"
                                        ]
                                    },
                                    {
                                        "column_name": "Registrant Phone",
                                        "column_order": 13,
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.phone",
                                        "data_type": "string",
                                        "example_values": [
                                            "866-434-9121"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.postal",
                                        "data_type": "string",
                                        "example_values": [
                                            "94088"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "CA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.registrant.street",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.city",
                                        "data_type": "string",
                                        "example_values": [
                                            "San Jose"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "US"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.email",
                                        "data_type": "string",
                                        "example_values": [
                                            "idc@splunk.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.fax",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Jhon smith"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.org",
                                        "data_type": "string",
                                        "example_values": [
                                            "Splunk Inc"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.phone",
                                        "data_type": "string",
                                        "example_values": [
                                            "861-111-1211"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.postal",
                                        "data_type": "string",
                                        "example_values": [
                                            "94088"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.state",
                                        "data_type": "string",
                                        "example_values": [
                                            "CA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.contacts.tech.street",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.created_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2006-06-20T12:49:22+00:00"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.domain",
                                        "data_type": "string",
                                        "example_values": [
                                            "SPLUNK.COM"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.expired_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-06-20T12:49:22+00:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.name_servers",
                                        "data_type": "string",
                                        "example_values": [
                                            "ns4.splunk.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.other_properties.dnssec",
                                        "data_type": "string",
                                        "example_values": [
                                            "unsignedDelegation"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.other_properties.domain_domain_status",
                                        "data_type": "string",
                                        "example_values": [
                                            "ok https://icann.org/epp#ok"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.other_properties.registry_domain_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "491960245_DOMAIN_COM-VRSN"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.registrar.abuse_contact_email",
                                        "data_type": "string",
                                        "example_values": [
                                            "abuse@net4.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.registrar.abuse_contact_phone",
                                        "data_type": "string",
                                        "example_values": [
                                            "911204323500"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.registrar.iana_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "1007"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.registrar.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Net 4 Test Limited"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.registrar.url",
                                        "data_type": "string",
                                        "example_values": [
                                            "http://www.net4.us/"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.parsed_whois.registrar.whois_server",
                                        "data_type": "string",
                                        "example_values": [
                                            "whois.net4domains.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.statuses",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parsed_whois.updated_date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-06-21T08:29:46+00:00"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.record_source",
                                        "data_type": "string",
                                        "example_values": [
                                            "SPLUNK.COM"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registrant",
                                        "data_type": "string",
                                        "example_values": [
                                            "Splunk Inc"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registration.created",
                                        "data_type": "string",
                                        "example_values": [
                                            "2006-06-20"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registration.expires",
                                        "data_type": "string",
                                        "example_values": [
                                            "2019-06-20"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registration.registrar",
                                        "data_type": "string",
                                        "example_values": [
                                            "Net 4 Test Limited"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registration.statuses",
                                        "data_type": "string",
                                        "example_values": [
                                            "ok"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.registration.updated",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-06-21"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.whois.date",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-03"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.whois.record",
                                        "data_type": "string",
                                        "example_values": [
                                            "Domain Name: SPLUNK.COM\nRegistry Domain ID: 491960245_DOMAIN_COM-VRSN\nRegistrar WHOIS Server: whois.net4domains.com\nRegistrar URL: http://www.net4.in/\nUpdated Date: 2018-06-21T08:29:46Z\nCreation Date: 2006-06-20T12:49:22Z\nRegistrar Registration Expiration Date: 2019-06-20T12:49:22Z\nRegistrar: Net 4 India Limited\nRegistrar IANA ID: 1007\nRegistrar Abuse Contact Email: abuse@net4.com\nRegistrar Abuse Contact Phone: +1.9661231111\nDomain Domain Status: ok https://icann.org/epp#ok\nRegistry Registrant ID: \nRegistrant Name: Jhon Smith\nRegistrant Organization: Splunk Inc\nRegistrant Street: ,\nRegistrant City: San Jose\nRegistrant State/Province: CA\nRegistrant Postal Code: 94088\nRegistrant Country: US\nRegistrant Phone: +91.2612789500\nRegistrant Phone Ext:\nRegistrant Fax: \nRegistrant Fax Ext:\nRegistrant Email: idc@splunk.com\nRegistry Admin ID: \nAdmin Name: Jhon Smith\nAdmin Organization: Splunk Inc\nAdmin Street: ,\nAdmin City: San Jose\nAdmin State/Province: CA\nAdmin Postal Code: 94088\nAdmin Country: US\nAdmin Phone: +1.9661231111\nAdmin Phone Ext:\nAdmin Fax: \nAdmin Fax Ext:\nAdmin Email: idc@splunk.com\nRegistry Tech ID: \nTech Name: Jhon Smith\nTech Organization: Splunk Inc\nTech Street: ,\nTech City: San Jose\nTech State/Province: CA\nTech Postal Code: 94088\nTech Country: IN\nTech Phone: +1.9661231111\nTech Phone Ext:\nTech Fax: \nTech Fax Ext:\nTech Email: idc@splunk.com\nName Server: NS1.SPLUNK.COM\nName Server: NS2.SPLUNK.COM\nName Server: NS3.SPLUNK.COM\nName Server: NS4.SPLUNK.COM\nDNSSEC: unsignedDelegation\nURL of the ICANN WHOIS Data Problem Reporting System: http://wdprs.internic.net/\n"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.city",
                                        "data_type": "string",
                                        "example_values": [
                                            "San Jose"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.country",
                                        "data_type": "string",
                                        "example_values": [
                                            "US"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.organization",
                                        "data_type": "string",
                                        "example_values": [
                                            "Splunk Inc"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Organization: Splunk Inc."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "whois domain"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def whois_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('whois_domain_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'whois_domain_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"domain_reputation_2:filtered-action_result.parameter.domain\", \"domain_reputation_2:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'whois_domain_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'domain': passed_filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"whois domain\", parameters=parameters, assets=['domaintools'], callback=join_send_email_bad_domain, name=\"whois_domain_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "3ac8bba5-7b6f-4b09-aad8-540fcc9ea750",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 414,
                        "line_start": 391,
                        "message": "Configuring now",
                        "name": "whois domain",
                        "notes": "",
                        "number": 1,
                        "order": 20,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 840
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "whois_domain_1",
                        "required_params": {
                            "domain": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3312
                    },
                    {
                        "action": "hunt domain",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "domain": "domain_reputation_2:filtered-action_result.parameter.domain"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "domain": "domain_reputation_2:filtered-action_result.parameter.domain"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "isightpartners",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Domain",
                                        "column_order": 0,
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.parameter.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Report Title",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ThreatScape",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.threatscape_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.ThreatScape",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reportLink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.webLink",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.publishDate",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.matchedOn.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.matchedOn.*.key",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Report Id",
                                        "column_order": 4,
                                        "contains": [
                                            "isightpartners report id"
                                        ],
                                        "data_path": "action_result.data.*.reportId",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Published Date",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.published_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.reports_matched",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "threat intel"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt domain"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_domain_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_domain_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_domain_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"domain_reputation_2:filtered-action_result.parameter.domain\", \"domain_reputation_2:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'hunt_domain_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'domain': passed_filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt domain\", parameters=parameters, assets=['isightpartners'], callback=join_send_email_bad_domain, name=\"hunt_domain_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "b36f4b24-4260-4aca-aabc-048b168aaa78",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 437,
                        "line_start": 414,
                        "message": "Configuring now",
                        "name": "hunt domain",
                        "notes": "",
                        "number": 1,
                        "order": 21,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 960
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_domain_1",
                        "required_params": {
                            "domain": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3313
                    },
                    {
                        "action": "send email",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attachments": "",
                            "body": "Check phantom to see output results for bad port scan.",
                            "from": "admin@phantom.us",
                            "subject": "Port Scan detected from bad IP",
                            "to": "michael@phantom.us"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "attachments": "",
                                    "bcc": "",
                                    "body": "Check phantom to see output results for bad port scan.",
                                    "cc": "",
                                    "from": "admin@phantom.us",
                                    "headers": "",
                                    "subject": "Port Scan detected from bad IP",
                                    "to": "michael@phantom.us"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "smtp",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 0,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.attachments",
                                        "data_type": "string",
                                        "example_values": [
                                            "ab2b2ccfba08ea538ef22f521caa01c3c2b17ccf"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.bcc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test1@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.body",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test body"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.cc",
                                        "data_type": "string",
                                        "example_values": [
                                            "test2@testdomain.com"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string",
                                        "example_values": [
                                            "sender@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.headers",
                                        "data_type": "string",
                                        "example_values": [
                                            "{\"Subject\": \"Test1\", \"To\": \"test3@testdomain.com\"}"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string",
                                        "example_values": [
                                            "Test"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.to",
                                        "data_type": "string",
                                        "example_values": [
                                            "receiver@testdomain.com"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Email sent"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "email"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "send email bad ip"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def send_email_bad_ip(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('send_email_bad_ip() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'send_email_bad_ip' call\n\n    parameters = []\n    \n    # build parameters list for 'send_email_bad_ip' call\n    parameters.append({\n        'cc': \"\",\n        'to': \"michael@phantom.us\",\n        'bcc': \"\",\n        'body': \"Check phantom to see output results for bad port scan.\",\n        'from': \"admin@phantom.us\",\n        'headers': \"\",\n        'subject': \"Port Scan detected from bad IP\",\n        'attachments': \"\",\n    })\n\n    phantom.act(action=\"send email\", parameters=parameters, assets=['smtp'], callback=set_severity_1, name=\"send_email_bad_ip\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 365,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "hunt ip, run query 1, whois ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "send email bad ip",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c706012c-8e99-44d9-a1d8-262d8e585884",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_send_email_bad_ip(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('join_send_email_bad_ip() called')\n\n    # check if all connected incoming playbooks, actions, or custom functions are done i.e. have succeeded or failed\n    if phantom.completed(action_names=['hunt_ip_1', 'run_query_1', 'whois_ip_3']):\n        \n        # call connected block \"send_email_bad_ip\"\n        send_email_bad_ip(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 488,
                        "line_end": 499,
                        "line_start": 463,
                        "message": "Configuring now",
                        "name": "send email",
                        "notes": "",
                        "number": 2,
                        "order": 23,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1000,
                            "y": 200
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "send_email_bad_ip",
                        "required_params": {
                            "body": true,
                            "to": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3316
                    },
                    {
                        "action": "domain reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "domain": "reverse_ip_2:action_result.data.*.ip_addresses.domain_names"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "domain": "reverse_ip_2:action_result.data.*.ip_addresses.domain_names"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal_private",
                                "output": [
                                    {
                                        "column_name": "Domain",
                                        "column_order": 0,
                                        "data_path": "action_result.parameter.domain",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Alexa category",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.Alexa category",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Alexa domain info",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.Alexa domain info",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Alexa rank",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.Alexa rank",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Webutation Info Verdict",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.Webutation domain info.Verdict",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Bitdefender category",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.BitDefender category",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Opera domain info",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.Opera domain info",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Trendmicro category",
                                        "column_order": 7,
                                        "data_path": "action_result.data.*.TrendMicro category",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Child safety",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.WOT domain info.Child safety",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Privacy",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.WOT domain info.Privacy",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Trustworthiness",
                                        "column_order": 10,
                                        "data_path": "action_result.data.*.WOT domain info.Trustworthiness",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Vendor reliability",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.WOT domain info.Vendor reliability",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Websense threatseeker category",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.Websense ThreatSeeker category",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Adult content",
                                        "column_order": 13,
                                        "data_path": "action_result.data.*.Webutation domain info.Adult content",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Safety score",
                                        "column_order": 14,
                                        "data_path": "action_result.data.*.Webutation domain info.Safety score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Bitdefender domain info",
                                        "column_order": 15,
                                        "data_path": "action_result.data.*.BitDefender domain info",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Dr. Web category",
                                        "column_order": 16,
                                        "data_path": "action_result.data.*.Dr&2e;Web category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.downloaded_samples",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.detected_urls",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.alexa_rank",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.communicating_samples",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "reputation"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "domain reputation"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "def domain_reputation_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('domain_reputation_2_callback() called')\n    \n    filter_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    join_filter_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_start": 527,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "reverse ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def domain_reputation_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'domain_reputation_2' call\n    results_data_1 = phantom.collect2(container=container, datapath=['reverse_ip_2:action_result.data.*.ip_addresses.domain_names', 'reverse_ip_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'domain_reputation_2' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            for domain in results_item_1[0]:\n                if (not domain):\n                    continue\n                parameters.append({\n                    'domain': domain,\n                    # context (artifact id) is added to associate results with the artifact\n                    'context': {'artifact_id': results_item_1[1]},\n                })\n\n    if parameters:\n        phantom.act(\"domain reputation\", parameters=parameters, assets=['virustotal'], callback=domain_reputation_2_callback, name=\"domain_reputation_2\", parent_action=action)    \n    else:\n        phantom.error(\"'domain_reputation_2' will not be executed due to lack of parameters\")\n    \n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "9c155d1e-38e1-446c-89e8-68fa25ae0c3d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 535,
                        "line_start": 499,
                        "message": "Configuring now",
                        "name": "domain reputation",
                        "notes": "",
                        "number": 2,
                        "order": 24,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 380,
                            "y": 700
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "domain_reputation_2",
                        "required_params": {
                            "domain": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3317
                    },
                    {
                        "action": "run query",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "command": "search",
                            "display": "",
                            "parse_only": "",
                            "query": "ip_reputation_1:filtered-action_result.parameter.ip"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "run query",
                                "actions": [
                                    "post data",
                                    "update event",
                                    "run query",
                                    "on poll",
                                    "get host events",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Splunk",
                                "app_version": "2.0.22",
                                "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
                                "asset_name": "splunk",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "command": "search",
                                    "display": "",
                                    "parse_only": "",
                                    "query": "ip_reputation_1:filtered-action_result.parameter.ip"
                                },
                                "has_app": true,
                                "id": 234,
                                "loaded": false,
                                "missing": false,
                                "name": "splunk",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.command",
                                        "data_type": "string",
                                        "example_values": [
                                            "savedsearch"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.parse_only",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "splunk query"
                                        ],
                                        "data_path": "action_result.parameter.query",
                                        "data_type": "string",
                                        "example_values": [
                                            "\"Send to Phantom\""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*._bkt",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._cd",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._indextime",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Raw",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*._raw",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._serial",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._si",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._sourcetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Time",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*._time",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Host",
                                        "column_order": 0,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.host",
                                        "data_type": "string",
                                        "example_values": [
                                            "10.1.67.187:8088"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.index",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.linecount",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.source",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sourcetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.splunk_server",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_events",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Total events: 2"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "command": {
                                        "data_type": "string",
                                        "default": "search",
                                        "description": "Beginning command (in Splunk Processing Language)",
                                        "key": "command",
                                        "order": 0,
                                        "required": false,
                                        "value_list": [
                                            "search",
                                            "eval",
                                            "savedsearch",
                                            "stats",
                                            "table",
                                            "tstats"
                                        ]
                                    },
                                    "display": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Display fields (comma-separated)",
                                        "key": "display",
                                        "order": 2,
                                        "required": false
                                    },
                                    "parse_only": {
                                        "data_type": "boolean",
                                        "default": false,
                                        "description": "Parse only",
                                        "key": "parse_only",
                                        "order": 3,
                                        "required": false
                                    },
                                    "query": {
                                        "contains": [
                                            "splunk query"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Query to run (in Splunk Processing Language)",
                                        "key": "query",
                                        "order": 1,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Splunk Enterprise",
                                "product_vendor": "Splunk Inc.",
                                "targets": "234",
                                "type": "siem"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "run query 1"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def run_query_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('run_query_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'run_query_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"ip_reputation_1:filtered-action_result.parameter.ip\", \"ip_reputation_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'run_query_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'command': \"search\",\n                'query': passed_filtered_results_item_1[0],\n                'display': \"\",\n                'parse_only': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_send_email_bad_ip, name=\"run_query_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "ip reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "15a77eb1-d782-4037-b878-303d1a9176e4",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 463,
                        "line_start": 437,
                        "message": "Configuring now",
                        "name": "run query",
                        "notes": "",
                        "number": 1,
                        "order": 22,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 200
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "run_query_1",
                        "required_params": {
                            "query": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3318
                    },
                    {
                        "action": "run query",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "command": "search",
                            "display": "",
                            "parse_only": "",
                            "query": "domain_reputation_2:filtered-action_result.parameter.domain"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "run query",
                                "actions": [
                                    "post data",
                                    "update event",
                                    "run query",
                                    "on poll",
                                    "get host events",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "Splunk",
                                "app_version": "2.0.22",
                                "appid": "91883aa8-9c81-470b-97a1-5d8f7995f560",
                                "asset_name": "splunk",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "command": "search",
                                    "display": "",
                                    "parse_only": "",
                                    "query": "domain_reputation_2:filtered-action_result.parameter.domain"
                                },
                                "has_app": true,
                                "id": 234,
                                "loaded": false,
                                "missing": false,
                                "name": "splunk",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.command",
                                        "data_type": "string",
                                        "example_values": [
                                            "savedsearch"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.parse_only",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "splunk query"
                                        ],
                                        "data_path": "action_result.parameter.query",
                                        "data_type": "string",
                                        "example_values": [
                                            "\"Send to Phantom\""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*._bkt",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._cd",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._indextime",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Raw",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*._raw",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._serial",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._si",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*._sourcetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Time",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*._time",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Host",
                                        "column_order": 0,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.host",
                                        "data_type": "string",
                                        "example_values": [
                                            "10.1.67.187:8088"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.index",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.linecount",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.source",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sourcetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.splunk_server",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_events",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Total events: 2"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "command": {
                                        "data_type": "string",
                                        "default": "search",
                                        "description": "Beginning command (in Splunk Processing Language)",
                                        "key": "command",
                                        "order": 0,
                                        "required": false,
                                        "value_list": [
                                            "search",
                                            "eval",
                                            "savedsearch",
                                            "stats",
                                            "table",
                                            "tstats"
                                        ]
                                    },
                                    "display": {
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Display fields (comma-separated)",
                                        "key": "display",
                                        "order": 2,
                                        "required": false
                                    },
                                    "parse_only": {
                                        "data_type": "boolean",
                                        "default": false,
                                        "description": "Parse only",
                                        "key": "parse_only",
                                        "order": 3,
                                        "required": false
                                    },
                                    "query": {
                                        "contains": [
                                            "splunk query"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "Query to run (in Splunk Processing Language)",
                                        "key": "query",
                                        "order": 1,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "Splunk Enterprise",
                                "product_vendor": "Splunk Inc.",
                                "targets": "234",
                                "type": "siem"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "run query 2"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def run_query_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('run_query_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'run_query_2' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"domain_reputation_2:filtered-action_result.parameter.domain\", \"domain_reputation_2:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'run_query_2' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        parameters.append({\n            'command': \"search\",\n            'query': passed_filtered_results_item_1[0],\n            'display': \"\",\n            'parse_only': \"\",\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': passed_filtered_results_item_1[1]},\n        })\n\n    phantom.act(action=\"run query\", parameters=parameters, assets=['splunk'], callback=join_send_email_bad_domain, name=\"run_query_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "domain reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bda24ef4-87ad-4370-914e-255feadaf697",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 99,
                        "line_start": 74,
                        "message": "Configuring now",
                        "name": "run query",
                        "notes": "",
                        "number": 2,
                        "order": 4,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 760,
                            "y": 720
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "run_query_2",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 3319
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n\n    # collect filtered artifact ids for 'if' condition 1\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.sourceAddress', 'artifact:*.id'], scope='all')\n    for container_item in container_data:\n        if ipfilter(container_item[0]):\n            ip_reputation_1(container=container)\n            reverse_ip_2(container=container)\n        else:\n            join_send_email_safe(container=container)\n\n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bbbae210-6e66-442b-add9-898540966f64",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 246,
                        "line_start": 233,
                        "name": "filter",
                        "notes": "",
                        "number": 2,
                        "order": 14,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "in",
                                        "data_type": "",
                                        "param": "artifact:*.cef.sourceAddress",
                                        "value": "internal range"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "not in",
                                        "data_type": "",
                                        "param": "artifact:*.cef.sourceAddress",
                                        "value": "internal range"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 0,
                            "y": 500
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 3320
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "ref-y": 8,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'filter_2' block\n    filter_2(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": false,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "caca1d96-9678-48af-aa06-367f44a01e70",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 30,
                        "line_start": 22,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": -140,
                            "y": 520
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 3321
                    }
                ]
            },
            "notes": ""
        },
        "python_version": "3",
        "schema": 4,
        "version": "4.10.0.40961"
    },
    "create_time": "2021-01-21T18:25:00.062235+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ],
    "tags": [],
    "misc": {
        "apps_list": [
            "Splunk",
            "iSight Partners",
            "DomainTools",
            "VirusTotal",
            "SMTP"
        ]
    }
}