ransomware_investigate_and_contain.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Use Cases",
    "coa": {
        "data": {
            "clean": true,
            "code_block": "\"\"\"Ransomware detected on endpoint\"\"\"",
            "description": "This playbook investigates and contains ransomware detected on endpoints.",
            "hash": "bb5c36ed1c9fc4ba347b91fc72062d5a8cad3656",
            "joint": {
                "cells": [
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "70271ae5-8109-4232-9d95-1255e3b79a41",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "76d35893-188b-4704-afcc-3579372422ae",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "cd53b29e-78cd-408d-8c58-6480077729a9",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 9
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "7b710f64-b2aa-4c8e-8d27-653a72eeb169",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "cd53b29e-78cd-408d-8c58-6480077729a9",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "7e9c56b6-7673-41ae-bb5c-97d0f5baa7a8",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 19
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "5dfd5413-40e0-4d8d-a089-4c72d489079e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0dc58914-d90c-4880-b7dd-f1bd9cb3db4a",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1080,
                                "y": 360
                            }
                        ],
                        "z": 160
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ee19c211-b021-44c6-ba1d-1d0654a5e1bd",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "3e31ada0-f327-4dbb-8c60-772db5c2a2c7",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1080,
                                "y": 360
                            }
                        ],
                        "z": 189
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f5a65f9b-e288-49f2-aa40-2381776611d8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "cb84850e-e005-4824-b8ad-151543871132",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1080,
                                "y": 400
                            }
                        ],
                        "z": 203
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f64d8c85-ea52-4e02-a7f2-797f75a93426",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "789a9802-b9ec-407d-9d47-2d6070d77237",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 249
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e553b76c-2472-4d11-98db-bc1f664665ec",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "789a9802-b9ec-407d-9d47-2d6070d77237",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c9908964-abaa-48e2-a066-02c55e38c29a",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 261
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "2191982d-1721-46bd-9ba5-529e2a3eefe0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c9908964-abaa-48e2-a066-02c55e38c29a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1580,
                                "y": 360
                            }
                        ],
                        "z": 308
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ef761a65-044c-40f0-b596-004370ea0d35",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "7e9c56b6-7673-41ae-bb5c-97d0f5baa7a8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 409
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d9b269e5-2275-4f19-82dc-38b335505fbe",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a06d3fab-dc42-4945-b319-d83bfdf9aa47",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 462
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "03857e15-ab4f-4f44-88ec-609d4e99f7ae",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 567
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c03b9b7a-1d84-4f63-8c6e-91a2b7b265ca",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bc513210-e299-4e69-b151-cdd26e9696b4",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 579
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f82ffb8c-bdaa-47e8-90cb-3423223a00c8",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "987c49d7-5934-4f18-ae1d-a5e2867eaf2c",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 652
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "452d5da9-7512-4503-afa4-ec08cbc97f32",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0dc58914-d90c-4880-b7dd-f1bd9cb3db4a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 927
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "77f09987-6349-4f40-aa94-51da05301b95",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "3e31ada0-f327-4dbb-8c60-772db5c2a2c7",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1340,
                                "y": 240
                            }
                        ],
                        "z": 933
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9883e649-39db-4eb4-a1c9-d159c7f54500",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "cb84850e-e005-4824-b8ad-151543871132",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [
                            {
                                "x": 1340,
                                "y": 520
                            },
                            {
                                "x": 1580,
                                "y": 400
                            }
                        ],
                        "z": 942
                    },
                    {
                        "action": "quarantine device",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "Name/IP",
                                        "column_order": 0,
                                        "contains": [
                                            "host name",
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "cb-lab"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Quarantine action succeeded. It might take some time for endpoint to get isolated."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "quarantine device"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def quarantine_device_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('quarantine_device_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'quarantine_device_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'quarantine_device_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'ip_hostname': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"quarantine device\", parameters=parameters, assets=['carbonblack'], name=\"quarantine_device_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "3e31ada0-f327-4dbb-8c60-772db5c2a2c7",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 47,
                        "line_start": 24,
                        "message": "Configuring now",
                        "name": "quarantine device",
                        "notes": "",
                        "number": 1,
                        "order": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1120,
                            "y": 200
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "quarantine_device_1",
                        "required_params": {
                            "ip_hostname": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1182
                    },
                    {
                        "action": "disable user",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "username": "hunt_file_1:action_result.data.*.process.results.*.username"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "username": "hunt_file_1:action_result.data.*.process.results.*.username"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domainctrl1",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "column_name": "Username",
                                        "column_order": 0,
                                        "contains": [
                                            "user name",
                                            "ldap distinguished name"
                                        ],
                                        "data_path": "action_result.parameter.username",
                                        "data_type": "string",
                                        "example_values": [
                                            "test_user3"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "User state changed"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "directory service"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "disable user"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('disable_user_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'disable_user_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.username', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'disable_user_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'username': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"disable user\", parameters=parameters, assets=['domainctrl1'], name=\"disable_user_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "cb84850e-e005-4824-b8ad-151543871132",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 70,
                        "line_start": 47,
                        "message": "Configuring now",
                        "name": "disable user",
                        "notes": "",
                        "number": 1,
                        "order": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1120,
                            "y": 480
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "disable_user_1",
                        "required_params": {
                            "username": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1184
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "ref-y": 8,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'get_file_1' block\n    get_file_1(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "76d35893-188b-4704-afcc-3579372422ae",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 24,
                        "line_start": 16,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 100,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 1220
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all details of actions\n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "block ip 2, terminate process, quarantine device, disable user",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "55a5fe39-620a-46ef-a2f8-9f752f3d5c71",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 331,
                        "line_start": 318,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 14,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1620,
                            "y": 80
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 1226
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"detonate_file_1:action_result.summary.malware\", \"==\", \"ransomware\"],\n        ],\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        block_ip_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        block_hash_4(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        block_hash_3(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": false,
                        "connection_name": "detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "623fbaad-6f02-4a42-b7d7-01f4ab2f71a5",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 91,
                        "line_start": 70,
                        "name": "filter",
                        "notes": "",
                        "number": 1,
                        "order": 4,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "detonate_file_1:action_result.summary.malware",
                                        "value": "ransomware"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 720,
                            "y": 60
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 1238
                    },
                    {
                        "action": "block ip",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "list_connections_1:action_result.data.*.ip_addr",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "list_connections_1:action_result.data.*.ip_addr",
                                    "is_source_address": "",
                                    "vsys": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "pan",
                                "output": [
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vsys",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.is_source_address",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 2,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "firewall"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block ip 2"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_ip_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('block_ip_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_ip_2' call\n    results_data_1 = phantom.collect2(container=container, datapath=['list_connections_1:action_result.data.*.ip_addr', 'list_connections_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'block_ip_2' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'ip': results_item_1[0],\n                'vsys': \"\",\n                'is_source_address': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], name=\"block_ip_2\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "list connections",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c9908964-abaa-48e2-a066-02c55e38c29a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 116,
                        "line_start": 91,
                        "message": "Configuring now",
                        "name": "block ip",
                        "notes": "",
                        "number": 2,
                        "order": 5,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1360,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_ip_2",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1250
                    },
                    {
                        "action": "list connections",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "carbonblack_process_id": "hunt_file_1:action_result.data.*.process.results.*.id",
                            "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname",
                            "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid",
                            "process_name": "hunt_file_1:action_result.data.*.process.results.*.process_name"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "carbonblack_process_id": "hunt_file_1:action_result.data.*.process.results.*.id",
                                    "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname",
                                    "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid",
                                    "process_name": "hunt_file_1:action_result.data.*.process.results.*.process_name"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "carbon black process id"
                                        ],
                                        "data_path": "action_result.parameter.carbonblack_process_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "0000001b-0000-0g44-01d4-6c744b8174f6"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "UHM"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.parameter.pid",
                                        "data_type": "numeric",
                                        "example_values": [
                                            948
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.parameter.process_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "taskhostw.exe"
                                        ]
                                    },
                                    {
                                        "column_name": "Carbon Black Process ID",
                                        "column_order": 3,
                                        "contains": [
                                            "carbon black process id"
                                        ],
                                        "data_path": "action_result.data.*.carbonblack_process_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "00000013-0000-03b4-01d2-ca4499a674e9"
                                        ]
                                    },
                                    {
                                        "column_name": "Direction",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.direction",
                                        "data_type": "string",
                                        "example_values": [
                                            "outbound"
                                        ]
                                    },
                                    {
                                        "column_name": "Domain",
                                        "column_order": 7,
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.domain",
                                        "data_type": "string",
                                        "example_values": [
                                            "fe2.update.microsoft.com"
                                        ]
                                    },
                                    {
                                        "column_name": "Event Time",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.event_time",
                                        "data_type": "string",
                                        "example_values": [
                                            "2017-06-13 01:05:22.209"
                                        ]
                                    },
                                    {
                                        "column_name": "Hostname",
                                        "column_order": 0,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "dc1"
                                        ]
                                    },
                                    {
                                        "column_name": "Ip",
                                        "column_order": 4,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.ip_addr",
                                        "data_type": "string",
                                        "example_values": [
                                            "134.170.53.30"
                                        ]
                                    },
                                    {
                                        "column_name": "PID",
                                        "column_order": 2,
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.pid",
                                        "data_type": "numeric",
                                        "example_values": [
                                            948
                                        ]
                                    },
                                    {
                                        "column_name": "Port",
                                        "column_order": 5,
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.port",
                                        "data_type": "string",
                                        "example_values": [
                                            "443"
                                        ]
                                    },
                                    {
                                        "column_name": "Process Name",
                                        "column_order": 1,
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.process_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "svchost.exe"
                                        ]
                                    },
                                    {
                                        "column_name": "Protocol",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.protocol",
                                        "data_type": "string",
                                        "example_values": [
                                            "TCP"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.total_connections",
                                        "data_type": "numeric",
                                        "example_values": [
                                            16
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.total_processes",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2186
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Successfully retrieved connections for process"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            3
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "list connections"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def list_connections_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('list_connections_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'list_connections_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.process_pid', 'hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.data.*.process.results.*.process_name', 'hunt_file_1:action_result.data.*.process.results.*.id', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'list_connections_1' call\n    for results_item_1 in results_data_1:\n        parameters.append({\n            'pid': results_item_1[0],\n            'ip_hostname': results_item_1[1],\n            'process_name': results_item_1[2],\n            'carbonblack_process_id': results_item_1[3],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': results_item_1[4]},\n        })\n\n    phantom.act(action=\"list connections\", parameters=parameters, assets=['carbonblack'], callback=block_ip_2, name=\"list_connections_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": false,
                        "connection_name": "hunt file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "789a9802-b9ec-407d-9d47-2d6070d77237",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 141,
                        "line_start": 116,
                        "message": "Configuring now",
                        "name": "list connections",
                        "notes": "",
                        "number": 1,
                        "order": 6,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1120,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "list_connections_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1251
                    },
                    {
                        "action": "hunt file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
                            "range": "",
                            "scope": "",
                            "type": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5",
                                    "range": "",
                                    "type": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "4fb491ac8d46aaf22ba8bc5c73dabef7",
                                            "13ded573464ba7f43fe640479b309e09",
                                            "9bf50324444c46997c2492d505b47f2d",
                                            "5FB30FE90736C7FC77DE637021B1CE7C"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.range",
                                        "data_type": "string",
                                        "example_values": [
                                            "0-10",
                                            "0-2",
                                            "5-8"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "carbon black query type"
                                        ],
                                        "data_path": "action_result.parameter.type",
                                        "data_type": "string",
                                        "example_values": [
                                            "process",
                                            "binary"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.elapsed",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0.1120398044586182,
                                            0.04952096939086914,
                                            0.1234798431396484,
                                            0.05507302284240723,
                                            0.05384993553161621
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Corporation"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Corporation"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_publisher_facet.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Signed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-01T00:00:00Z",
                                            "2015-01-01T00:00:00Z",
                                            "2013-11-01T00:00:00Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1,
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "16.0.10827.20181",
                                            "4.7.0205.0",
                                            "6.1.7600.16385 (win7_rtm.090713-1255)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "default group"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.name",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1,
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "CB-TEST-02",
                                            "WIN7-CLIENT1",
                                            "ACCOUNTING-PC"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0",
                                            "16.7"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file path",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
                                            "c:\\program files\\microsoft security client\\nissrv.exe",
                                            "C:\\Windows\\system32\\ping.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0",
                                            "50.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Office",
                                            "Microsoft Malware Protection"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-19T00:00:00Z",
                                            "2018-09-29T00:00:00Z",
                                            "2018-10-02T00:00:00Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1,
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.binary.highlights.*.ids",
                                        "data_type": "string",
                                        "example_values": [
                                            "13DED573464BA7F43FE640479B309E09",
                                            "9BF50324444C46997C2492D505B47F2D",
                                            "5FB30FE90736C7FC77DE637021B1CE7C"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "PREPREPRE13DED573464BA7F43FE640479B309E09POSTPOSTPOST",
                                            "PREPREPRE9BF50324444C46997C2492D505B47F2DPOSTPOSTPOST",
                                            "PREPREPRE5FB30FE90736C7FC77DE637021B1CE7CPOSTPOSTPOST"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.alliance_data_srstrust",
                                        "data_type": "string",
                                        "example_values": [
                                            "5fb30fe90736c7fc77de637021b1ce7c"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.alliance_link_srstrust",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=5fb30fe90736c7fc77de637021b1ce7c"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.alliance_score_srstrust",
                                        "data_type": "numeric",
                                        "example_values": [
                                            -100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.alliance_updated_srstrust",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-02-07T02:37:28Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.cb_version",
                                        "data_type": "numeric",
                                        "example_values": [
                                            610,
                                            510,
                                            511
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.company_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Corporation"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9683736,
                                            366512,
                                            16896
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_issuer",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Code Signing PCA"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_prog_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Office",
                                            "Microsoft Corp."
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_publisher",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Corporation"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result",
                                        "data_type": "string",
                                        "example_values": [
                                            "Signed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_sign_time",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-14T20:23:00Z",
                                            "2015-01-30T19:14:00Z",
                                            "2009-07-14T10:17:00Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_subject",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Corporation"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.endpoint",
                                        "data_type": "string",
                                        "example_values": [
                                            "CB-TEST-02|27",
                                            "WIN7-CLIENT1|15",
                                            "DC1|19"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.event_partition_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100972684312576,
                                            100955696070656
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.facet_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            883737,
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_desc",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Office Click-to-Run (SxS)",
                                            "Microsoft Network Realtime Inspection Service",
                                            "TCP/IP Ping Command"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_version",
                                        "data_type": "string",
                                        "example_values": [
                                            "16.0.10827.20181",
                                            "4.7.0205.0",
                                            "6.1.7600.16385 (win7_rtm.090713-1255)"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.group",
                                        "data_type": "string",
                                        "example_values": [
                                            "Default Group"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.host_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1,
                                            6
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.internal_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "OfficeClickToRun.exe",
                                            "NisSrv.exe",
                                            "ping.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_64bit",
                                        "data_type": "boolean",
                                        "example_values": [
                                            false,
                                            true
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_executable_image",
                                        "data_type": "boolean",
                                        "example_values": [
                                            false,
                                            true
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.last_seen",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-28T10:06:02.456Z",
                                            "2018-10-28T10:06:42.455Z",
                                            "2018-10-26T00:01:41.224Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.legal_copyright",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Corporation.  All rights reserved."
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.md5",
                                        "data_type": "string",
                                        "example_values": [
                                            "13DED573464BA7F43FE640479B309E09",
                                            "9BF50324444C46997C2492D505B47F2D",
                                            "5FB30FE90736C7FC77DE637021B1CE7C"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file path",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.observed_filename",
                                        "data_type": "string",
                                        "example_values": [
                                            "c:\\program files\\common files\\microsoft shared\\clicktorun\\updates\\16.0.10827.20181\\officeclicktorun.exe",
                                            "c:\\program files\\microsoft security client\\nissrv.exe",
                                            "c:\\windows\\system32\\ping.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9683736,
                                            366512,
                                            16896
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.original_filename",
                                        "data_type": "string",
                                        "example_values": [
                                            "OfficeClickToRun.exe",
                                            "NisSrv.exe",
                                            "ping.exe.mui"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.os_type",
                                        "data_type": "string",
                                        "example_values": [
                                            "Windows"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "Microsoft Office",
                                            "Microsoft Malware Protection"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_version",
                                        "data_type": "string",
                                        "example_values": [
                                            "16.0.10827.20181",
                                            "4.7.0205.0",
                                            "6.1.7600.16385"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-19T17:04:47.906Z",
                                            "2015-07-01T02:12:21.783Z",
                                            "2015-05-15T07:23:54.846Z"
                                        ]
                                    },
                                    {
                                        "column_name": "Signed",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.binary.results.*.signed",
                                        "data_type": "string",
                                        "example_values": [
                                            "Signed"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.timestamp",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-10-19T17:04:47.906Z",
                                            "2015-07-01T02:12:21.783Z",
                                            "2015-05-15T07:23:54.846Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
                                        "data_type": "string",
                                        "example_values": [
                                            "2015-07-01T02:20:02.062Z",
                                            "2015-05-15T07:30:02.843Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
                                        "data_type": "string",
                                        "example_values": [
                                            "5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.start",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0,
                                            5
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.terms",
                                        "data_type": "string",
                                        "example_values": [
                                            "md5:13ded573464ba7f43fe640479b309e09",
                                            "md5:9bf50324444c46997c2492d505b47f2d",
                                            "md5:5FB30FE90736C7FC77DE637021B1CE7C"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.total_results",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.all_segments",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.comprehensive_search",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.elapsed",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0.2200779914855957
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1566
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "default group"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            10128
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "domain_controller"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "100.0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            10123
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "dc2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "51.2"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            5185
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "0"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            411
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "svchost.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "98.5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9971
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file path",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process.facets.path_full.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "98.5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9971
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "4fb491ac8d46aaf22ba8bc5c73dabef7"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "98.5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9971
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process.facets.process_name.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "wmiprvse.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "98.5"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9971
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-02-24T00:00:00Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            324
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "LOCAL SERVICE"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.percent",
                                        "data_type": "numeric",
                                        "example_values": [
                                            100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
                                        "data_type": "string",
                                        "example_values": [
                                            "98.4"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.value",
                                        "data_type": "numeric",
                                        "example_values": [
                                            9966
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.incomplete_results",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.alliance_data_srstrust",
                                        "data_type": "string",
                                        "example_values": [
                                            "4fb491ac8d46aaf22ba8bc5c73dabef7"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.alliance_link_srstrust",
                                        "data_type": "string",
                                        "example_values": [
                                            "https://services.bit9.com/Services/extinfo.aspx?ak=b8b4e631d4884ad1c56f50e4a5ee9279&sg=0313e1735f6cec221b1d686bd4de23ee&md5=4fb491ac8d46aaf22ba8bc5c73dabef7"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.alliance_score_srstrust",
                                        "data_type": "numeric",
                                        "example_values": [
                                            -100
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.alliance_updated_srstrust",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-02-07T02:37:28Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.childproc_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file path"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.cmdline",
                                        "data_type": "string",
                                        "example_values": [
                                            "C:\\Windows\\sysWOW64\\wbem\\wmiprvse.exe -Embedding"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.comms_ip",
                                        "data_type": "numeric",
                                        "example_values": [
                                            168886572
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.crossproc_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.emet_config",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.emet_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.filemod_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.filtering_known_dlls",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.group",
                                        "data_type": "string",
                                        "example_values": [
                                            "default group"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.host_type",
                                        "data_type": "string",
                                        "example_values": [
                                            "workstation"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "win7-client1"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "carbon black process id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.id",
                                        "data_type": "string",
                                        "example_values": [
                                            "0000000f-0000-0688-01d3-27738c9b4243"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.interface_ip",
                                        "data_type": "numeric",
                                        "example_values": [
                                            168886572
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.last_server_update",
                                        "data_type": "string",
                                        "example_values": [
                                            "2018-03-22T09:21:32.332Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.last_update",
                                        "data_type": "string",
                                        "example_values": [
                                            "2017-09-07T00:52:15.82Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.modload_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            43
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.netconn_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.os_type",
                                        "data_type": "string",
                                        "example_values": [
                                            "windows"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "0000000f-0000-0258-01d1-ec51b545a19b"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_md5",
                                        "data_type": "string",
                                        "example_values": [
                                            "000000000000000000000000000000"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.parent_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "svchost.exe"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_pid",
                                        "data_type": "numeric",
                                        "example_values": [
                                            600
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_unique_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "0000000f-0000-0258-01d1-ec51b545a19b-000000000001"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "file path",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.path",
                                        "data_type": "string",
                                        "example_values": [
                                            "c:\\windows\\syswow64\\wbem\\wmiprvse.exe"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_md5",
                                        "data_type": "string",
                                        "example_values": [
                                            "4fb491ac8d46aaf22ba8bc5c73dabef7"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "process name",
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_name",
                                        "data_type": "string",
                                        "example_values": [
                                            "wmiprvse.exe"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_pid",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1672
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.processblock_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.regmod_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.segment_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.sensor_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            15
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.start",
                                        "data_type": "string",
                                        "example_values": [
                                            "2017-09-07T00:52:15.758Z"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.terminated",
                                        "data_type": "boolean",
                                        "example_values": [
                                            true,
                                            false
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.unique_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "0000000f-0000-0688-01d3-27738c9b4243-000000000001"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.username",
                                        "data_type": "string",
                                        "example_values": [
                                            "SYSTEM"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.start",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.terms",
                                        "data_type": "string",
                                        "example_values": [
                                            "md5:4fb491ac8d46aaf22ba8bc5c73dabef7"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.total_results",
                                        "data_type": "numeric",
                                        "example_values": [
                                            32404
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.device_count",
                                        "data_type": "numeric",
                                        "example_values": [
                                            32404,
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Displaying 10 'process' results of total 32404",
                                            "Displaying 1 'binary' results of total 1",
                                            "Displaying 0 'binary' results of total 1"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt file"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('hunt_file_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_file_1' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_1:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_1' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'hash': filtered_results_item_1[0],\n                'type': \"\",\n                'range': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_1_callback, name=\"hunt_file_1\")\n\n    return",
                        "callback_code": "def hunt_file_1_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None):\n    phantom.debug('hunt_file_1_callback() called')\n    \n    terminate_process_2(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    quarantine_device_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    disable_user_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n    list_connections_1(action=action, success=success, container=container, results=results, handle=handle, custom_function=custom_function)\n\n    return",
                        "callback_start": 166,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "423d03c9-011f-411a-ad6e-4fe0f78675ef",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 176,
                        "line_start": 141,
                        "message": "Configuring now",
                        "name": "hunt file",
                        "notes": "",
                        "number": 1,
                        "order": 7,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 860,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_file_1",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1258
                    },
                    {
                        "action": "block hash",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "comment": "",
                            "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "comment": "",
                                    "hash": "filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.comment",
                                        "data_type": "string",
                                        "example_values": [
                                            "Sample comment"
                                        ]
                                    },
                                    {
                                        "column_name": "Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "180469AE0B239E31DB4C65F02FD70BC1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Block hash action succeeded. It might take some time for blacklisting to take effect."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block hash 4"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_hash_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('block_hash_4() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_hash_4' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:detonate_file_1:action_result.data.*.file_info.md5\", \"filtered-data:filter_1:condition_1:detonate_file_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'block_hash_4' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'hash': filtered_results_item_1[0],\n                'comment': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], name=\"block_hash_4\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bc513210-e299-4e69-b151-cdd26e9696b4",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 200,
                        "line_start": 176,
                        "message": "Configuring now",
                        "name": "block hash",
                        "notes": "",
                        "number": 4,
                        "order": 8,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 860,
                            "y": 480
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_hash_4",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1260
                    },
                    {
                        "action": "terminate process",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname",
                            "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid",
                            "sensor_id": "hunt_file_1:action_result.data.*.process.results.*.sensor_id"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip_hostname": "hunt_file_1:action_result.data.*.process.results.*.hostname",
                                    "pid": "hunt_file_1:action_result.data.*.process.results.*.process_pid",
                                    "sensor_id": "hunt_file_1:action_result.data.*.process.results.*.sensor_id"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "column_name": "HostName/IP",
                                        "column_order": 1,
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string",
                                        "example_values": [
                                            "cb-lab"
                                        ]
                                    },
                                    {
                                        "column_name": "PID",
                                        "column_order": 2,
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.parameter.pid",
                                        "data_type": "numeric",
                                        "example_values": [
                                            7540,
                                            968
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.parameter.sensor_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            15
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.completion",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1522081992.466807,
                                            1530214295.224632
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.create_time",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1522081992.447609,
                                            1530214295.197862
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2,
                                            4
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "kill"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.object",
                                        "data_type": "numeric",
                                        "example_values": [
                                            7540,
                                            968
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.result_code",
                                        "data_type": "numeric",
                                        "example_values": [
                                            0
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.result_desc",
                                        "data_type": "string",
                                        "example_values": [
                                            ""
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.result_type",
                                        "data_type": "string",
                                        "example_values": [
                                            "WinHresult"
                                        ]
                                    },
                                    {
                                        "column_name": "sensor id",
                                        "column_order": 0,
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.data.*.sensor_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            27,
                                            15
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data.*.session_id",
                                        "data_type": "numeric",
                                        "example_values": [
                                            71,
                                            37
                                        ]
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "complete"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.username",
                                        "data_type": "string",
                                        "example_values": [
                                            "admin"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "complete"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "",
                                            "Status: complete"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "terminate process"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def terminate_process_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('terminate_process_2() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'terminate_process_2' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:action_result.data.*.process.results.*.process_pid', 'hunt_file_1:action_result.data.*.process.results.*.sensor_id', 'hunt_file_1:action_result.data.*.process.results.*.hostname', 'hunt_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'terminate_process_2' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'pid': results_item_1[0],\n                'sensor_id': results_item_1[1],\n                'ip_hostname': results_item_1[2],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[3]},\n            })\n\n    phantom.act(action=\"terminate process\", parameters=parameters, assets=['carbonblack'], name=\"terminate_process_2\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0dc58914-d90c-4880-b7dd-f1bd9cb3db4a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 225,
                        "line_start": 200,
                        "message": "Configuring now",
                        "name": "terminate process",
                        "notes": "",
                        "number": 2,
                        "order": 9,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1120,
                            "y": 60
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "terminate_process_2",
                        "required_params": {
                            "pid": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1268
                    },
                    {
                        "action": "block ip",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip",
                                    "is_source_address": "",
                                    "vsys": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "pan",
                                "output": [
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vsys",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.is_source_address",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 2,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "firewall"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block ip 1"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('block_ip_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_ip_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"detonate_file_1:filtered-action_result.data.*.task_info.report.*.network.tcp.*.@ip\", \"detonate_file_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'block_ip_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'ip': passed_filtered_results_item_1[0],\n                'vsys': \"\",\n                'is_source_address': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"block ip\", parameters=parameters, assets=['pan'], name=\"block_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a06d3fab-dc42-4945-b319-d83bfdf9aa47",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 250,
                        "line_start": 225,
                        "message": "Configuring now",
                        "name": "block ip",
                        "notes": "",
                        "number": 1,
                        "order": 10,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 860,
                            "y": 60
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1269
                    },
                    {
                        "action": "block hash",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "comment": "",
                            "hash": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "comment": "",
                                    "hash": "detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.parameter.comment",
                                        "data_type": "string",
                                        "example_values": [
                                            "Sample comment"
                                        ]
                                    },
                                    {
                                        "column_name": "Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "180469AE0B239E31DB4C65F02FD70BC1"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Block hash action succeeded. It might take some time for blacklisting to take effect."
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block hash 3"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('block_hash_3() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_hash_3' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"detonate_file_1:filtered-action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1\", \"detonate_file_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'block_hash_3' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'hash': passed_filtered_results_item_1[0],\n                'comment': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(action=\"block hash\", parameters=parameters, assets=['carbonblack'], name=\"block_hash_3\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "detonate file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "987c49d7-5934-4f18-ae1d-a5e2867eaf2c",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 274,
                        "line_start": 250,
                        "message": "Configuring now",
                        "name": "block hash",
                        "notes": "",
                        "number": 3,
                        "order": 11,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 860,
                            "y": 200
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_hash_3",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1270
                    },
                    {
                        "action": "get file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "artifact:*.cef.fileHash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "get file",
                                "actions": [
                                    "list zones",
                                    "list policies",
                                    "update zone",
                                    "get file info",
                                    "get file",
                                    "block hash",
                                    "unblock hash",
                                    "get global list",
                                    "hunt file",
                                    "get system info",
                                    "list threats",
                                    "list endpoints",
                                    "test connectivity"
                                ],
                                "active": true,
                                "app_name": "CylancePROTECT",
                                "app_version": "1.0.39",
                                "appid": "e297b2aa-e103-4cc3-8cd9-14ee75d60308",
                                "asset_name": "cylance_protect",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "hash": "artifact:*.cef.fileHash"
                                },
                                "has_app": true,
                                "id": 240,
                                "loaded": false,
                                "missing": false,
                                "name": "cylance_protect",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string",
                                        "example_values": [
                                            "success",
                                            "failed"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string",
                                        "example_values": [
                                            "EFD5A16B2AA99F36C7E457454011E7CA8DE232F4584BA5957880A7B2368ED111"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string",
                                        "example_values": [
                                            "Successfully added file to vault"
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric",
                                        "example_values": [
                                            1
                                        ]
                                    },
                                    {
                                        "column_name": "Vault ID",
                                        "column_order": 0,
                                        "contains": [
                                            "sha1",
                                            "vault id"
                                        ],
                                        "data_path": "action_result.summary.vault_id",
                                        "data_type": "string",
                                        "example_values": [
                                            "dcf38e99bd2a70a1ea7232ab5e04aca63e535795"
                                        ]
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.summary.name",
                                        "data_type": "string",
                                        "example_values": [
                                            "EFD5A16B2AA99F36C7E457454011E7CA8DE232F4584BA5957880A7B2368ED111"
                                        ]
                                    },
                                    {
                                        "data_path": "action_result.summary.size",
                                        "data_type": "numeric",
                                        "example_values": [
                                            2113536
                                        ]
                                    }
                                ],
                                "parameters": {
                                    "hash": {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "SHA256 hash of file to download",
                                        "key": "hash",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "CylancePROTECT",
                                "product_vendor": "Cylance",
                                "targets": "240",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get file"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 0.7
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('get_file_1() called')\n\n    # collect data for 'get_file_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'get_file_1' call\n    for container_item in container_data:\n        parameters.append({\n            'hash': container_item[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(action=\"get file\", parameters=parameters, assets=['cylance_protect'], callback=detonate_file_1, name=\"get_file_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "cd53b29e-78cd-408d-8c58-6480077729a9",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 318,
                        "line_start": 298,
                        "message": "Configuring now",
                        "name": "get file",
                        "notes": "",
                        "number": 1,
                        "order": 13,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 240,
                            "y": 60
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_file_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1274
                    },
                    {
                        "action": "detonate file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "file_name": "",
                            "vault_id": "get_file_1:action_result.summary.vault_id"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "file_name": "",
                                    "vault_id": "get_file_1:action_result.summary.vault_id"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "wildfire",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.parameter.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pe file",
                                            "pdf",
                                            "flash",
                                            "apk",
                                            "jar",
                                            "doc",
                                            "xls",
                                            "ppt"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_info.filetype",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_info.malware",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_info.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_info.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_info.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_info.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@behavior_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.*.@sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@behavior_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.evidence.file.entry.@sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@deleted_file",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_deleted.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.file.file_written.*.@written_file",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.malware",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@query",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@response",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.dns.*.@type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@country",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.tcp.*.@port",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@country",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.udp.*.@port",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@host",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@uri",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.network.url.*.@user_agent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.platform",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@command",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file path"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.file.create.*.@type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.mutex.createmutex.*.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.create.*.@subkey",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@key",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_list.process.*.registry.set.*.@subkey",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.process_tree.*.process.@text",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletekey.*.@reg_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.registry.deletevaluekey.*.@reg_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@pid",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@process_image",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.registry.setvaluekey.*.@reg_key",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.task_info.report.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.software",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@details",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.summary.entry.*.@score",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.task",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.#text",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.timeline.entry.*.@seq",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.task_info.report.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.malware",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "sandbox"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "detonate file"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def detonate_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):\n    phantom.debug('detonate_file_1() called')\n        \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'detonate_file_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['get_file_1:action_result.summary.vault_id', 'get_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'detonate_file_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'vault_id': results_item_1[0],\n                'file_name': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(action=\"detonate file\", parameters=parameters, assets=['wildfire'], callback=filter_1, name=\"detonate_file_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "get file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "7e9c56b6-7673-41ae-bb5c-97d0f5baa7a8",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 298,
                        "line_start": 274,
                        "message": "Configuring now",
                        "name": "detonate file",
                        "notes": "",
                        "number": 1,
                        "order": 12,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 480,
                            "y": 60
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "detonate_file_1",
                        "required_params": {
                            "vault_id": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 1275
                    }
                ]
            },
            "notes": ""
        },
        "python_version": "3",
        "schema": 4,
        "version": "4.10.0.40961"
    },
    "create_time": "2021-01-25T18:47:58.409263+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ],
    "tags": [],
    "misc": {
        "apps_list": [
            "Carbon Black Response",
            "LDAP",
            "Palo Alto Networks Firewall",
            "WildFire",
            "Cylance"
        ]
    }
}