advanced_playbook_tutorial.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Tech Sessions",
    "misc": { "apps_list": ["Palo Alto Networks Firewall", "ReversingLabs"] },
    "coa": {
        "data": {
            "clean": true,
            "code_block": "import requests",
            "description": "This example Playbook was created for a tutorial to show various features of the Phantom Playbook editor, including filters, decisions, custom lists, prompts and scheduled actions.",
            "hash": "482c666ddef3798954a85df87f1fff3f2ba6ce39",
            "joint": {
                "cells": [
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "ref-y": 8,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'file_reputation_1' block\n    file_reputation_1(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2c2aac7c-ea0a-44d0-9f11-72969dc2e9ce",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 25,
                        "line_start": 17,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 140,
                            "y": 620
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 1
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "43461e43-3071-4e61-acf6-075af0a56538",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2c2aac7c-ea0a-44d0-9f11-72969dc2e9ce",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "01204538-b04d-4682-abb4-01e616cac5fe",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 12
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ae212f38-db69-48d1-8ff5-eb4b3e33839e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "01204538-b04d-4682-abb4-01e616cac5fe",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "7fb56735-cc89-4272-afb1-d89874c587c2",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 13
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "2f0d1929-aa34-4627-be97-c0b44647165d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "7fb56735-cc89-4272-afb1-d89874c587c2",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "83fbb871-d0d4-488a-ad95-974f45077c38",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 15
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "3cffacd3-259f-4966-bb24-27875ea88a94",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "83fbb871-d0d4-488a-ad95-974f45077c38",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "05af01e2-e37d-4566-9c91-cc20563706a6",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 18
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "1c60619b-4480-45d2-a039-302233bc225d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "05af01e2-e37d-4566-9c91-cc20563706a6",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "27643aee-8df0-48a9-85a7-347df872b2d6",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 20
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "a4d70b7a-698c-4d61-96a2-c30abb3fdfcb",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "83fbb871-d0d4-488a-ad95-974f45077c38",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "27845ccb-bf3b-4f45-a1b2-538ddf53ce57",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 22
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "70efdc58-547c-4af3-bb55-f44c7031a64c",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "83fbb871-d0d4-488a-ad95-974f45077c38",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "dff5ea89-94dd-443f-ad16-c8ce2d0401af",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 24
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "49a880ea-a238-42c0-81d1-3010d2587dfb",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "fc0bdfe2-0da0-4b10-a487-75628d52c651",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "ea54af98-d19b-4438-b959-ee4b509ef85d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 39
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b7577511-dfae-4e12-83cf-a44307eebe45",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "dff5ea89-94dd-443f-ad16-c8ce2d0401af",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "5fe6244b-4b80-4e5d-a661-e91f932040bd",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 40
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d28335dc-454e-4a9c-96f0-880691a0bdff",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "5fe6244b-4b80-4e5d-a661-e91f932040bd",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6f3d383e-6e07-4ce9-b2bd-30d7338ff22c",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 42
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "87dbbef6-713b-44fa-b268-209fa596942f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6f3d383e-6e07-4ce9-b2bd-30d7338ff22c",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "fc0bdfe2-0da0-4b10-a487-75628d52c651",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 44
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "945b4894-8199-409b-a76c-2604dd3fa77d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "27643aee-8df0-48a9-85a7-347df872b2d6",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e28f5907-8d15-4ae1-84d3-2267f7f0bf04",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 51
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "eb998d3c-ab81-4c45-b42c-0e098c4e79e7",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "27845ccb-bf3b-4f45-a1b2-538ddf53ce57",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e28f5907-8d15-4ae1-84d3-2267f7f0bf04",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "vertices": [],
                        "z": 52
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f6a36252-9418-40c8-84f6-73e993d63210",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "841e8b4f-567c-4c39-8c6e-5cf8527ff457",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e28f5907-8d15-4ae1-84d3-2267f7f0bf04",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 123
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all detals of actions \n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation, terminate process, remove from blocklist",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "e28f5907-8d15-4ae1-84d3-2267f7f0bf04",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 316,
                        "line_start": 303,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "order": 15,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 2180,
                            "y": 620
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 166
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d7eb5e24-7795-49e0-af87-9a324ab53a74",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "ea54af98-d19b-4438-b959-ee4b509ef85d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c33dec3f-d008-4c3c-99ae-76ddc963b5f1",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 187
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "4f9d6114-49a0-4b13-a1b4-67fe0c570d6b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c33dec3f-d008-4c3c-99ae-76ddc963b5f1",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "841e8b4f-567c-4c39-8c6e-5cf8527ff457",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 188
                    },
                    {
                        "action": "unblock ip",
                        "action_type": "correct",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "unblock_ip_1:action_result.parameter.ip",
                            "is_source_address": "",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "unblock_ip_1:action_result.parameter.ip",
                                    "is_source_address": "",
                                    "vsys": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "pan",
                                "output": [
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.is_source_address",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vsys",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 2,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "firewall"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "remove from blockli...."
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Correct"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_correct.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def remove_from_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('remove_from_blocklist() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'remove_from_blocklist' call\n    results_data_1 = phantom.collect2(container=container, datapath=['unblock_ip_1:action_result.parameter.ip', 'unblock_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'remove_from_blocklist' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'ip': results_item_1[0],\n                'vsys': \"\",\n                'is_source_address': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"unblock ip\", parameters=parameters, assets=['pan'], name=\"remove_from_blocklist\", parent_action=action)    \n    \n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#E65100",
                        "connected_to_start": true,
                        "connection_name": "unblock ip 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def remove_from_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('remove_from_blocklist() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'remove_from_blocklist' call\n    ips_to_remove = phantom.collect2(container=container, datapath=['unblock_ip_1:action_result.parameter.ip'], action_results=results)\n    \n    phantom.debug(\"ips to remove: {}\".format(ips_to_remove))\n    del_rows = set()\n    \n    for ip in ips_to_remove:\n        match = phantom.datastore_present('blocked_ips', [ip[0]], 0)\n        #matches = match.get('matches', [])\n        if 'matches' in match:\n            matches = match['matches']\n            for m in matches:\n                idx = m.get('index', -1)\n                if idx >= 0:\n                    del_rows.add(idx)\n    \n    if del_rows:\n        phantom.debug(\"deleting rows: {}\".format(del_rows))\n        data = { 'delete_rows': list(del_rows) }\n        requests.post('{}/decided_list/blocked_ips'.format(phantom.get_rest_base_url()), data=json.dumps(data), verify=False)\n\n    return",
                        "custom_join": "",
                        "custom_name": "remove from blocklist",
                        "delay": 0,
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "841e8b4f-567c-4c39-8c6e-5cf8527ff457",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 303,
                        "line_start": 275,
                        "message": "Configuring now",
                        "name": "unblock ip",
                        "notes": "If unblock was done, remove the IP address from blocklist",
                        "number": 2,
                        "order": 14,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1960,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "remove_from_blocklist",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Correct",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 211
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "api": "set severity",
                        "attrs": {
                            ".api": {
                                "text": "set severity"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "API"
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def set_severity_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('set_severity_2() called')\n\n    phantom.set_severity(container, \"high\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "color": "",
                        "configured": [
                            {
                                "key": "set-severity",
                                "setSeveritySeverity": "high"
                            }
                        ],
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "27643aee-8df0-48a9-85a7-347df872b2d6",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 32,
                        "line_start": 25,
                        "message": "Configuring now",
                        "name": "set severity",
                        "notes": "Set severity to HIGH because the infected endpoint is not a test machine",
                        "number": 2,
                        "order": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1240,
                            "y": 600
                        },
                        "previous_function": "",
                        "previous_name": "set_severity_2",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "api",
                        "status": "",
                        "title": "API",
                        "type": "coa.API",
                        "warn": false,
                        "z": 217
                    },
                    {
                        "action": "file reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "artifact:*.cef.fileHash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "file reputation",
                                "active": true,
                                "app_name": "ReversingLabs",
                                "app_version": "1.2.26",
                                "appid": "",
                                "asset_name": "reversinglabs",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "hash": "artifact:*.cef.fileHash"
                                },
                                "has_app": true,
                                "id": 61,
                                "loaded": false,
                                "missing": false,
                                "name": "reversinglabs",
                                "output": [
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.first_seen_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.last_scanned_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.last_seen_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.single_scan",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.first_scanned_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sample_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sample_size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.scanner_match",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.scanner_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.results.*.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.results.*.scanner",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.scanned_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.scanners.*.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.scanners.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.xref.*.scanners.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sha384",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sha512",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.ripemd160",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_scans",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "parameters": {
                                    "hash": {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "File hash to query",
                                        "key": "hash",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "TitaniumCloud",
                                "product_vendor": "ReversingLabs",
                                "targets": "5",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "file reputation"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('file_reputation_1() called')\n\n    # collect data for 'file_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'file_reputation_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'hash': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"file reputation\", parameters=parameters, assets=['reversinglabs'], callback=filter_1, name=\"file_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "01204538-b04d-4682-abb4-01e616cac5fe",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 127,
                        "line_start": 106,
                        "message": "Configuring now",
                        "name": "file reputation",
                        "notes": "Check reversing labs if file is malicious",
                        "number": 1,
                        "order": 7,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 300,
                            "y": 600
                        },
                        "previous_function": "",
                        "previous_name": "file_reputation_1",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 227
                    },
                    {
                        "action": "terminate process",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "filtered-data:filter_2:condition_1:artifact:*.cef.destinationAddress",
                            "name": "filtered-data:filter_2:condition_1:artifact:*.cef.fileName"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip_hostname": "filtered-data:filter_2:condition_1:artifact:*.cef.destinationAddress",
                                    "name": "filtered-data:filter_2:condition_1:artifact:*.cef.fileName"
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "tanium",
                                "output": [
                                    {
                                        "contains": [
                                            "file name",
                                            "process name"
                                        ],
                                        "data_path": "action_result.parameter.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name/IP Address",
                                        "column_order": 0,
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "terminate pr..."
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def terminate_process_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('terminate_process_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'terminate_process_1' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_2:condition_1:artifact:*.cef.fileName', 'filtered-data:filter_2:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_2:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'terminate_process_1' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0] and filtered_artifacts_item_1[1]:\n            parameters.append({\n                'name': filtered_artifacts_item_1[0],\n                'ip_hostname': filtered_artifacts_item_1[1],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[2]},\n            })\n\n    phantom.act(\"terminate process\", parameters=parameters, assets=['tanium'], name=\"terminate_process_1\")    \n    \n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def terminate_process_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('terminate_process_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'terminate_process_1' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_2:condition_1:artifact:*.cef.fileName', 'filtered-data:filter_2:condition_1:artifact:*.cef.destinationAddress', 'filtered-data:filter_2:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'terminate_process_1' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0] and filtered_artifacts_item_1[1]:\n            parameters.append({\n                'name': filtered_artifacts_item_1[0],\n                'ip_hostname': filtered_artifacts_item_1[1],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[2]},\n            })\n\n    #phantom.act(\"terminate process\", parameters=parameters, assets=['tanium'], name=\"terminate_process_1\")    \n    \n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": 0,
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "27845ccb-bf3b-4f45-a1b2-538ddf53ce57",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 275,
                        "line_start": 251,
                        "message": "Configuring now",
                        "name": "terminate process",
                        "notes": "terminating the process by file name for the file whose hash has been confirmed to be malicious",
                        "number": 1,
                        "order": 13,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 820,
                            "y": 700
                        },
                        "previous_function": "",
                        "previous_name": "terminate_process_1",
                        "required_params": {
                            "ip_hostname": true,
                            "name": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 230
                    },
                    {
                        "action": "unblock ip",
                        "action_type": "correct",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "block_ip_1:action_result.parameter.ip",
                            "is_source_address": "",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "block_ip_1:action_result.parameter.ip",
                                    "is_source_address": "",
                                    "vsys": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "pan",
                                "output": [
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.is_source_address",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vsys",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 2,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "firewall"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "unblock ip 1"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Correct"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_correct.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_delay_dark_on.svg"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def unblock_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('unblock_ip_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'unblock_ip_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['block_ip_1:action_result.parameter.ip', 'block_ip_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'unblock_ip_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'is_source_address': \"\",\n                'ip': results_item_1[0],\n                'vsys': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n    # calculate start time using delay of 60 minutes\n    start_time = datetime.now() + timedelta(minutes=60)\n\n    phantom.act(\"unblock ip\", parameters=parameters, assets=['pan'], callback=remove_from_blocklist, start_time=start_time, name=\"unblock_ip_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#E65100",
                        "connected_to_start": true,
                        "connection_name": "block ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "60",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c33dec3f-d008-4c3c-99ae-76ddc963b5f1",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 251,
                        "line_start": 224,
                        "message": "Configuring now",
                        "name": "unblock ip",
                        "notes": "Scheduling the unblock after 60 minutes",
                        "number": 1,
                        "order": 12,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1720,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "unblock_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "show_delay": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Correct",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 242
                    },
                    {
                        "action": "send message",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "destination": "",
                            "message": "filtered-data:filter_3:condition_1:artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [],
                        "attrs": {
                            ".action": {
                                "text": "add to blocklist"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Generic"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_code_dark_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "playbook_tutorial_prompt",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def add_to_blocklist(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('add_to_list() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_3:condition_1:artifact:*.cef.sourceAddress', 'filtered-data:filter_3:condition_1:artifact:*.id'])\n    \n    phantom_url = phantom.get_base_url()\n    container_url = \"{}/mission/{}\".format(phantom_url, container['id'])\n    \n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            phantom.datastore_add('blocked_ips', [ filtered_artifacts_item_1[0], 'yes',  container_url ] )\n\n    block_ip_1(action, success, container, results, handle, filtered_artifacts, filtered_results)\n    return",
                        "custom_join": "",
                        "custom_name": "add to blocklist",
                        "delay": 0,
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "fc0bdfe2-0da0-4b10-a487-75628d52c651",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 199,
                        "line_start": 183,
                        "message": "Configuring now",
                        "name": "send message",
                        "notes": "Add the IP address to [blocked_ips] custom list",
                        "number": 1,
                        "order": 10,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1240,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "add_to_blocklist",
                        "required_params": {},
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Generic",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 243
                    },
                    {
                        "action": "block ip",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "filtered-data:filter_3:condition_1:artifact:*.cef.sourceAddress",
                            "is_source_address": "",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "appid": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "filtered-data:filter_3:condition_1:artifact:*.cef.sourceAddress",
                                    "is_source_address": "",
                                    "vsys": ""
                                },
                                "has_app": true,
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "pan",
                                "output": [
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vsys",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.is_source_address",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 2,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "firewall"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block ip"
                            },
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".color-band": {
                                "fill": "#3C444D"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.approver image": {
                                "opacity": 1
                            },
                            "g.code image": {
                                "opacity": 1
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            },
                            "g.timer image": {
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('block_ip_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_ip_1' call\n    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_3:condition_1:artifact:*.cef.sourceAddress', 'filtered-data:filter_3:condition_1:artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'block_ip_1' call\n    for filtered_artifacts_item_1 in filtered_artifacts_data_1:\n        if filtered_artifacts_item_1[0]:\n            parameters.append({\n                'is_source_address': \"\",\n                'ip': filtered_artifacts_item_1[0],\n                'vsys': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_artifacts_item_1[1]},\n            })\n\n    phantom.act(\"block ip\", parameters=parameters, assets=['pan'], callback=unblock_ip_1, name=\"block_ip_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "add to blocklist",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "ea54af98-d19b-4438-b959-ee4b509ef85d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 224,
                        "line_start": 199,
                        "message": "Configuring now",
                        "name": "block ip",
                        "notes": "lets block the IP on the FWs",
                        "number": 1,
                        "order": 11,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1480,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "block_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 244
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('decision_4() called')\n\n    # check for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"playbook_tutorial_prompt:action_result.summary.response\", \"==\", \"Yes\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched_artifacts_1 or matched_results_1:\n        add_to_blocklist(action=action, success=success, container=container, results=results, handle=handle)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "playbook_tutorial_prompt",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6f3d383e-6e07-4ce9-b2bd-30d7338ff22c",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 145,
                        "line_start": 127,
                        "name": "decision",
                        "notes": "Analyst wants a temp block so lets add it to block list first and proceed with block",
                        "number": 4,
                        "order": 8,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1100,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "decision_4",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 246
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_2() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"==\", \"artifact:*.cef.fileHash\"],\n        ],\n        name=\"filter_2:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        decision_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        terminate_process_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        filter_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "83fbb871-d0d4-488a-ad95-974f45077c38",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 106,
                        "line_start": 86,
                        "name": "filter",
                        "notes": "Identify the artifact whose hash is malicious to get other related properties",
                        "number": 2,
                        "order": 6,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 680,
                            "y": 600
                        },
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 247
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n        ],\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        filter_2(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "7fb56735-cc89-4272-afb1-d89874c587c2",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 86,
                        "line_start": 68,
                        "name": "filter",
                        "notes": "More than 10 vendors detect the file as Malicious?",
                        "number": 1,
                        "order": 5,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 540,
                            "y": 600
                        },
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 248
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#637282",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def decision_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('decision_3() called')\n\n    # check for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"filtered-data:filter_2:condition_1:artifact:*.cef.destinationAddress\", \"not in\", \"custom_list:test_machines\"],\n        ])\n\n    # call connected blocks if condition 1 matched\n    if matched_artifacts_1 or matched_results_1:\n        set_severity_2(action=action, success=success, container=container, results=results, handle=handle)\n        return\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "05af01e2-e37d-4566-9c91-cc20563706a6",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 50,
                        "line_start": 32,
                        "name": "decision",
                        "notes": "If the infected machine is NOT a test machine then this is a HIGH severity event",
                        "number": 3,
                        "order": 3,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1100,
                            "y": 600
                        },
                        "previous_function": "",
                        "previous_name": "decision_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "decision",
                        "status": "",
                        "type": "coa.Decision",
                        "warn": "",
                        "z": 249
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773",
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_3() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"filtered-data:filter_2:condition_1:artifact:*.cef.destinationAddress\", \"not in\", \"custom_list:blocked_ips\"],\n        ],\n        name=\"filter_3:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        playbook_tutorial_prompt(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "dff5ea89-94dd-443f-ad16-c8ce2d0401af",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 68,
                        "line_start": 50,
                        "name": "filter",
                        "notes": "If the source (attacker) IP is not already blocked, then lets ask the user to proceed with the block",
                        "number": 3,
                        "order": 4,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 820,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "filter_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 250
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "approver": "admin",
                        "attrs": {
                            ".background": {
                                "fill": "#000000",
                                "stroke": "#5C6773"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "opacity": 1,
                                "xlink:href": "/inc/coa/img/block_icon_note_dark_on.svg"
                            }
                        },
                        "block_code": "def playbook_tutorial_prompt(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('playbook_tutorial_prompt() called')\n    \n    # set user and message variables for phantom.prompt call\n    user = \"admin\"\n    message = \"\"\"Based on a SIEM event about a potential malware incident, Phantom has investigated and determined that the potential attacker IP address:  \n{0}\n\nhas been connected to malware with hash \n{1}\n\nand the above hash has {2} positive detections on a ReversingLabs reputation score. Should Phantom temporarily block the IP address using the Palo Alto Networks firewall for the next 60 minutes (after which it will be unblocked)?\"\"\"\n\n    # parameter list for template variable replacement\n    parameters = [\n        \"filtered-data:filter_3:condition_1:artifact:*.cef.sourceAddress\",\n        \"filtered-data:filter_3:condition_1:artifact:*.cef.fileHash\",\n        \"filtered-data:filter_2:condition_1:file_reputation_1:action_result.summary.positives\",\n    ]\n\n    #responses:\n    response_types = [\n        {\n            \"prompt\": \"\",\n            \"options\": {\n                \"type\": \"list\",\n                \"choices\": [\n                    \"Yes\",\n                    \"No\",\n                ]\n            },\n        },\n    ]\n\n    phantom.prompt2(container=container, user=user, message=message, respond_in_mins=30, name=\"playbook_tutorial_prompt\", parameters=parameters, response_types=response_types, callback=decision_4)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "playbook_tutorial_prompt",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "5fe6244b-4b80-4e5d-a661-e91f932040bd",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 183,
                        "line_start": 145,
                        "message": "Based on a SIEM event about a potential malware incident, Phantom has investigated and determined that the potential attacker IP address:  \n{0}\n\nhas been connected to malware with hash \n{1}\n\nand the above hash has {2} positive detections on a ReversingLabs reputation score. Should Phantom temporarily block the IP address using the Palo Alto Networks firewall for the next 60 minutes (after which it will be unblocked)?",
                        "name": "prompt",
                        "notes": "Ask the IR analyst to see if this should be temporarily blocked",
                        "number": 1,
                        "order": 9,
                        "outPorts": [
                            "out"
                        ],
                        "parameters": [
                            {
                                "position": 0,
                                "type": "",
                                "value": "filtered-data:filter_3:condition_1:artifact:*.cef.sourceAddress"
                            },
                            {
                                "position": 1,
                                "type": "",
                                "value": "filtered-data:filter_3:condition_1:artifact:*.cef.fileHash"
                            },
                            {
                                "position": 2,
                                "type": "",
                                "value": "filtered-data:filter_2:condition_1:file_reputation_1:action_result.summary.positives"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 960,
                            "y": 840
                        },
                        "previous_function": "",
                        "previous_name": "playbook_tutorial_prompt",
                        "respond_in": "30",
                        "response_key": "Yes/No",
                        "response_options": [
                            "Yes",
                            "No"
                        ],
                        "response_type": "list",
                        "responses": [
                            {
                                "response_key": "Yes/No",
                                "response_options": [
                                    "Yes",
                                    "No"
                                ],
                                "response_prompt": "",
                                "response_type": "list"
                            }
                        ],
                        "show_number": true,
                        "size": {
                            "height": 80,
                            "width": 80
                        },
                        "state": "prompt",
                        "status": "",
                        "type": "coa.Prompt",
                        "warn": "",
                        "z": 252
                    }
                ]
            },
            "notes": "Check file reputation (reversing labs)\nCheck if infected endpoint is a test machine or a critical system. Set Severity accordingly.\nIf file is malicious, terminate process by filename on endpoint (Tanium)\nIf file is malicious, extract the C&C Server IP and check if C&C IP is already blocked in a \u201cblocked IPs\u201d list\nIf not already blocked, ask user if the IP should be blocked given the file reputation information and other details\nIf user approves, block the IP and add it to \u201cblocked IPs\u201d list\nSchedule an unblock after 60 mins and remove the IP from \u201cblocked IPs\u201d list"
        },
        "schema": 3,
        "version": "4.2.6332"
    },
    "create_time": "2019-01-28T22:34:22.850873+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ],
    "tags": []
}