malware_hunt_and_contain.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Samples",
    "misc": { "apps_list": ["LDAP", "ServiceNow", "Carbon Black Response", "VirusTotal"] },
    "coa": {
        "data": {
            "clean": true,
            "code_block": "\"\"\"Malicous file detected on endpoint\"\"\"",
            "description": "This playbook investigates and remediates malware infections on the endpoint.",
            "hash": "00204d2a1fed949770bf0923d8d47405546a446f",
            "joint": {
                "cells": [
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "5ad21936-f8c5-45e3-ab48-4aa74d2185b3",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 14
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c168d4c9-945d-4742-a662-6e4abbc945da",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 651
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "3949529c-aff6-4401-90d8-a70c288b74d5",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "b9591115-e22e-48e0-952d-47c76448f051",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0444efd4-6363-4dea-acca-b0c02ce9f973",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1290
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9b55f239-b39d-4fe3-adda-f6168661b33a",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "72f13962-4d43-44be-9710-d2ed60cbbf00",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0444efd4-6363-4dea-acca-b0c02ce9f973",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1558
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9c84c8ba-08f4-4cec-acfd-c4dbccbbc66e",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1694
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b415fd2a-3939-4c18-a92e-efa93d32b1c6",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1706
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "961848a5-5fd4-4e3b-8b7b-6ef40ea4d007",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1710
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "1649dbd5-f0bf-43ec-951b-5ad008365d1d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "b9591115-e22e-48e0-952d-47c76448f051",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1718
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0db3fd7f-4779-44c3-8ea3-694bad0388d9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1886
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "88f69577-f71a-4ee0-8386-9ab6bcd33e28",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1892
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "48627df2-9bc5-40fa-858e-426631c72ab9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "91866693-2720-43a1-a437-f65f19382b9a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1903
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "fbce023e-da26-4df2-829b-99d0a167cdd0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 1968
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "509e0e96-ee20-4dd7-8a04-e5a9b8f1db85",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1982
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f5d00299-537c-4bf8-b86b-a500fa1c2258",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1988
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "ee268141-044c-48e5-b1ad-29803892a264",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 1992
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "0a60f02d-fb84-4d21-af04-0adc070f3ccf",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2050
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "562f6e73-5fb8-4722-b99b-7b2b91109a37",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2324
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "14967b49-8e3a-4a08-8c66-53f7e7b5b4b2",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 2339
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "d580f77a-9877-4c13-9a40-308797deca8d",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2544
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c2f5849d-4fa9-4a35-93df-7570b63d2304",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "72f13962-4d43-44be-9710-d2ed60cbbf00",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 2557
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 3
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "block"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def filter_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_3() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.summary.positives\", \">\", \"5\"],\n            [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n        ],\n        logical_operator='and',\n        name=\"filter_3:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        create_ticket_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": false,
                        "connection_name": "block hash 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "e9a5e63f-becb-4040-914b-bdaeb8278d88",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 45,
                        "line_start": 25,
                        "name": "filter",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.summary.positives",
                                        "value": "5"
                                    },
                                    {
                                        "comparison": "<=",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.summary.positives",
                                        "value": "10"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1080,
                            "y": 80
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_3",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 2590
                    },
                    {
                        "action": "shutdown system",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
                            "message": "",
                            "wait_time": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
                                    "message": "",
                                    "ph": "",
                                    "wait_time": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domainctrl1",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.wait_time",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.parameter.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Machine Ip Name",
                                        "column_order": 0,
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Total Objects",
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Total Objects Successful",
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "shutdown system"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def shutdown_system_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('shutdown_system_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'shutdown_system_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'shutdown_system_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'wait_time': \"\",\n                'ph': \"\",\n                'message': \"\",\n                'ip_hostname': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"shutdown system\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"shutdown_system_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a2d2bac8-c4c2-41b2-9c94-5e958b32684f",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 71,
                        "line_start": 45,
                        "message": "Configuring now",
                        "name": "shutdown system",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 760
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "shutdown_system_1",
                        "required_params": {
                            "ip_hostname": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2794
                    },
                    {
                        "action": "create ticket",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "description": "",
                            "fields": "",
                            "short_description": "Virus Detected"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "description": "",
                                    "fields": "",
                                    "short_description": "Virus Detected",
                                    "table": "",
                                    "vault_id": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "servicenow",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.short_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "servicenow table"
                                        ],
                                        "data_path": "action_result.parameter.table",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.fields",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "servicenow ticket id"
                                        ],
                                        "data_path": "action_result.summary.created_ticket_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.escalation",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.watch_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.follow_up",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.made_sla",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_task",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sla_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Number",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.caller_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_mod_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.notify",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Closed On",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.closed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cmdb_ci",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.subcategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.expected_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.knowledge",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.opened_by.link",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.opened_by.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.impact",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.caused_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.problem_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.activity_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ID",
                                        "column_order": 4,
                                        "contains": [
                                            "servicenow ticket id"
                                        ],
                                        "data_path": "action_result.data.*.sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Opened On",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.opened_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.child_incidents",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Short Description",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.short_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments_and_work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.time_worked",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_reject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reassignment_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.due_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_class_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_plan",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Description",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.rfc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.company",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.user_input",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain.link",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.group_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.active",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent_incident",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.closed_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Severity",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.severity",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_approval",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.incident_state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopen_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contact_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_end",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.location",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assignment_group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_set",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.order",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.urgency",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Priority",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.priority",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.hold_reason",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_bytes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_width",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.content_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_height",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.download_link",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_mod_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.average_image_color",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.additional_assignee_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_added",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "ticketing"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "create ticket 2"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": false,
                        "connection_name": "logoff user, shutdown system, disable user, block hash 3",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def create_ticket_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'create_ticket_2' call\n\n    disabled_users = set(phantom.collect2(datapath='disable_user_1:action_result.parameter.username'))\n    blocked_hashes = set(phantom.collect2(datapath='block_hash_3:action_result.parameter.hash'))\n    loggedoff_users = set(phantom.collect2(datapath='logoff_user_1:action_result.parameter.username'))\n    shutdown_systems = set(phantom.collect2(datapath='shutdown_system_1:action_result.parameter.ip_hostname'))\n    file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash',                                                         \n                                                 'file_reputation_1:filtered-action_result.summary.positives'])\n    detected_users = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.username'))\n    detected_systems = set(phantom.collect2(datapath='hunt_file_2:action_result.data.*.process.results.*.hostname'))\n    \n    title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n    \n    description =  \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n    description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n    description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n    if len(blocked_hashes):\n        description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n    if len(loggedoff_users):\n        description += \"{0} users were forced to logoff:\\n{1}\\n\\n\".format(len(loggedoff_users), \", \".join(loggedoff_users))\n    if len(disabled_users):\n        description += \"{0} user accounts were disabled:\\n{1}\\n\\n\".format(len(disabled_users), \", \".join(disabled_users))\n    if len(shutdown_systems):\n        description += \"{0} systems were shutdown:\\n{1}\\n\\n\".format(len(shutdown_systems), \", \".join(shutdown_systems))\n\n    parameters = []\n    \n    # build parameters list for 'create_ticket_2' call\n    parameters.append({\n        'short_description': title,\n        'description': description,\n        'fields': \"\",\n    })\n\n    if parameters:\n        phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_2\", parent_action=action)    \n    else:\n        phantom.error(\"'create_ticket_2' will not be executed due to lack of parameters\")\n    \n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "b9591115-e22e-48e0-952d-47c76448f051",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 116,
                        "line_start": 71,
                        "message": "Configuring now",
                        "name": "create ticket",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1220,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "create_ticket_2",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2825
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_2() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n        ],\n        name=\"filter_2:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        create_ticket_2(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": false,
                        "connection_name": "logoff user, shutdown system, disable user, block hash 3",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a44f44e3-b4cb-4409-a495-8afedb2754e4",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('join_filter_2() called')\n\n    # check if all connected incoming actions are done i.e. have succeeded or failed\n    if phantom.actions_done([ 'logoff_user_1', 'shutdown_system_1', 'disable_user_1', 'block_hash_3' ]):\n        \n        # call connected block \"filter_2\"\n        filter_2(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 134,
                        "line_end": 145,
                        "line_start": 116,
                        "name": "filter",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.summary.positives",
                                        "value": "10"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1080,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 2826
                    },
                    {
                        "action": "logoff user",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
                            "username": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip_hostname": "hunt_file_2:action_result.data.*.process.results.*.hostname",
                                    "username": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domainctrl1",
                                "output": [
                                    {
                                        "column_name": "Username",
                                        "column_order": 0,
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.parameter.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Total Objects",
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Total Objects Successful",
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "logoff user"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def logoff_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('logoff_user_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'logoff_user_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.hostname', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'logoff_user_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'username': \"\",\n                'ip_hostname': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"logoff user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"logoff_user_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "4fb5d51d-3f89-4408-88c4-4af8f22feb5a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 169,
                        "line_start": 145,
                        "message": "Configuring now",
                        "name": "logoff user",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 620
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "logoff_user_1",
                        "required_params": {
                            "ip_hostname": true,
                            "username": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2827
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'file_reputation_1' block\n    file_reputation_1(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "4c86e34b-13d5-4884-b1d2-53d1f3448f91",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 25,
                        "line_start": 17,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 80,
                            "y": 100
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 2895
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all detals of actions \n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "create ticket 2, create ticket 3",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0444efd4-6363-4dea-acca-b0c02ce9f973",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 450,
                        "line_start": 437,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1460,
                            "y": 100
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 2901
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.summary.positives\", \">\", \"5\"],\n            [\"file_reputation_1:action_result.summary.positives\", \"<=\", 10],\n        ],\n        logical_operator='and',\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        hunt_file_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n        get_file_2(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"file_reputation_1:action_result.summary.positives\", \">\", 10],\n        ],\n        name=\"filter_1:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        hunt_file_2(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n        get_file_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "8c9518d8-506f-4750-9e8e-2094bd14d431",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 224,
                        "line_start": 189,
                        "name": "filter",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.summary.positives",
                                        "value": "5"
                                    },
                                    {
                                        "comparison": "<=",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.summary.positives",
                                        "value": "10"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "file_reputation_1:action_result.summary.positives",
                                        "value": "10"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 460,
                            "y": 80
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 2941
                    },
                    {
                        "action": "hunt file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash",
                            "range": "",
                            "type": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash",
                                    "range": "",
                                    "type": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "carbon black query type"
                                        ],
                                        "data_path": "action_result.parameter.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.range",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.device_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.terms",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.total_results",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.modload_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.sensor_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.process_md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_unique_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.cmdline",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.filemod_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "carbon black process id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.last_update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.netconn_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file path"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.regmod_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.crossproc_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.segment_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.host_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.childproc_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.unique_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.elapsed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.terms",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.total_results",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.ids",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.host_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.observed_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Signed",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.binary.results.*.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_executable_image",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_64bit",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.endpoint",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.legal_copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.cb_version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.last_seen",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.elapsed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt file 2"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('hunt_file_2() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_file_2' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_2' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'hash': filtered_results_item_1[0],\n                'range': \"\",\n                'type': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=hunt_file_2_callback, name=\"hunt_file_2\")\n\n    return",
                        "callback_code": "def hunt_file_2_callback(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('hunt_file_2_callback() called')\n    \n    disable_user_1(action=action, success=success, container=container, results=results, handle=handle)\n    logoff_user_1(action=action, success=success, container=container, results=results, handle=handle)\n    shutdown_system_1(action=action, success=success, container=container, results=results, handle=handle)\n    block_hash_3(action=action, success=success, container=container, results=results, handle=handle)\n\n    return",
                        "callback_start": 249,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "6f5751ac-efaa-4f6e-97cf-29c88c78b381",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 259,
                        "line_start": 224,
                        "message": "Configuring now",
                        "name": "hunt file",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 600,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_file_2",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2944
                    },
                    {
                        "action": "get file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Vault ID",
                                        "column_order": 1,
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.data.*.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "MD5",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_details.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.icon",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.endpoint",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.is_64bit",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.file_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.last_seen",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.cb_version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.host_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.watchlists.*.wid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.watchlists.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.orig_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.copied_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.legal_copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_publisher",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_sign_time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.observed_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_result_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.is_executable_image",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.server_added_timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.summary.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.file_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get file 3"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('get_file_3() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_file_3' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_2:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'get_file_3' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'hash': filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_3\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "e6a1a311-5337-4d44-b8d3-58d8a6cf8be1",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 282,
                        "line_start": 259,
                        "message": "Configuring now",
                        "name": "get file",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 600,
                            "y": 900
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_file_3",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2945
                    },
                    {
                        "action": "get file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Vault ID",
                                        "column_order": 1,
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.data.*.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "MD5",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.data.*.file_details.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.icon",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.endpoint",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.is_64bit",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.file_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.last_seen",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.cb_version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.host_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.watchlists.*.wid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.watchlists.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.orig_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.copied_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.legal_copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_publisher",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_sign_time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.observed_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.digsig_result_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.is_executable_image",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.file_details.server_added_timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.summary.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.file_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get file 2"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_file_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('get_file_2() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_file_2' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'get_file_2' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'hash': filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"get file\", parameters=parameters, assets=['carbonblack'], name=\"get_file_2\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "91866693-2720-43a1-a437-f65f19382b9a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 305,
                        "line_start": 282,
                        "message": "Configuring now",
                        "name": "get file",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 600,
                            "y": 200
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_file_2",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2947
                    },
                    {
                        "action": "create ticket",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "description": "block_hash_2:action_result.message",
                            "fields": "block_hash_2:action_result.message",
                            "short_description": "block_hash_2:action_result.message"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "description": "block_hash_2:action_result.message",
                                    "fields": "block_hash_2:action_result.message",
                                    "short_description": "block_hash_2:action_result.message",
                                    "table": "",
                                    "vault_id": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "servicenow",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.short_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "servicenow table"
                                        ],
                                        "data_path": "action_result.parameter.table",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.fields",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "servicenow ticket id"
                                        ],
                                        "data_path": "action_result.summary.created_ticket_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_updated_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.escalation",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.watch_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.follow_up",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.made_sla",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_task",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sla_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Number",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.number",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.caller_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_mod_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.notify",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Closed On",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.closed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.cmdb_ci",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.subcategory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.expected_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.knowledge",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.opened_by.link",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.opened_by.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.impact",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.caused_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.problem_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.activity_due",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "ID",
                                        "column_order": 4,
                                        "contains": [
                                            "servicenow ticket id"
                                        ],
                                        "data_path": "action_result.data.*.sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Opened On",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.opened_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.child_incidents",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Short Description",
                                        "column_order": 0,
                                        "data_path": "action_result.data.*.short_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.comments_and_work_notes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.time_worked",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_reject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reassignment_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_stc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.due_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_class_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.delivery_plan",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Description",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.rfc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.company",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assigned_to",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.user_input",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain.link",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resolved_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.calendar_duration",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.group_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.active",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.parent_incident",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_domain_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.closed_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Severity",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.severity",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.upon_approval",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.incident_state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.reopen_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.contact_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_end",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.work_notes_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.sys_created_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.location",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.correlation_display",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.close_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.assignment_group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.approval_set",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.order",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.urgency",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Priority",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.priority",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.hold_reason",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.business_service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_bytes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_width",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.content_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.image_height",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.table_sys_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.attachment_details.*.download_link",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_mod_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_created_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_by",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.sys_updated_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.size_compressed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.attachment_details.*.average_image_color",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.additional_assignee_list",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.attachment_added",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "ticketing"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "create ticket 3"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": false,
                        "connection_name": "block hash 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def create_ticket_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'create_ticket_2' call\n\n    file_reputation = phantom.collect2(datapath=['file_reputation_1:filtered-action_result.parameter.hash',                                                         \n                                                 'file_reputation_1:filtered-action_result.summary.positives'])\n    blocked_hashes = set(phantom.collect2(datapath='block_hash_2:action_result.parameter.hash'))\n    detected_users = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.username'))\n    detected_systems = set(phantom.collect2(datapath='hunt_file_1:action_result.data.*.process.results.*.hostname'))\n    \n    title = \"Virus Detected on {0} devices\".format(len(detected_systems))\n    \n    description =  \"Hashes sumbitted with detections:\\n{0}\\n\\n\".format(\", \".join([\"{0} ({1})\".format(*fr) for fr in file_reputation]))\n    description += \"File was found on {0} devices:\\n{1}\\n\\n\".format(len(detected_systems), ', '.join(detected_systems))\n    description += \"This impacts at least {0} users:\\n{1}\\n\\n\".format(len(detected_users), ', '.join(detected_users))\n    if len(blocked_hashes):\n        description += \"{0} hashes were submitted for blocking:\\n{1}\\n\\n\".format(len(blocked_hashes), \", \".join(blocked_hashes))\n\n    parameters = []\n    \n    # build parameters list for 'create_ticket_2' call\n    parameters.append({\n        'short_description': title,\n        'description': description,\n        'fields': \"\",\n    })\n\n    if parameters:\n        phantom.act(\"create ticket\", parameters=parameters, assets=['servicenow'], name=\"create_ticket_3\", parent_action=action)    \n    else:\n        phantom.error(\"'create_ticket_3' will not be executed due to lack of parameters\")\n    \n    return",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "72f13962-4d43-44be-9710-d2ed60cbbf00",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 341,
                        "line_start": 305,
                        "message": "Configuring now",
                        "name": "create ticket",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1220,
                            "y": 80
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "create_ticket_3",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2948
                    },
                    {
                        "action": "disable user",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "username": "hunt_file_2:action_result.data.*.process.results.*.username"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "username": "hunt_file_2:action_result.data.*.process.results.*.username"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "domainctrl1",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Username",
                                        "column_order": 0,
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.parameter.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "directory service"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "disable user"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def disable_user_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('disable_user_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'disable_user_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:action_result.data.*.process.results.*.username', 'hunt_file_2:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'disable_user_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'username': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"disable user\", parameters=parameters, assets=['domainctrl1'], callback=join_filter_2, name=\"disable_user_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "34bd4b5e-7b04-43a8-9fa7-dff28adb98dc",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 364,
                        "line_start": 341,
                        "message": "Configuring now",
                        "name": "disable user",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 480
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "disable_user_1",
                        "required_params": {
                            "username": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2949
                    },
                    {
                        "action": "block hash",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "comment": "",
                            "hash": "hunt_file_2:artifact:*.cef.fileHash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "comment": "",
                                    "hash": "hunt_file_2:artifact:*.cef.fileHash"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.comment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block hash 3"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_hash_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('block_hash_3() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_hash_3' call\n    inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_2:artifact:*.cef.fileHash', 'hunt_file_2:artifact:*.id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'block_hash_3' call\n    for inputs_item_1 in inputs_data_1:\n        if inputs_item_1[0]:\n            parameters.append({\n                'comment': \"\",\n                'hash': inputs_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': inputs_item_1[1]},\n            })\n\n    phantom.act(\"block hash\", parameters=parameters, assets=['carbonblack'], callback=join_filter_2, name=\"block_hash_3\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file 2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "4aa9e1f2-fc69-4439-ae54-3eb215adec8f",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 388,
                        "line_start": 364,
                        "message": "Configuring now",
                        "name": "block hash",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 340
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_hash_3",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2950
                    },
                    {
                        "action": "hunt file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash",
                            "range": "",
                            "type": "binary"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "hash": "filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash",
                                    "range": "",
                                    "type": "binary"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "carbon black query type"
                                        ],
                                        "data_path": "action_result.parameter.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.range",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.device_count",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.terms",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.total_results",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.parent_name.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_name.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.group.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.path_full.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.process_md5.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hostname.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.host_type.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.hour_of_day.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.start.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.day_of_week.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.facets.username_full.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.modload_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.sensor_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.process_md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_unique_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.cmdline",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.filemod_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "carbon black process id"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.last_update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.start",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.netconn_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "process name"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.process_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file path"
                                        ],
                                        "data_path": "action_result.data.*.process.results.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.regmod_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.parent_pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.crossproc_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.segment_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.host_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.childproc_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.results.*.unique_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.elapsed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.process.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.terms",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.total_results",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.ids",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.highlights.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.host_count.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.name",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.alliance_score_virustotal.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.hostname.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.group.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.file_version_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_result.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.company_name_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.product_name_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.server_added_timestamp.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.digsig_sign_time.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.ratio",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.percent",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.facets.observed_filename_facet.*.value",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.host_count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.observed_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Signed",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.binary.results.*.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_executable_image",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.orig_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.is_64bit",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.group",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.digsig_result_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.copied_mod_len",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.server_added_timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.endpoint",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.wid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.watchlists.*.value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.legal_copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.binary.results.*.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.cb_version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.os_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.file_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.results.*.last_seen",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.elapsed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.binary.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt file 1"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('hunt_file_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'hunt_file_1' call\n    filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.hash\", \"filtered-data:filter_1:condition_1:file_reputation_1:action_result.parameter.context.artifact_id\"])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_file_1' call\n    for filtered_results_item_1 in filtered_results_data_1:\n        if filtered_results_item_1[0]:\n            parameters.append({\n                'hash': filtered_results_item_1[0],\n                'range': \"\",\n                'type': \"binary\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"hunt file\", parameters=parameters, assets=['carbonblack'], callback=block_hash_2, name=\"hunt_file_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "file reputation",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0fe35225-af74-44fa-b1a4-433a9c00cadb",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 413,
                        "line_start": 388,
                        "message": "Configuring now",
                        "name": "hunt file",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 600,
                            "y": 80
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_file_1",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2955
                    },
                    {
                        "action": "block hash",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "comment": "",
                            "hash": "hunt_file_1:artifact:*.cef.fileHash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "comment": "",
                                    "hash": "hunt_file_1:artifact:*.cef.fileHash"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.comment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block hash 2"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_hash_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('block_hash_2() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_hash_2' call\n    inputs_data_1 = phantom.collect2(container=container, datapath=['hunt_file_1:artifact:*.cef.fileHash', 'hunt_file_1:artifact:*.id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'block_hash_2' call\n    for inputs_item_1 in inputs_data_1:\n        if inputs_item_1[0]:\n            parameters.append({\n                'comment': \"\",\n                'hash': inputs_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': inputs_item_1[1]},\n            })\n\n    phantom.act(\"block hash\", parameters=parameters, assets=['carbonblack'], callback=filter_3, name=\"block_hash_2\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "hunt file 1",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "f8ca6cc8-63fc-4ccf-b4cb-1a5ed1941c4d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 437,
                        "line_start": 413,
                        "message": "Configuring now",
                        "name": "block hash",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 840,
                            "y": 80
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_hash_2",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_delay": false,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2956
                    },
                    {
                        "action": "file reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "hash": "artifact:*.cef.fileHash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "file reputation",
                                "active": true,
                                "app_name": "VirusTotal",
                                "app_version": "1.2.40",
                                "asset_name": "virustotal",
                                "config_type": "asset",
                                "count": 0,
                                "fields": {
                                    "hash": "artifact:*.cef.fileHash"
                                },
                                "id": 142,
                                "loaded": false,
                                "missing": false,
                                "name": "virustotal",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.permalink",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.total",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.resource",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.response_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scan_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "virustotal scan id"
                                        ],
                                        "data_path": "action_result.data.*.scan_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.verbose_msg",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_scans",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.result",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.update",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.scans.*.detected",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_positives",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "parameters": {
                                    "hash": {
                                        "contains": [
                                            "hash",
                                            "sha256",
                                            "sha1",
                                            "md5"
                                        ],
                                        "data_type": "string",
                                        "default": null,
                                        "description": "File hash to query",
                                        "key": "hash",
                                        "order": 0,
                                        "primary": true,
                                        "required": true
                                    }
                                },
                                "product_name": "VirusTotal",
                                "product_vendor": "VirusTotal",
                                "targets": "34",
                                "type": ""
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "file reputation"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def file_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('file_reputation_1() called')\n\n    # collect data for 'file_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.fileHash', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'file_reputation_1' call\n    for container_item in container_data:\n        parameters.append({\n            'hash': container_item[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': container_item[1]},\n        })\n\n    phantom.act(\"file reputation\", parameters=parameters, assets=['virustotal'], callback=filter_1, name=\"file_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "3c5abd70-80e5-46b8-908e-4eeb0ae4cef5",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 189,
                        "line_start": 169,
                        "message": "Configuring now",
                        "name": "file reputation",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 220,
                            "y": 80
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "file_reputation_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "action_assets",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 2957
                    }
                ]
            },
            "notes": ""
        },
        "schema": 3,
        "version": "3.5.137"
    },
    "create_time": "2018-02-12T21:57:48.724935+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ]
}