c2_investigate_and_contain.json

{
    "blockly": false,
    "blockly_xml": "<xml></xml>",
    "category": "Samples",
    "misc": { "apps_list": ["SMTP", "WHOIS", "vSphere", "Palo Alto Networks Firewall", "Carbon Black Response", "Volatility", "Threatgrid", "Autofocus", "OpenDNS Investigate", "MaxMind"] },
    "coa": {
        "data": {
            "clean": true,
            "code_block": "import traceback\n\n\"\"\"\nThis playbook is deigned to perform the investigative and potential containment steps necessary to properly handle a command and control attack scenario.  It will extract file and connection information from a compromised VM, enrich the information, then take containment actions depending on the significance of the information.  Examples of significant information include files with threat scores greater than 70, IP addresses with reputation status of MALICIOUS, among other attributes.\n\"\"\"\n\ndef asset_configured(action):\n    assets = phantom.get_assets(action=action)\n    if assets:\n        return True\n    \n    return False\n\ndef escalate(container):\n    phantom.set_severity(container, \"high\")\n    \ndef deescalate(container):\n    phantom.set_severity(container, \"low\")\n    phantom.close(container)\n    \ndef deescalate_close_notify(container):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'deescalate_close_notify' call\n\n    container_id = container['id']\n    phantom.deescalate(container)\n    \n    parameters = []\n    \n    # build parameters list for 'deescalate_close_notify' call\n    parameters.append({\n        'from': \"\",\n        'to': \"root@localhost\",\n        'subject': \"Descalating and Closing Container ID: \" + container['id'],\n        'body': \"The c2 investigate and contain playbook on the Phantom platform has completed and will be closing the container.\" +\n                \"Information about the container is as follows: \\n Container ID: \" + container['id'] + \"\\nContainer Label: \" + container['label'] + \"\\nContainer Severity: \" + container['severity'],\n        'attachments': \"\",\n    })\n\n    if parameters:\n        phantom.act(\"send email\", parameters=parameters, assets=['smtp'], name=\"deescalate_close_notify\")    \n    else:\n        phantom.error(\"'deescalate_close_notify' will not be executed due to lack of parameters\")\n    \n    return\n\ndef escalate_close_notify(container):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'escalate_close_notify' call\n\n    parameters = []\n    \n    # build parameters list for 'escalate_close_notify' call\n    parameters.append({\n        'body': \"asdf\",\n        'to': \"root@localhost\",\n        'from': \"\",\n        'attachments': \"\",\n        'subject': \"Escalating and closing\",\n    })\n\n    if parameters:\n        phantom.act(\"send email\", parameters=parameters, assets=['smtp'], name=\"escalate_close_notify\")    \n    else:\n        phantom.error(\"'escalate_close_notify' will not be executed due to lack of parameters\")\n    \n    return",
            "description": "This playbook is designed to perform the investigative and potential containment steps necessary to properly handle a command and control attack scenario. It will extract file and connection information from a compromised VM, enrich the information, then take containment actions depending on the significance of the information. Examples of significant information include files with threat scores greater than 50, IP addresses with reputation status of MALICIOUS, among other attributes.",
            "hash": "f1b7fd430b7bdbe117e9a429c9cfedf66e7e3f1a",
            "joint": {
                "cells": [
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "3fb55a43-dfe5-4f6b-971d-c0a76e6f4ae1",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d89a525e-08c7-47b1-8cf3-2bc7c087494a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "15847615-45e8-402b-ace5-c06ed6f431be",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 15
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "983ba14b-332b-4c39-896d-5582869a6189",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d89a525e-08c7-47b1-8cf3-2bc7c087494a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a014a947-8730-4cfa-a6f9-da517ef1eaf8",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 25
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "86837019-423f-4839-8799-be5c40a637e5",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d89a525e-08c7-47b1-8cf3-2bc7c087494a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "95ecc4d5-0bbe-4456-a453-80684850319d",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 33
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "e126cdce-1418-4707-8519-70f5d21faf61",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d89a525e-08c7-47b1-8cf3-2bc7c087494a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "63c9a42c-bd3e-4efc-9e93-d504fd45fddd",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 44
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "1af683d8-2f2c-4829-84e4-cf89ec09a5f4",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "d89a525e-08c7-47b1-8cf3-2bc7c087494a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "548d3a1a-7508-4a4c-a1dd-cce0300c4098",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 75
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "21506b93-6385-4919-84e9-e1c82faf831c",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "548d3a1a-7508-4a4c-a1dd-cce0300c4098",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "bccde3ed-b14f-4edd-b693-596a2197e5fb",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 85
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "291a188b-4e29-4a79-a732-2906a9470dd0",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "bccde3ed-b14f-4edd-b693-596a2197e5fb",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "dc29d6a2-3a8f-4fb6-9cf0-3ed2650dd875",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 121
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "3d79a0c8-e63b-4964-ac08-44add4eb46ad",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "dc29d6a2-3a8f-4fb6-9cf0-3ed2650dd875",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e8c6c914-ae4a-498f-914b-40afbc10b112",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 139
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9c652128-ae31-427d-972c-d70ed207a90b",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "8af38680-f99a-4ccd-8ed8-a09e7b657111",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "0f9ad8b6-8af1-45e4-adf4-52349ed29478",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 271
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "1d685bc0-33c7-4a58-bd4c-338a517617c9",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "0f9ad8b6-8af1-45e4-adf4-52349ed29478",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "efba0a3c-2d01-445d-a9c0-dd2ab3435b67",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 326
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c2e6824b-4db5-4d18-a2af-15d99268e657",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "e927c052-d479-45a9-96c9-d19365da97b2",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "98747bd0-61f4-43ef-a404-ef84eb5628be",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 824
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "9d8e51b0-beaa-4473-9e1a-302bb1023f4f",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a014a947-8730-4cfa-a6f9-da517ef1eaf8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "911ffbff-1263-4049-a87d-492731c78f89",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 864
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "78e8a582-b8aa-403c-a37f-acc834ba0764",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "15847615-45e8-402b-ace5-c06ed6f431be",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "911ffbff-1263-4049-a87d-492731c78f89",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 913
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "a4b35c13-5f51-4088-8c63-15cc53a9ecfd",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "911ffbff-1263-4049-a87d-492731c78f89",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "75395809-5dfe-4c9f-9e94-1026334d75b6",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 988
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "cb6ddaec-f8e4-49b7-be6e-80a6980431b4",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "98747bd0-61f4-43ef-a404-ef84eb5628be",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "c5f0117e-d979-4794-a089-52a3fd4336ee",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 2270
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "b15d8d24-82ac-44d9-8fd3-2935b779d94a",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "a42e6d03-df9d-469d-8761-9bc198b470b8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "efba0a3c-2d01-445d-a9c0-dd2ab3435b67",
                            "port": "in",
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 3754
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "af509fe1-c348-4694-aa62-1449a70a6fc3",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "efba0a3c-2d01-445d-a9c0-dd2ab3435b67",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a42e6d03-df9d-469d-8761-9bc198b470b8",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 4141
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "34d176fb-93a8-4ebb-9132-86d78f97e2ad",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "efba0a3c-2d01-445d-a9c0-dd2ab3435b67",
                            "port": "out-3",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "444a63ef-a64f-4673-a02a-4ed0ccb9ef43",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 4155
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "f2ada9e8-dcd5-457a-b99b-bbbd1705c31a",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "75395809-5dfe-4c9f-9e94-1026334d75b6",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "20854de8-8185-437d-9381-3039ec17ba35",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 4268
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "179c9f52-0cdf-49b0-8cfa-abf98a8971d5",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "911ffbff-1263-4049-a87d-492731c78f89",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "a2ef55d8-1b63-483f-afdd-360de01b3012",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 4596
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "452bf12f-70bd-4cd4-abe7-e5d0f11aa276",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "e8c6c914-ae4a-498f-914b-40afbc10b112",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "2b26302d-4fcb-4e08-8c28-bd0eaa1dd7c5",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 4694
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c996b5ff-e3dd-4b34-8d8a-40c3f8ef82cb",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2b26302d-4fcb-4e08-8c28-bd0eaa1dd7c5",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "8af38680-f99a-4ccd-8ed8-a09e7b657111",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 4733
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            },
                            ".tool-remove": {
                                "position": 0.5
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "89cf5706-c1b7-4f2c-8a07-b0eb5b1e0806",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "2b26302d-4fcb-4e08-8c28-bd0eaa1dd7c5",
                            "port": "out-3",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(3) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "541f87f3-8ed5-4ae6-b6d5-e9f483a4356b",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 4767
                    },
                    {
                        "action": "whois ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "whois",
                                "output": [
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Asn",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.asn",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Asn Cidr",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.asn_cidr",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Asn Country Code",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.asn_country_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Asn Date",
                                        "column_order": 5,
                                        "data_path": "action_result.data.*.asn_date",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Asn Registry",
                                        "column_order": 6,
                                        "data_path": "action_result.data.*.asn_registry",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Abuse Emails",
                                        "column_order": 7,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.nets.*.abuse_emails",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Address",
                                        "column_order": 8,
                                        "data_path": "action_result.data.*.nets.*.address",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Cidr",
                                        "column_order": 9,
                                        "data_path": "action_result.data.*.nets.*.cidr",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "City",
                                        "column_order": 10,
                                        "data_path": "action_result.data.*.nets.*.city",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Country",
                                        "column_order": 11,
                                        "data_path": "action_result.data.*.nets.*.country",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Created",
                                        "column_order": 12,
                                        "data_path": "action_result.data.*.nets.*.created",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Description",
                                        "column_order": 13,
                                        "data_path": "action_result.data.*.nets.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_order": 7,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.nets.*.emails",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.nets.*.handle",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 14,
                                        "data_path": "action_result.data.*.nets.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Postal Code",
                                        "column_order": 15,
                                        "data_path": "action_result.data.*.nets.*.postal_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Range",
                                        "column_order": 16,
                                        "data_path": "action_result.data.*.nets.*.range",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "State",
                                        "column_order": 17,
                                        "data_path": "action_result.data.*.nets.*.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Tech Emails",
                                        "column_order": 18,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.nets.*.tech_emails",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Updated",
                                        "column_order": 19,
                                        "data_path": "action_result.data.*.nets.*.updated",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.query",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Misc Emails",
                                        "column_order": 20,
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.data.*.nets.*.misc_emails",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.asn",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.country_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.nets.*.address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.nets.*.range",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.registry",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "whois ip"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def whois_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('whois_ip_1() called')\n\n    # collect data for 'whois_ip_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'whois_ip_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"whois ip\", parameters=parameters, assets=['whois'], name=\"whois_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "63c9a42c-bd3e-4efc-9e93-d504fd45fddd",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 128,
                        "line_start": 107,
                        "message": "Configuring now",
                        "name": "whois ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 200,
                            "y": 720
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "whois_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 4898
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "30c16b0d-3d68-47e3-88e9-7e238527bc90",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "efba0a3c-2d01-445d-a9c0-dd2ab3435b67",
                            "port": "out-2",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(2) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "3690f15d-1482-4eb0-85c9-9a756cf88149",
                            "selector": ".port-body[type=\"input\"]"
                        },
                        "type": "link",
                        "z": 5397
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "67b94b38-b8ca-475b-87c2-9b2e0028e330",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "3690f15d-1482-4eb0-85c9-9a756cf88149",
                            "port": "out-1",
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "e927c052-d479-45a9-96c9-d19365da97b2",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 5413
                    },
                    {
                        "action": "geolocate ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "maxmind",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.continent_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.country_iso_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.country_name",
                                        "data_type": "string",
                                        "map_info": "Country"
                                    },
                                    {
                                        "data_path": "action_result.data.*.latitude",
                                        "data_type": "numeric",
                                        "map_info": "latitude"
                                    },
                                    {
                                        "data_path": "action_result.data.*.longitude",
                                        "data_type": "numeric",
                                        "map_info": "longitude"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "map_info": "IP Address"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string",
                                        "map_info": "name"
                                    },
                                    {
                                        "data_path": "action_result.data.*.city_name",
                                        "data_type": "string",
                                        "map_info": "City"
                                    },
                                    {
                                        "data_path": "action_result.data.*.postal_code",
                                        "data_type": "string",
                                        "map_info": "Postal Code"
                                    },
                                    {
                                        "data_path": "action_result.data.*.as_org",
                                        "data_type": "string",
                                        "map_info": "Organization"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state_iso_code",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.state_name",
                                        "data_type": "string",
                                        "map_info": "State/Province"
                                    },
                                    {
                                        "data_path": "action_result.data.*.time_zone",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "information"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "geolocate ip"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def geolocate_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('geolocate_ip_1() called')\n\n    # collect data for 'geolocate_ip_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'geolocate_ip_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"geolocate ip\", parameters=parameters, assets=['maxmind'], callback=join_filter_4, name=\"geolocate_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "15847615-45e8-402b-ace5-c06ed6f431be",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 149,
                        "line_start": 128,
                        "message": "Configuring now",
                        "name": "geolocate ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 200,
                            "y": 580
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "geolocate_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5456
                    },
                    {
                        "0": "S",
                        "1": "T",
                        "2": "A",
                        "3": "R",
                        "4": "T",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "ref-x": 33,
                                "text": "START"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "ref-x": 13,
                                "xlink:href": "/inc/coa/img/block_icon_start.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_start(container):\n    phantom.debug('on_start() called')\n    \n    # call 'geolocate_ip_1' block\n    geolocate_ip_1(container=container)\n\n    # call 'ip_reputation_1' block\n    ip_reputation_1(container=container)\n\n    # call 'hunt_ip_1' block\n    hunt_ip_1(container=container)\n\n    # call 'whois_ip_1' block\n    whois_ip_1(container=container)\n\n    # call 'list_vms_1' block\n    list_vms_1(container=container)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "d89a525e-08c7-47b1-8cf3-2bc7c087494a",
                        "inPorts": [],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 107,
                        "line_start": 87,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 60,
                            "y": 180
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "START",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 5461
                    },
                    {
                        "action": "create alert",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {},
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [],
                        "attrs": {
                            ".action": {
                                "text": "deescalate close 3"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": false,
                        "connection_name": "find malware",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def deescalate_close_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n\n    deescalate_close_notify(container)\n    \n    return",
                        "custom_join": "",
                        "custom_name": "deescalate close 3",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "541f87f3-8ed5-4ae6-b6d5-e9f483a4356b",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 157,
                        "line_start": 149,
                        "message": "Configuring now",
                        "name": "create alert",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1200,
                            "y": 20
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "deescalate_close_3",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5531
                    },
                    {
                        "action": "send email",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attachments": "",
                            "body": "adsf",
                            "from": "",
                            "subject": "Deescalating and closing",
                            "to": "root@localhost"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "attachments": "",
                                    "body": "adsf",
                                    "from": "",
                                    "subject": "Deescalating and closing",
                                    "to": "root@localhost"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "smtp",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.body",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.to",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.attachments",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "email"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "deescalate_close_con..."
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": false,
                        "connection_name": "ip reputation, geolocate ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def deescalate_close_container(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    deescalate_close_notify(container)\n    \n    return",
                        "custom_join": "",
                        "custom_name": "deescalate_close_container",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a2ef55d8-1b63-483f-afdd-360de01b3012",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 165,
                        "line_start": 157,
                        "message": "Configuring now",
                        "name": "send email",
                        "notes": "",
                        "number": 5,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 580,
                            "y": 580
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "deescalate_close_container",
                        "required_params": {
                            "body": true,
                            "to": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5540
                    },
                    {
                        "action": "terminate process",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip_hostname": "snapshot_vm_1:action_result.data.*.host",
                            "pid": "find_malware_1:action_result.data.*.pid",
                            "sensor_id": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip_hostname": "snapshot_vm_1:action_result.data.*.host",
                                    "pid": "find_malware_1:action_result.data.*.pid",
                                    "sensor_id": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.object",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "user name"
                                        ],
                                        "data_path": "action_result.data.*.username",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "sensor id",
                                        "column_order": 0,
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.data.*.sensor_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.completion",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.session_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.create_time",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.result_code",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.result_desc",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.result_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "HostName/IP",
                                        "column_order": 1,
                                        "contains": [
                                            "ip",
                                            "host name"
                                        ],
                                        "data_path": "action_result.parameter.ip_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "carbon black sensor id"
                                        ],
                                        "data_path": "action_result.parameter.sensor_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "PID",
                                        "column_order": 2,
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.parameter.pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "terminate process"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def terminate_process_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('terminate_process_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'terminate_process_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['find_malware_1:action_result.data.*.pid', 'find_malware_1:action_result.parameter.context.artifact_id'], action_results=results)\n    results_data_2 = phantom.collect2(container=container, datapath=['snapshot_vm_1:action_result.data.*.host', 'snapshot_vm_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'terminate_process_1' call\n    for results_item_1 in results_data_1:\n        for results_item_2 in results_data_2:\n            if results_item_1[0]:\n                parameters.append({\n                    'sensor_id': \"\",\n                    'pid': results_item_1[0],\n                    'ip_hostname': results_item_2[0],\n                    # context (artifact id) is added to associate results with the artifact\n                    'context': {'artifact_id': results_item_1[1]},\n                })\n\n    phantom.act(\"terminate process\", parameters=parameters, assets=['carbonblack'], callback=escalate_close_container2, name=\"terminate_process_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": false,
                        "connection_name": "block hash",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "98747bd0-61f4-43ef-a404-ef84eb5628be",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 192,
                        "line_start": 165,
                        "message": "Configuring now",
                        "name": "terminate process",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 2140,
                            "y": 360
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "terminate_process_1",
                        "required_params": {
                            "pid": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5608
                    },
                    {
                        "action": "create alert",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {},
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [],
                        "attrs": {
                            ".action": {
                                "text": "deescalate_close_con..."
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": false,
                        "connection_name": "detonate file, get report",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def deescalate_close_container1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n\n    deescalate_close_notify(container)\n    \n    return",
                        "custom_join": "",
                        "custom_name": "deescalate_close_container1",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "444a63ef-a64f-4673-a02a-4ed0ccb9ef43",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 200,
                        "line_start": 192,
                        "message": "Configuring now",
                        "name": "create alert",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1820,
                            "y": 20
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "deescalate_close_container1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5611
                    },
                    {
                        "action": "create alert",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {},
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [],
                        "attrs": {
                            ".action": {
                                "text": "escalate_close_conta..."
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": false,
                        "connection_name": "block ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def escalate_close_container_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n\n    escalate_close_notify(container)\n    \n    return",
                        "custom_join": "",
                        "custom_name": "escalate_close_container_2",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "20854de8-8185-437d-9381-3039ec17ba35",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 208,
                        "line_start": 200,
                        "message": "Configuring now",
                        "name": "create alert",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 820,
                            "y": 440
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "escalate_close_container_2",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5616
                    },
                    {
                        "0": "E",
                        "1": "N",
                        "2": "D",
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".title": {
                                "text": "END"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_end.svg"
                            },
                            "g.notes": {
                                "display": "block"
                            }
                        },
                        "block_code": "def on_finish(container, summary):\n    phantom.debug('on_finish() called')\n    # This function is called after all actions are completed.\n    # summary of all the action and/or all detals of actions \n    # can be collected here.\n\n    # summary_json = phantom.get_summary()\n    # if 'result' in summary_json:\n        # for action_result in summary_json['result']:\n            # if 'action_run_id' in action_result:\n                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n                # phantom.debug(action_results)\n\n    return",
                        "callback_code": "# read-only block view not available",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "escalate_close_container2",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "45790328-0c92-47b4-8ab9-3a1513a6f67a",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "# read-only block view not available",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 639,
                        "line_start": 626,
                        "name": "",
                        "notes": "",
                        "number": 0,
                        "outPorts": [],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 2620,
                            "y": 380
                        },
                        "previous_function": "",
                        "previous_name": "",
                        "show_number": true,
                        "size": {
                            "height": 54,
                            "width": 80
                        },
                        "status": "",
                        "title": "END",
                        "type": "coa.StartEnd",
                        "warn": false,
                        "z": 5620
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 1
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 0.7
                            }
                        },
                        "block_code": "def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_1() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"list_vms_1:action_result.data.*.ip\", \"==\", \"artifact:*.cef.sourceAddress\"],\n            [\"list_vms_1:action_result.data.*.state\", \"==\", \"running\"],\n        ],\n        logical_operator='and',\n        name=\"filter_1:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        snapshot_vm_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "list vms",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "bccde3ed-b14f-4edd-b693-596a2197e5fb",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 228,
                        "line_start": 208,
                        "name": "filter",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "list_vms_1:action_result.data.*.ip",
                                        "value": "artifact:*.cef.sourceAddress"
                                    },
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "list_vms_1:action_result.data.*.state",
                                        "value": "running"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 440,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_1",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 5628
                    },
                    {
                        "action": "list vms",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {},
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {},
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "vmwarevsphere",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Host Name",
                                        "column_order": 0,
                                        "contains": [
                                            "host name"
                                        ],
                                        "data_path": "action_result.data.*.vm_hostname",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "OS",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.vm_full_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Ip",
                                        "column_order": 2,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.vm_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "State",
                                        "column_order": 4,
                                        "data_path": "action_result.data.*.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "VM",
                                        "column_order": 5,
                                        "contains": [
                                            "vm"
                                        ],
                                        "data_path": "action_result.data.*.vmx_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_vms",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.running_vms",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "virtualization"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "list vms"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def list_vms_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('list_vms_1() called')\n\n    parameters = []\n\n    phantom.act(\"list vms\", parameters=parameters, assets=['vmwarevsphere'], callback=filter_1, name=\"list_vms_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "548d3a1a-7508-4a4c-a1dd-cce0300c4098",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 237,
                        "line_start": 228,
                        "message": "Configuring now",
                        "name": "list vms",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 200,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "list_vms_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5630
                    },
                    {
                        "action": "find malware",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "profile": "",
                            "vault_id": "snapshot_vm_1:action_result.data.*.vault_id"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "profile": "",
                                    "vault_id": "snapshot_vm_1:action_result.data.*.vault_id"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "volatility",
                                "output": [
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.data.*.process",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.protection",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.flags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.vad_tag",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.buffer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.disassembly",
                                        "data_type": "string"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "forensic"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "find malware"
                            },
                            ".background": {
                                "stroke": "#E6984E"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 1
                            },
                            "g.error image": {
                                "xlink:href": "/inc/coa/img/block_icon_warn.svg"
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def find_malware_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('find_malware_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'find_malware_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['snapshot_vm_1:action_result.data.*.vault_id', 'snapshot_vm_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'find_malware_1' call\n    for results_item_1 in results_data_1:\n        parameters.append({\n            'profile': \"\",\n            'vault_id': results_item_1[0],\n            # context (artifact id) is added to associate results with the artifact\n            'context': {'artifact_id': results_item_1[1]},\n        })\n\n    phantom.act(\"find malware\", parameters=parameters, assets=['volatility'], callback=filter_5, name=\"find_malware_1\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "snapshot vm",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "e8c6c914-ae4a-498f-914b-40afbc10b112",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 260,
                        "line_start": 237,
                        "message": "Configuring now",
                        "name": "find malware",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 820,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "find_malware_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "warn",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5631
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 6
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "g.notes image": {
                                "xlink:href": "/inc/coa/img/block_icon_note_on.svg"
                            }
                        },
                        "block_code": "def filter_6(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_6() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"filtered-data:filter_2:condition_2:detonate_file_3:action_result.data.*.report.disk.mbr.hashes.orig.md5\", \"==\", \"artifact:*.cef.fileHash\"],\n        ],\n        name=\"filter_6:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        block_hash_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "detonate file, get report",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "3690f15d-1482-4eb0-85c9-9a756cf88149",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 278,
                        "line_start": 260,
                        "name": "filter",
                        "notes": "Filter the artifact that matches the hash from the ip.",
                        "number": 6,
                        "outPorts": [
                            "out-1"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "filtered-data:filter_2:condition_2:detonate_file_3:action_result.data.*.report.disk.mbr.hashes.orig.md5",
                                        "value": "artifact:*.cef.fileHash"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1760,
                            "y": 360
                        },
                        "previous_function": "",
                        "previous_name": "filter_6",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 5640
                    },
                    {
                        "action": "block hash",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "comment": "",
                            "hash": "filtered-artifact:*.cef.fileHash"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "comment": "",
                                    "hash": "filtered-artifact:*.cef.fileHash"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "carbonblack",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 1,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "md5",
                                            "hash"
                                        ],
                                        "data_path": "action_result.parameter.hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.comment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block hash"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_hash_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('block_hash_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_hash_1' call\n    passed_filtered_artifact_data = phantom.collect2(container=container, datapath=['filtered-artifact:*.cef.fileHash', 'filtered-artifact:*.id'], filter_artifacts=filtered_artifacts)\n\n    parameters = []\n    \n    # build parameters list for 'block_hash_1' call\n    for passed_filtered_artifact_item in passed_filtered_artifact_data:\n        parameters.append({\n            'comment': \"\",\n            'hash': passed_filtered_artifact_item[0],\n        })\n\n    phantom.act(\"block hash\", parameters=parameters, assets=['carbonblack'], callback=terminate_process_1, name=\"block_hash_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "detonate file, get report",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "e927c052-d479-45a9-96c9-d19365da97b2",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 299,
                        "line_start": 278,
                        "message": "Configuring now",
                        "name": "block hash",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1900,
                            "y": 360
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_hash_1",
                        "required_params": {
                            "hash": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5641
                    },
                    {
                        "action": "send email",
                        "action_type": "generic",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "attachments": "",
                            "body": "asdf",
                            "from": "",
                            "subject": "Escalating and closing",
                            "to": "root@localhost"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "attachments": "",
                                    "body": "asdf",
                                    "from": "",
                                    "subject": "Escalating and closing",
                                    "to": "root@localhost"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "smtp",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.body",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.to",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "email"
                                        ],
                                        "data_path": "action_result.parameter.from",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vault id"
                                        ],
                                        "data_path": "action_result.parameter.attachments",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.subject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "email"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "escalate_close_conta..."
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Utilities"
                            },
                            "g.code image": {
                                "xlink:href": "/inc/coa/img/block_icon_code_on.svg"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_generic.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "# read-only block view not available",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#5094D4",
                        "connected_to_start": true,
                        "connection_name": "terminate process",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "def escalate_close_container2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    escalate_close_notify(container)\n\n    return",
                        "custom_join": "",
                        "custom_name": "escalate_close_container2",
                        "delay": "0",
                        "description": "",
                        "has_custom": true,
                        "has_custom_block": true,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "c5f0117e-d979-4794-a089-52a3fd4336ee",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 307,
                        "line_start": 299,
                        "message": "Configuring now",
                        "name": "send email",
                        "notes": "",
                        "number": 4,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 2380,
                            "y": 360
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "escalate_close_container2",
                        "required_params": {
                            "body": true,
                            "to": true
                        },
                        "reviewer": "",
                        "showNumber": true,
                        "show_number": true,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Utilities",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5642
                    },
                    {
                        "attrs": {
                            ".connection": {
                                "stroke": "#6C7A89",
                                "stroke-width": 2
                            },
                            ".marker-target": {
                                "d": "M 10 0 L 0 5 L 10 10 z",
                                "fill": "#6a6c8a",
                                "stroke": "#6a6c8a"
                            }
                        },
                        "connector": {
                            "args": {
                                "radius": 5
                            },
                            "name": "rounded"
                        },
                        "endDirections": [
                            "left"
                        ],
                        "id": "c8eda14f-d391-4c8a-9e97-8081f9daf486",
                        "router": {
                            "name": "metro"
                        },
                        "source": {
                            "id": "c5f0117e-d979-4794-a089-52a3fd4336ee",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(2) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "startDirections": [
                            "right"
                        ],
                        "target": {
                            "id": "45790328-0c92-47b4-8ab9-3a1513a6f67a",
                            "port": null,
                            "selector": "g:nth-child(1) > g:nth-child(1) > g:nth-child(1) > circle:nth-child(1)"
                        },
                        "type": "link",
                        "z": 5643
                    },
                    {
                        "action": "hunt ip",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.destinationAddress",
                            "scope": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress",
                                    "scope": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "autofocus",
                                "output": [
                                    {
                                        "column_name": "Public Tag Name",
                                        "column_order": 0,
                                        "contains": [
                                            "autofocus tag"
                                        ],
                                        "data_path": "action_result.data.*.public_tag_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Tag Name",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.tag_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Count",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Description",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.scope",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_tags_matched",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "endpoint"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "hunt ip"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def hunt_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('hunt_ip_1() called')\n\n    # collect data for 'hunt_ip_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'hunt_ip_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                'scope': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"hunt ip\", parameters=parameters, assets=['autofocus'], name=\"hunt_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "95ecc4d5-0bbe-4456-a453-80684850319d",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 329,
                        "line_start": 307,
                        "message": "Configuring now",
                        "name": "hunt ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 200,
                            "y": 300
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "hunt_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5644
                    },
                    {
                        "action": "ip reputation",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "ip": "artifact:*.cef.destinationAddress"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "opendns_investigate",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Blocked Domain",
                                        "column_order": 0,
                                        "contains": [
                                            "domain"
                                        ],
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Domain ID",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.summary.total_blocked_domains",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.summary.ip_status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "reputation"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "ip reputation"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def ip_reputation_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('ip_reputation_1() called')\n\n    # collect data for 'ip_reputation_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'ip_reputation_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'ip': container_item[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"ip reputation\", parameters=parameters, assets=['opendns_investigate'], callback=join_filter_4, name=\"ip_reputation_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "",
                        "connection_type": "",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a014a947-8730-4cfa-a6f9-da517ef1eaf8",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 350,
                        "line_start": 329,
                        "message": "Configuring now",
                        "name": "ip reputation",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 200,
                            "y": 440
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "ip_reputation_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5645
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 4
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_4() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation_1:action_result.summary.ip_status\", \"==\", \"MALICIOUS\"],\n            [\"geolocate_ip_1:action_result.data.*.country_iso_code\", \"!=\", \"US\"],\n        ],\n        logical_operator='or',\n        name=\"filter_4:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        block_ip_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"ip_reputation_1:action_result.summary.ip_status\", \"!=\", \"MALICIOUS\"],\n            [\"geolocate_ip_1:action_result.data.*.country_iso_code\", \"==\", \"US\"],\n        ],\n        logical_operator='and',\n        name=\"filter_4:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        deescalate_close_container(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "ip reputation, geolocate ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "911ffbff-1263-4049-a87d-492731c78f89",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_filter_4(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('join_filter_4() called')\n\n    # check if all connected incoming actions are done i.e. have succeeded or failed\n    if phantom.actions_done([ 'ip_reputation_1', 'geolocate_ip_1' ]):\n        \n        # call connected block \"filter_4\"\n        filter_4(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 385,
                        "line_end": 396,
                        "line_start": 350,
                        "name": "filter",
                        "notes": "",
                        "number": 4,
                        "outPorts": [
                            "out-1",
                            "out-2"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "ip_reputation_1:action_result.summary.ip_status",
                                        "value": "MALICIOUS"
                                    },
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "geolocate_ip_1:action_result.data.*.country_iso_code",
                                        "value": "US"
                                    }
                                ],
                                "display": "If",
                                "logic": "or",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "ip_reputation_1:action_result.summary.ip_status",
                                        "value": "MALICIOUS"
                                    },
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "geolocate_ip_1:action_result.data.*.country_iso_code",
                                        "value": "US"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 440,
                            "y": 440
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_4",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 5646
                    },
                    {
                        "action": "block ip",
                        "action_type": "contain",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "device_group": "",
                            "ip": "artifact:*.cef.destinationAddress",
                            "policy_name": "",
                            "policy_type": "",
                            "vsys": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "ip": "artifact:*.cef.destinationAddress",
                                    "is_source_address": "",
                                    "vsys": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "pan",
                                "output": [
                                    {
                                        "column_name": "IP",
                                        "column_order": 0,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.parameter.ip",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vsys",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.is_source_address",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "column_name": "Status",
                                        "column_order": 1,
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Message",
                                        "column_order": 2,
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "firewall"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "block ip"
                            },
                            ".border": {
                                "height": 88
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Contain"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_contain.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def block_ip_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('block_ip_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'block_ip_1' call\n    container_data = phantom.collect2(container=container, datapath=['artifact:*.cef.destinationAddress', 'artifact:*.id'])\n\n    parameters = []\n    \n    # build parameters list for 'block_ip_1' call\n    for container_item in container_data:\n        if container_item[0]:\n            parameters.append({\n                'is_source_address': \"\",\n                'ip': container_item[0],\n                'vsys': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': container_item[1]},\n            })\n\n    phantom.act(\"block ip\", parameters=parameters, assets=['pan'], callback=escalate_close_container_2, name=\"block_ip_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#3D9959",
                        "connected_to_start": true,
                        "connection_name": "ip reputation, geolocate ip",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "75395809-5dfe-4c9f-9e94-1026334d75b6",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 421,
                        "line_start": 396,
                        "message": "Configuring now",
                        "name": "block ip",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 580,
                            "y": 440
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "block_ip_1",
                        "required_params": {
                            "ip": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Contain",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5647
                    },
                    {
                        "action": "snapshot vm",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "download": "",
                            "vmx_path": "list_vms_1:filtered-action_result.data.*.vmx_path"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "download": "",
                                    "vmx_path": "list_vms_1:filtered-action_result.data.*.vmx_path"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "vmwarevsphere",
                                "output": [
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.download",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "vm"
                                        ],
                                        "data_path": "action_result.parameter.vmx_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Vault ID",
                                        "column_order": 0,
                                        "contains": [
                                            "vault id",
                                            "os memory dump",
                                            "vm snapshot file"
                                        ],
                                        "data_path": "action_result.data.*.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "vSphere Server",
                                        "column_order": 1,
                                        "contains": [
                                            "ip"
                                        ],
                                        "data_path": "action_result.data.*.host",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "File name",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Snapshot size",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "vm"
                                        ],
                                        "data_path": "action_result.data.*.vmx_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "virtualization"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "snapshot vm"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def snapshot_vm_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('snapshot_vm_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'snapshot_vm_1' call\n    passed_filtered_results_data_1 = phantom.collect2(container=container, datapath=[\"list_vms_1:filtered-action_result.data.*.vmx_path\", \"list_vms_1:filtered-action_result.parameter.context.artifact_id\"], action_results=filtered_results)\n\n    parameters = []\n    \n    # build parameters list for 'snapshot_vm_1' call\n    for passed_filtered_results_item_1 in passed_filtered_results_data_1:\n        if passed_filtered_results_item_1[0]:\n            parameters.append({\n                'download': \"\",\n                'vmx_path': passed_filtered_results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': passed_filtered_results_item_1[1]},\n            })\n\n    phantom.act(\"snapshot vm\", parameters=parameters, assets=['vmwarevsphere'], callback=find_malware_1, name=\"snapshot_vm_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "list vms",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "dc29d6a2-3a8f-4fb6-9cf0-3ed2650dd875",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 445,
                        "line_start": 421,
                        "message": "Configuring now",
                        "name": "snapshot vm",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 580,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "snapshot_vm_1",
                        "required_params": {
                            "vmx_path": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5648
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 5
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-2": {
                                "port": {
                                    "id": "out-3",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": -2
                            },
                            ".outPorts>.port-2>.port-body": {
                                "port": {
                                    "id": "out-3",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            }
                        },
                        "block_code": "def filter_5(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_5() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"find_malware_1:action_result.summary.possibly_mal_instances\", \">\", 0],\n        ],\n        name=\"filter_5:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        get_process_file_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"find_malware_1:action_result.summary.possibly_mal_instances\", \"<\", 0],\n        ],\n        name=\"filter_5:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        pass\n\n    # collect filtered artifact ids for 'if' condition 3\n    matched_artifacts_3, matched_results_3 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"find_malware_1:action_result.summary.possibly_mal_instances\", \"==\", 0],\n        ],\n        name=\"filter_5:condition_3\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_3 or matched_results_3:\n        deescalate_close_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_3, filtered_results=matched_results_3)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "find malware",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "2b26302d-4fcb-4e08-8c28-bd0eaa1dd7c5",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 489,
                        "line_start": 445,
                        "name": "filter",
                        "notes": "",
                        "number": 5,
                        "outPorts": [
                            "out-1",
                            "out-2",
                            "out-3"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "find_malware_1:action_result.summary.possibly_mal_instances",
                                        "value": "0"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "<",
                                        "data_type": "",
                                        "param": "find_malware_1:action_result.summary.possibly_mal_instances",
                                        "value": "0"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "find_malware_1:action_result.summary.possibly_mal_instances",
                                        "value": "0"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1060,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_5",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 5649
                    },
                    {
                        "action": "get process file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "pid": "find_malware_1:action_result.data.*.pid",
                            "profile": "snapshot_vm_1:action_result.summary.vol_profile_used",
                            "vault_id": "snapshot_vm_1:action_result.data.*.vault_id"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "pid": "find_malware_1:action_result.data.*.pid",
                                    "profile": "snapshot_vm_1:action_result.summary.vol_profile_used",
                                    "vault_id": "snapshot_vm_1:action_result.data.*.vault_id"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "volatility",
                                "output": [
                                    {
                                        "column_name": "Process Image Hash",
                                        "column_order": 0,
                                        "contains": [
                                            "hash",
                                            "pe file"
                                        ],
                                        "data_path": "action_result.data.*.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Name",
                                        "column_order": 1,
                                        "data_path": "action_result.data.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "column_name": "Size",
                                        "column_order": 2,
                                        "data_path": "action_result.data.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "column_name": "Type",
                                        "column_order": 3,
                                        "data_path": "action_result.data.*.type",
                                        "data_type": "string"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "forensic"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get process file"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_process_file_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('get_process_file_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_process_file_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['snapshot_vm_1:action_result.summary.vol_profile_used', 'snapshot_vm_1:action_result.data.*.vault_id', 'snapshot_vm_1:action_result.parameter.context.artifact_id'], action_results=results)\n    results_data_2 = phantom.collect2(container=container, datapath=['find_malware_1:action_result.data.*.pid', 'find_malware_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'get_process_file_1' call\n    for results_item_1 in results_data_1:\n        for results_item_2 in results_data_2:\n            parameters.append({\n                'profile': results_item_1[0],\n                'vault_id': results_item_1[1],\n                'pid': results_item_2[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[2]},\n            })\n\n    phantom.act(\"get process file\", parameters=parameters, assets=['volatility'], callback=detonate_file_3, name=\"get_process_file_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "find malware",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "8af38680-f99a-4ccd-8ed8-a09e7b657111",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 515,
                        "line_start": 489,
                        "message": "Configuring now",
                        "name": "get process file",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1200,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_process_file_1",
                        "required_params": {},
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5650
                    },
                    {
                        "action": "detonate file",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "file_name": "",
                            "force_analysis": "",
                            "private": "",
                            "vault_id": "get_process_file_1:action_result.data.*.vault_id",
                            "vm": ""
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "file_name": "",
                                    "force_analysis": "",
                                    "private": "",
                                    "vault_id": "get_process_file_1:action_result.data.*.vault_id",
                                    "vm": ""
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "threatgrid",
                                "output": [
                                    {
                                        "contains": [
                                            "threatgrid task id"
                                        ],
                                        "data_path": "action_result.summary.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.summary.results_url",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.summary.target",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.changed",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.contents.curr",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.contents.orig",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.type",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.type",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.changed",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.ioc",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.URL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.Method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.Network_Stream",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.hits",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.truncated",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.status.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.status.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.origin",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.status.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.status.done_url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.running_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.vm_runtime",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.analysis_started_at",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.analysis_submitted_at",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.new",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.kpid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.proc",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.monitored",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.process_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.tid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.upid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.uthread",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.dll_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.shell_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.command_line",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.desktop_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.runtime_data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.window_title",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.image_pathname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.current_directory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.analyzed_because",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.access",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.options",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.dst",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.src",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.uid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.ts_end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.session",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.report.network.*.dst_port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.duration",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.report.network.*.src_port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.ts_begin",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.transport",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_orig",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_resp",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.conn_state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_missed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets_orig",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets_resp",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_orig_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_resp_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.magic",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.run_time",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.current_os",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.sandcastle",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.controlsubject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.sample_executed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.sandbox_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.report_created",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.sandbox_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.js",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.pe",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.ini",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.lnk",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.pdf",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.rtf",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.txt",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.html",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.network.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.created-time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.entropy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.exports",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.original_file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.header_relocations",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_code_segment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_instruction_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_segment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.pages",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.size_in_paragraphs",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.import_hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.number_of_symbols",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.actual_checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.claimed_checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.entrypoint_address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.file_alignment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_major_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_minor_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.loader_flag",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.number_of_rva_and_sizes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.reserved_field",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.section_alignment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.subsystem",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.dll",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.entries",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.internal_checksum_match",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.codepage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.language",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.locale",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.offset",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.resource_sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.sublanguage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.characteristics",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.data_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.Sections.InternetShortcut.Properties.URL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section_hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.virtual_size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.signatures",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.tag_attrs",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.urls",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.magic-type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.mime-type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.origin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.relation.network",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.relation.process",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.annotations.network.*.ts",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.os",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.status.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.status.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.login",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.status.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.started_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.completed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.submitted_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.submission_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.bis",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.sample",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.max-severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.max-confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.parameter.file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.force_analysis",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "vault id",
                                            "pe file",
                                            "pdf"
                                        ],
                                        "data_path": "action_result.parameter.vault_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.parameter.private",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "sandbox"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "detonate file"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def detonate_file_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('detonate_file_3() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'detonate_file_3' call\n    results_data_1 = phantom.collect2(container=container, datapath=['get_process_file_1:action_result.data.*.vault_id', 'get_process_file_1:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'detonate_file_3' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'file_name': \"\",\n                'vault_id': results_item_1[0],\n                'force_analysis': \"\",\n                'vm': \"\",\n                'private': \"\",\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n\n    phantom.act(\"detonate file\", parameters=parameters, assets=['threatgrid'], callback=join_filter_2, name=\"detonate_file_3\", parent_action=action)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "get process file",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "0",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "0f9ad8b6-8af1-45e4-adf4-52349ed29478",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 542,
                        "line_start": 515,
                        "message": "Configuring now",
                        "name": "detonate file",
                        "notes": "",
                        "number": 3,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1440,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "detonate_file_3",
                        "required_params": {
                            "vault_id": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5651
                    },
                    {
                        "active": false,
                        "angle": 0,
                        "attrs": {
                            ".background": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".border": {
                                "transform": "rotate(45 30 70)"
                            },
                            ".inPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".number": {
                                "text": 2
                            },
                            ".outPorts>.port-0": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                },
                                "ref-x": 83,
                                "ref-y": 40
                            },
                            ".outPorts>.port-0>.port-body": {
                                "port": {
                                    "id": "out-1",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-1": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": 82
                            },
                            ".outPorts>.port-1>.port-body": {
                                "port": {
                                    "id": "out-2",
                                    "type": "out"
                                }
                            },
                            ".outPorts>.port-2": {
                                "port": {
                                    "id": "out-3",
                                    "type": "out"
                                },
                                "ref-x": 41,
                                "ref-y": -2
                            },
                            ".outPorts>.port-2>.port-body": {
                                "port": {
                                    "id": "out-3",
                                    "type": "out"
                                }
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 0.7
                            }
                        },
                        "block_code": "def filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('filter_2() called')\n\n    # collect filtered artifact ids for 'if' condition 1\n    matched_artifacts_1, matched_results_1 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"detonate_file_3:action_result.data.*.threat.score\", \"==\", \"\"],\n        ],\n        name=\"filter_2:condition_1\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_1 or matched_results_1:\n        get_report_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)\n\n    # collect filtered artifact ids for 'if' condition 2\n    matched_artifacts_2, matched_results_2 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"detonate_file_3:action_result.data.*.threat.score\", \"!=\", \"\"],\n            [\"detonate_file_3:action_result.data.*.threat.score\", \">\", 50],\n        ],\n        logical_operator='and',\n        name=\"filter_2:condition_2\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_2 or matched_results_2:\n        filter_6(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2)\n\n    # collect filtered artifact ids for 'if' condition 3\n    matched_artifacts_3, matched_results_3 = phantom.condition(\n        container=container,\n        action_results=results,\n        conditions=[\n            [\"detonate_file_3:action_result.data.*.threat.score\", \"!=\", \"\"],\n            [\"detonate_file_3:action_result.data.*.threat.score\", \"<=\", 50],\n        ],\n        logical_operator='and',\n        name=\"filter_2:condition_3\")\n\n    # call connected blocks if filtered artifacts or results\n    if matched_artifacts_3 or matched_results_3:\n        deescalate_close_container1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_3, filtered_results=matched_results_3)\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": false,
                        "connected_to_start": true,
                        "connection_name": "detonate file, get report",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "description": "",
                        "hasElse": false,
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "efba0a3c-2d01-445d-a9c0-dd2ab3435b67",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "def join_filter_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('join_filter_2() called')\n\n    # check if all connected incoming actions are done i.e. have succeeded or failed\n    if phantom.actions_done([ 'detonate_file_3', 'get_report_1' ]):\n        \n        # call connected block \"filter_2\"\n        filter_2(container=container, handle=handle)\n    \n    return",
                        "join_optional": [],
                        "join_start": 590,
                        "line_end": 601,
                        "line_start": 542,
                        "name": "filter",
                        "notes": "",
                        "number": 2,
                        "outPorts": [
                            "out-1",
                            "out-2",
                            "out-3"
                        ],
                        "outputs": [
                            {
                                "conditions": [
                                    {
                                        "comparison": "==",
                                        "data_type": "",
                                        "param": "detonate_file_3:action_result.data.*.threat.score",
                                        "value": ""
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "detonate_file_3:action_result.data.*.threat.score",
                                        "value": ""
                                    },
                                    {
                                        "comparison": ">",
                                        "data_type": "",
                                        "param": "detonate_file_3:action_result.data.*.threat.score",
                                        "value": "50"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            },
                            {
                                "conditions": [
                                    {
                                        "comparison": "!=",
                                        "data_type": "",
                                        "param": "detonate_file_3:action_result.data.*.threat.score",
                                        "value": ""
                                    },
                                    {
                                        "comparison": "<=",
                                        "data_type": "",
                                        "param": "detonate_file_3:action_result.data.*.threat.score",
                                        "value": "50"
                                    }
                                ],
                                "display": "If",
                                "logic": "and",
                                "type": "if"
                            }
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1680,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "filter_2",
                        "show_number": true,
                        "size": {
                            "height": 82,
                            "width": 82
                        },
                        "state": "filter",
                        "status": "",
                        "type": "coa.Filter",
                        "warn": false,
                        "z": 5652
                    },
                    {
                        "action": "get report",
                        "action_type": "investigate",
                        "active": false,
                        "active_keys": {},
                        "active_values": {
                            "id": "detonate_file_3:action_result.summary.id"
                        },
                        "angle": 0,
                        "app": "",
                        "approver": "",
                        "assets": [
                            {
                                "action": "",
                                "active": true,
                                "app_name": "",
                                "app_version": "",
                                "config_type": "asset",
                                "fields": {
                                    "id": "detonate_file_3:action_result.summary.id"
                                },
                                "id": "-",
                                "loaded": false,
                                "missing": false,
                                "name": "threatgrid",
                                "output": [
                                    {
                                        "contains": [
                                            "threatgrid task id"
                                        ],
                                        "data_path": "action_result.summary.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.summary.results_url",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "file name"
                                        ],
                                        "data_path": "action_result.summary.target",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.curr.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.disk.mbr.hashes.orig.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.changed",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.contents.curr",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.mbr.contents.orig",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.type",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.curr.*.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.type",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.orig.*.start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.disk.partition_tables.changed",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.ioc",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.URL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.Method",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.data.*.Network_Stream",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.hits",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.title",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.category",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.truncated",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.iocs.*.description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.status.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.status.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.origin",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.status.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.status.done_url",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.running_on",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.vm_runtime",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.original_filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.analysis_started_at",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.status.analysis_submitted_at",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.new",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "contains": [
                                            "pid"
                                        ],
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.pid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.kpid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.proc",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.monitored",
                                        "data_type": "boolean"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.process_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.tid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.upid",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.uthread",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.dll_path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.shell_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.command_line",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.desktop_info",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.runtime_data",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.window_title",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.image_pathname",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.startup_info.current_directory",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.analyzed_because",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_read.*.key_value",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.access",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.dynamic.processes.*.registry_keys_opened.*.options",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.dst",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.src",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.uid",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.ts_end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.history",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.service",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.session",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.report.network.*.dst_port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.duration",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "port"
                                        ],
                                        "data_path": "action_result.data.*.report.network.*.src_port",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.ts_begin",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.transport",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_orig",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_resp",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.conn_state",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_missed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets_orig",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.packets_resp",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_orig_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.network.*.bytes_resp_payload",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.version",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.size",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.magic",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.malware_desc.*.filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.vm_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.run_time",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.current_os",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.sandcastle",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_end",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.analysis_start",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.controlsubject",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.sandcastle_env.sample_executed",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.sandbox_id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.report_created",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.metadata.general_details.sandbox_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.js",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.pe",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.ini",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.lnk",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.pdf",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.rtf",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.txt",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.html",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.file.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.network.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.versions.version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.created-time",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.entropy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.exports",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.company_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.copyright",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_description",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.file_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.internal_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.original_file_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_name",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.file_info.product_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.header_relocations",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_code_segment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_instruction_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.initial_stack_segment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.pages",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.dos.size_in_paragraphs",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.import_hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.number_of_symbols",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.actual_checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.claimed_checksum",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.entrypoint_address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.file_alignment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_major_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.linker_minor_version",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.loader_flag",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.number_of_rva_and_sizes",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.reserved_field",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.section_alignment",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.optional_header.subsystem",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.signed",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.headers.pe.timestamp",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.dll",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.imports.*.entries",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.internal_checksum_match",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.codepage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.language",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.locale",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.offset",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.resource_sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.sublanguage",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.resources.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.address",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.characteristics",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.data_pointer",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.entropy_type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "url"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.Sections.InternetShortcut.Properties.URL",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.section_hash",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.sections.*.virtual_size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.signatures",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.tag_attrs",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.tags",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.forensics.urls",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.magic-type",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.mime-type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.origin",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.path",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.relation.network",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.relation.process",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.report.artifacts.*.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.size",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.artifacts.*.type",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.report.annotations.network.*.ts",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.os",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "md5"
                                        ],
                                        "data_path": "action_result.data.*.status.md5",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha1"
                                        ],
                                        "data_path": "action_result.data.*.status.sha1",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.login",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.state",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "hash",
                                            "sha256"
                                        ],
                                        "data_path": "action_result.data.*.status.sha256",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.filename",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.started_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.completed_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.submitted_at",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.status.submission_id",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.bis",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.count",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.score",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.sample",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.max-severity",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.data.*.threat.max-confidence",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "action_result.status",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "action_result.message",
                                        "data_type": "string"
                                    },
                                    {
                                        "contains": [
                                            "threatgrid task id"
                                        ],
                                        "data_path": "action_result.parameter.id",
                                        "data_type": "string"
                                    },
                                    {
                                        "data_path": "summary.total_objects",
                                        "data_type": "numeric"
                                    },
                                    {
                                        "data_path": "summary.total_objects_successful",
                                        "data_type": "numeric"
                                    }
                                ],
                                "product_name": "",
                                "product_vendor": "",
                                "type": "sandbox"
                            }
                        ],
                        "attrs": {
                            ".action": {
                                "text": "get report"
                            },
                            ".inPorts>.port-in": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".inPorts>.port-in>.port-body": {
                                "port": {
                                    "id": "in",
                                    "type": "in"
                                }
                            },
                            ".message": {
                                "fill": "#FFFFFF",
                                "font-size": 12,
                                "font-weight": 300,
                                "opacity": 0,
                                "ref": ".background",
                                "ref-x": 5,
                                "ref-y": 105,
                                "text": "Configuring now"
                            },
                            ".outPorts>.port-out": {
                                "ref": ".background",
                                "ref-x": 0.5
                            },
                            ".outPorts>.port-out>.port-body": {
                                "port": {
                                    "id": "out",
                                    "type": "out"
                                }
                            },
                            ".title": {
                                "text": "Investigate"
                            },
                            "g.delete": {
                                "display": "none"
                            },
                            "g.error": {
                                "opacity": 0
                            },
                            "g.icon image": {
                                "xlink:href": "/inc/coa/img/block_icon_investigate.svg"
                            },
                            "g.notes": {
                                "display": "block",
                                "opacity": 1
                            },
                            "rect.warn-background": {
                                "fill": "#FFFFFF"
                            },
                            "text.icon": {
                                "fill": "#FFFFFF"
                            }
                        },
                        "block_code": "def get_report_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):\n    phantom.debug('get_report_1() called')\n    \n    #phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))\n    \n    # collect data for 'get_report_1' call\n    results_data_1 = phantom.collect2(container=container, datapath=['detonate_file_3:action_result.summary.id', 'detonate_file_3:action_result.parameter.context.artifact_id'], action_results=results)\n\n    parameters = []\n    \n    # build parameters list for 'get_report_1' call\n    for results_item_1 in results_data_1:\n        if results_item_1[0]:\n            parameters.append({\n                'id': results_item_1[0],\n                # context (artifact id) is added to associate results with the artifact\n                'context': {'artifact_id': results_item_1[1]},\n            })\n    # calculate start time using delay of 10 minutes\n    start_time = datetime.now() + timedelta(minutes=10)\n\n    phantom.act(\"get report\", parameters=parameters, assets=['threatgrid'], callback=join_filter_2, start_time=start_time, name=\"get_report_1\")\n\n    return",
                        "callback_code": "",
                        "callback_start": 1,
                        "callsback": true,
                        "color": "#654796",
                        "connected_to_start": true,
                        "connection_name": "detonate file, get report",
                        "connection_type": "action",
                        "custom_callback": "",
                        "custom_code": "",
                        "custom_join": "",
                        "custom_name": "",
                        "delay": "10",
                        "description": "",
                        "has_custom": false,
                        "has_custom_block": false,
                        "has_custom_callback": false,
                        "has_custom_join": false,
                        "id": "a42e6d03-df9d-469d-8761-9bc198b470b8",
                        "inPorts": [
                            "in"
                        ],
                        "join_code": "",
                        "join_optional": [],
                        "join_start": 1,
                        "line_end": 626,
                        "line_start": 601,
                        "message": "Configuring now",
                        "name": "get report",
                        "notes": "",
                        "number": 1,
                        "outPorts": [
                            "out"
                        ],
                        "ports": {
                            "groups": {
                                "in": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "left"
                                        }
                                    },
                                    "position": {
                                        "name": "left"
                                    }
                                },
                                "out": {
                                    "attrs": {
                                        ".port-body": {
                                            "fill": "#fff",
                                            "magnet": true,
                                            "r": 10,
                                            "stroke": "#000"
                                        },
                                        ".port-label": {
                                            "fill": "#000"
                                        }
                                    },
                                    "label": {
                                        "position": {
                                            "args": {
                                                "y": 10
                                            },
                                            "name": "right"
                                        }
                                    },
                                    "position": {
                                        "name": "right"
                                    }
                                }
                            }
                        },
                        "position": {
                            "x": 1820,
                            "y": 160
                        },
                        "previous_block_type": "",
                        "previous_function": "",
                        "previous_name": "get_report_1",
                        "required_params": {
                            "id": true
                        },
                        "reviewer": "",
                        "showNumber": false,
                        "show_delay": true,
                        "show_number": false,
                        "size": {
                            "height": 112,
                            "width": 168
                        },
                        "state": "asset",
                        "status": "",
                        "title": "Investigate",
                        "type": "coa.Action",
                        "warn": false,
                        "z": 5653
                    }
                ]
            },
            "notes": ""
        },
        "schema": 3,
        "version": "3.5.135"
    },
    "create_time": "2018-02-12T16:44:44.369740+00:00",
    "draft_mode": false,
    "labels": [
        "events"
    ]
}