How to Read Comments in Playbooks

[SOARt_of_Lost]

With SOAR 6.1's addition of the "Run automatically when" field, it would be great to be able to run a playbook on container resolution that can read the closure comment. Bonus points if you can explain why Comment data is separate from Event data in the export while notes aren't.

[SOARt_of_Lost · Accepted solution]

You can read the comments on a container by using the the API in a code or custom function block.

comment_url = phantom.build_phantom_rest_url('container', container_id, 'comments')

comment_resp_json = phantom.requests.get(comment_url, verify=False).json()

if comment_resp_json.get('count', 0) > 0:
    phantom.debug(comment_resp_json)

You can then parse the comments to your heart's content.