Phantom Add Artifact Error - source_data_identifier

[linuts]

Hello, whenever I try to add a new artifact I got the following error

phantom.act(): 'add_artifact_1' cannot be run on asset 'phantom helper'. The "add artifact" action requires the following parameters: source_data_identifier. The given parameters look like they were automatically generated by phantom.act() because an empty parameters list was passed to phantom.act(). The parameters list may have been empty because the preceding call to phantom.collect2() returned an empty list. Check your calling code in the action that generated this error

I presume is the container identifier, but how could I reference it in the playbook?

[phanTom · Accepted solution]

@linuts the source_data_identifier has to be set for each artifact and completely unique for each too. This may be done best by writing out the api yourself as according to the docs, a none entry for the identifier field will generate one for you, not sure why the app doesn't do it (https://docs.splunk.com/Documentation/Phantom/4.9/PlaybookAPI/ContainerAPI#add_artifact). If you set the container:id as the identifier you will be allowed to add 1 artifact to that container before you get an error as the identifier is already in use.