Splunk SOAR Deletion of Container using filter (such as Label of the container and age of the Container)

[imarri]

I'm aiming to develop a Playbook in SOAR Phantom to automate the deletion of containers(using label) older than one week. Can you guide me on which App to utilize for container management and how to implement appropriate filters in the Action Block?

[SOARt_of_Lost]

I can't speak to an app, but this sounds easy enough to do with the API. You'd need to build a way to loop through containers, pull the relevant date info, then decide which ones to delete. Some useful links

# See the fields you're able to work with
my_query_url = phantom.build_phantom_rest_url('container','[id]')
my_response_json = phantom.requests.get(my_id_url, verify=False).json()
phantom.debug(my_response_json)