What values do I use in Phantom's "Add Artifact" action to add my string as an artifact?

[AlexBryant]

In my Phantom playbook, I'm using a custom code block to generate a string (specifically, a Python dictionary representing matches between two sets of data) that I'd like to add to the container as an artifact. At the end of the playbook, I'll attach that artifact to an email that will be sent out.

I'm using the Phantom app with action "Add Artifact" and have not been successful in adding my string as an artifact. Here are the prompts in the app and the values I'm putting in them:

name: matches
container_id: [blank, as it's optional]
label: event
source_data_identifier: matches
cef_name: matches
cef_value: Search_URL_Content:custom_function:matches (the cef name for the string I'm interested in)
cef_dictionary: [blank, as it's optional]
contains: "matches": ["text"]

Every time I run the playbook, I get the following error from Add Artifact:

'add_artifact_1' on asset 'phantom': 1 action failed. (1)For Parameter: {"cef_name":"matches","cef_value"[the string i want to add as an artifact]","contains":"text","context":{"artifact_id":0,"guid":"23efc7d2-f15b-4cb5-a083-f08793cd551d","parent_action_run":[]},"label":"event","name":"matches","source_data_identifier":"matches"} Message: "Error from server. Status code: 400, Details: each value in cef_types must be a list of strings indicating the possible types "

I've been working this for several hours and can't find examples to go on....can anyone offer assistance as to what I should enter into these fields to fix this error?

Thanks!

[linuts]

I know it's a few months after you asked, I had the same issue 

first I found out you'll need a new artifact created, I still can't find how to do this automatically.

I'm running an splunk query for URL and then adding them to the artifacts.

then in the options

you'll need to add 

source_data_identifier --> the name you want

cef_name--->  in my example i use artifact:*.cef.requestURL

cef_value ---> Splunk_Query:action_result.data.*.url      (this is where the result of the investigate action)

And that's it.

You can test it by run an manual action within the container and check if it works