Ah there's your problem. You assign the variable "extracted_ip_1" which then works fine within the function, but in the following phantom.save_run_data function call, it does not actually dump the va...
See more...
Ah there's your problem. You assign the variable "extracted_ip_1" which then works fine within the function, but in the following phantom.save_run_data function call, it does not actually dump the value of the "extracted_ip_1" variable into the output, but rather the "code_3__extracted_ip_1" variable, which is previously set to None. You should change the phantom.save_run_data command to use the correct variable name in the value parameter: phantom.save_run_data(key="code_3:extracted_ip_1", value=json.dumps(extracted_ip_1)) Or, if you want to constrain all custom code between the "custom code" comment blocks, you can change the variable name: code_3__extracted_ip_1 = regex_extract_ipv4_3_data_extracted_ipv4[0] Also you mentioned your data path on the input to the following block is "code_3:customer_function:extraced_ip_1", which has "customer_function" but it should have "custom_function". Not sure if this is just a typo in your post but if it exists also in your SOAR instance then it can also cause problems.