@wilcompl1334 you will need to pass in the formatted_data.* output from the format block into the query field of the run_query action (as per the diagram). Try selecting each option and watch the Code in the Playbook Editor tab for the change: * If using formatted_data.* output the code has a for loop to add a single parameter for each item found in the formatted data output * If using just formatted_data it passes in the list (built in the format block using %'s) as a single string parameter. So unless you are doing something custom I am not aware of, simply by using the %%{0}%% method in the format block and selecting the formatted_data.* datapath in the query field, Phantom will see each item in the list as a separate parameter and pass them individually into the run_query action. Using the format block with the %%{0}%% in will create: | inputlookup someCSV.csv | search domain=domain1.com | inputlookup someCSV.csv | search domain=domain2.com | inputlookup someCSV.csv | search domain=domain3.com If you pass it in as just formatted_data then the code will look like this: # build parameters list for 'run_query_1' call parameters.append({ 'command': "search", 'query': formatted_data_1, 'display': "", 'parse_only': "", }) However if you use the formatted_data.* it will/should change to this: # build parameters list for 'run_query_1' call for formatted_part_1 in formatted_data_1: parameters.append({ 'command': "search", 'query': formatted_part_1, 'display': "", 'parse_only': "", }) I am 100% sure, again unless you are doing something custom I am not aware of, this will work for you.
... View more