@drew19 it's not written anywhere how to use this as it's from my exp of delivering 100's of playbooks over the last couple of years as a SOAR Solutions Architect. There is no specific walkthough on how to use this as HTTP DELETE is a standard capability which is made available to you on Phantom by using either the HTTP app or using the phantom.requests.delete() capability (similar to standard python requests lib).  Not everything can be documented to the degree of a walkthrough with Phantom as there are 1000 ways to do the same thing on the platform, it's mostly personal choice/knowledge that drives how you implement something in Phantom.  I would highly recommend leaving feedback on the documentation if you feel it is missing.  ... View more

@drew19 without knowing your use case I would say there may be a better way to facilitate your requirement.  However, in the mean time,  I would definitely look at the phantom.save_object() and phantom.get_object() API calls as you can make the value only relative to a specific container and/or playbook so you wouldn't need to reset every time as new context (container/playbook) would set it to Null again.  https://docs.splunk.com/Documentation/Phantom/4.10/PlaybookAPI/DataManagementAPI#save_object  https://docs.splunk.com/Documentation/Phantom/4.10/PlaybookAPI/DataManagementAPI#get_object  ... View more

@drew19 A playbook always needs a container, but if you need playbooks to run without an "Alert" creating the container, the Phantom Timer app (here) will create empty containers on a schedule with a selected label defined. Any active playbooks against that label will then pick this up when created and process as per usual. ... View more

@wilcompl1334 you will need to pass in the formatted_data.* output from the format block into the query field of the run_query action (as per the diagram). Try selecting each option and watch the Code in the Playbook Editor tab for the change: * If using formatted_data.* output the code has a for loop to add a single parameter for each item found in the formatted data output * If using just formatted_data it passes in the list (built in the format block using %'s) as a single string parameter.  So unless you are doing something custom I am not aware of, simply by using the %%{0}%% method in the format block and selecting the formatted_data.* datapath in the query field, Phantom will see each item in the list as a separate parameter and pass them individually into the run_query action. Using the format block with the %%{0}%% in will create: | inputlookup someCSV.csv | search domain=domain1.com | inputlookup someCSV.csv | search domain=domain2.com | inputlookup someCSV.csv | search domain=domain3.com   If you pass it in as just formatted_data then the code will look like this: # build parameters list for 'run_query_1' call parameters.append({     'command': "search",     'query': formatted_data_1,     'display': "",     'parse_only': "", }) However if you use the formatted_data.* it will/should change to this: # build parameters list for 'run_query_1' call for formatted_part_1 in formatted_data_1:     parameters.append({         'command': "search",         'query': formatted_part_1,         'display': "",         'parse_only': "", }) I am 100% sure, again unless you are doing something custom I am not aware of, this will work for you.  ... View more