@drew19 When you send an email automatically you could update a custom list with the container_id & the mail_id and any other useful information for the update action(s). Then on a schedule check the status of each container_id, if closed use to the mail_id to run the update_email action then delete the entry from the list upon success. This would take a relatively small time to setup and test. For your other question you need to use REST and hit the 'container' endpoint with some filtering. <your_phantom_url>/rest/container?_filter_label='"<your_label>"'&page_size=0&sort=id&order=desc If using the phantom.requests() API you need to set it up like this: url = phantom.build_phantom_rest_url('container')
params = [('_filter_label', '"<label>"'), ('page_size', 0), ('sort', 'id'), ('order', 'desc')]
r = phantom.requests.get(url, params=params, verify=False)
response = r.json() verify=False is only if you don't have valid certs on Phantom. Docs links: Filtering REST: https://docs.splunk.com/Documentation/Phantom/4.10.3/PlatformAPI/RESTQueryData Sessions API: https://docs.splunk.com/Documentation/Phantom/4.10.3/PlaybookAPI/SessionAPI
... View more