Hi team, I'm using Phantom to create playbooks and I would like to know how the find artifact is used when I create a phantom action block -> phantom app -> find artifacts action. When I create the block I get this code: def find_artifacts_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, **kwargs):
phantom.debug('find_artifacts_1() called')
#phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED')))
# collect data for 'find_artifacts_1' call
parameters = []
# build parameters list for 'find_artifacts_1' call
parameters.append({
'values': "",
'exact_match': "true",
'limit_search': "",
'container_ids': "current",
})
phantom.act(action="find artifacts", parameters=parameters, assets=['phantom'], name="find_artifacts_1")
return But what should I put in the "values"? I tried using a created artifact name like "artifact:test.example" where "test" is the label and "example" is the is the source ID of the artifact that I've already created. But I'm getting 0 artifacts as a results: Message: "Artifacts found: 0" And also what the containers_ids refers to? Does it refers to a list of the containers IDs separated with comma or a python list? etc... Because there is no available documentation explaining this. Even this page (https://my.phantom.us/4.6/docs/automation/artifacts) doesn't contain a native API that allows me to understand how to find an artifact. Also the recent versions >4.6 of that page are blank... Thank you for your help
... View more
