I used a custom function that parses out email addresses from an alert, I used the phantom.add_artifact function to add the artifact to the container. I am then using a filter to check for the artifact ("artifact:*.label", "==", "notiresponse"). It evaluates as false each time even though if I check the container it is there. What can I do to ensure that the filter is seeing this artifact? When I check the debug log, I can see the loop checking against all of the artifacts in the container except for the one I am creating via custom function. We have multiple playbooks that do this, but this one, in particular, is giving me trouble.  ... View more

I am noticing for some of our events our playbooks run multiple times on the same event. How can I go about keeping that from happening? The second run of the playbook is generating a lot of error notifications for us. Ex We get an alert, Phantom ingest the email, our move processed email playbook runs, our alert playbooks run and then our move processed email playbook runs again causing us to receive an error notification (by design). How can this be stopped? ... View more