If I understand you right, you want to start working with the events ingested into the SOAR platform, where your playbooks might all similarly start by retrieving each container's artifact data? If so, I find myself relying on SOAR's code nodes more often than not to get the level of data I want.  Within your first line of custom code, you gain myriad prepopulated variables to access 'raw' data from the prior node and overall container/event data: try printing some of those parameters across the top. Despite those params, I generally rely on REST queries to obtain artifact data, like much of the client-side code itself.  Install the HTTP app, and create an asset that points to 127.0.0.1/rest.  Make sure one of your parameters includes a REST access token/header from some User.  Then, your PBs can call that HTTP app action node to GET/PUT/POST whatever, specifically "https://..host../rest/artifact?_filter_container=#####", whose results will include a 'cef' key with the verbatim artifact(s) data available for you to directly consume, modify, or simply pass forward into future nodes. lmk if I'm way off base, but this is generally how I manipulate individual container artifact data, inside and outside of individual playbooks. ... View more