Thank you for the responses. I copy/pasted some of the SOAR info below and as for the questions: I did define the output variable in the custom code block config I am not using {0} in the sample block because it kept giving an error . I was using {1} because that was grabbing the IP through a utility and that was working for me. The variable from the custom code block (extracted_ip_1) worked fine within the code block but was not set outside of it. code_3:customer_function:extraced_ip_1 def code_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): phantom.debug("code_3() called") regex_extract_ipv4_3__result = phantom.collect2(container=container, datapath=["regex_extract_ipv4_3:custom_function_result.data.extracted_ipv4","regex_extract_ipv4_3:custom_function_result.data.input_value"]) container_artifact_data = phantom.collect2(container=container, datapath=["artifact:*.cef.cs1","artifact:*.cef.cs1Label"]) regex_extract_ipv4_3_data_extracted_ipv4 = [item[0] for item in regex_extract_ipv4_3__result] regex_extract_ipv4_3_data_input_value = [item[1] for item in regex_extract_ipv4_3__result] container_artifact_cef_item_0 = [item[0] for item in container_artifact_data] container_artifact_cef_item_1 = [item[1] for item in container_artifact_data] input_parameter_0 = "" code_3__extracted_ip_1 = None ################################################################################ ## Custom Code Start ################################################################################ # Write your custom code here... extracted_ip_1 = regex_extract_ipv4_3_data_extracted_ipv4[0] ################################################################################ ## Custom Code End ################################################################################ phantom.save_run_data(key="code_3:extracted_ip_1", value=json.dumps(code_3__extracted_ip_1)) run_query_4(container=container) return
... View more
