"""
"""

import phantom.rules as phantom
import json
from datetime import datetime, timedelta
def on_start(container):
    phantom.debug('on_start() called')
    
    # call 'filter_1' block
    filter_1(container=container)

    return

def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('filter_1() called')

    # collect filtered artifact ids for 'if' condition 1
    matched_artifacts_1, matched_results_1 = phantom.condition(
        container=container,
        conditions=[
            ["artifact:*.cef.fileHash", "!=", ""],
        ],
        name="filter_1:condition_1")

    # call connected blocks if filtered artifacts or results
    if matched_artifacts_1 or matched_results_1:
        decision_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)

    return

def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('decision_1() called')

    # check for 'if' condition 1
    matched_artifacts_1, matched_results_1 = phantom.condition(
        container=container,
        conditions=[
            ["filtered-data:filter_1:condition_1:artifact:*.cef.fileHash", "in", "custom_list: Prior Hashes"],
        ])

    # call connected blocks if condition 1 matched
    if matched_artifacts_1 or matched_results_1:
        format_1(action=action, success=success, container=container, results=results, handle=handle)
        return

    # call connected blocks for 'else' condition 2
    add_list_1(action=action, success=success, container=container, results=results, handle=handle)

    return

def format_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('format_1() called')
    
    template = """{0} has been seen before!"""

    # parameter list for template variable replacement
    parameters = [
        "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash",
    ]

    phantom.format(container=container, template=template, parameters=parameters, name="format_1")

    return

def add_list_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('add_list_1() called')

    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash'])

    filtered_artifacts_item_1_0 = [item[0] for item in filtered_artifacts_data_1]

    phantom.add_list(" Prior Hashes", filtered_artifacts_item_1_0)

    return

def on_finish(container, summary):
    phantom.debug('on_finish() called')
    # This function is called after all actions are completed.
    # summary of all the action and/or all detals of actions
    # can be collected here.

    # summary_json = phantom.get_summary()
    # if 'result' in summary_json:
        # for action_result in summary_json['result']:
            # if 'action_run_id' in action_result:
                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
                # phantom.debug(action_results)

    return
8db8c912f77dcb7b0a178a59b1d4ce65a23606ba
<mask token>


def on_start(container):
    phantom.debug('on_start() called')
    filter_1(container=container)
    return


def filter_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('filter_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[['artifact:*.cef.fileHash', '!=', '']], name
        ='filter_1:condition_1')
    if matched_artifacts_1 or matched_results_1:
        decision_1(action=action, success=success, container=container,
            results=results, handle=handle, filtered_artifacts=
            matched_artifacts_1, filtered_results=matched_results_1)
    return


<mask token>


def add_list_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('add_list_1() called')
    filtered_artifacts_data_1 = phantom.collect2(container=container,
        datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash']
        )
    filtered_artifacts_item_1_0 = [item[0] for item in
        filtered_artifacts_data_1]
    phantom.add_list(' Prior Hashes', filtered_artifacts_item_1_0)
    return


def on_finish(container, summary):
    phantom.debug('on_finish() called')
    return

<mask token>


def on_start(container):
    phantom.debug('on_start() called')
    filter_1(container=container)
    return


def filter_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('filter_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[['artifact:*.cef.fileHash', '!=', '']], name
        ='filter_1:condition_1')
    if matched_artifacts_1 or matched_results_1:
        decision_1(action=action, success=success, container=container,
            results=results, handle=handle, filtered_artifacts=
            matched_artifacts_1, filtered_results=matched_results_1)
    return


def decision_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('decision_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[[
        'filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'in',
        'custom_list: Prior Hashes']])
    if matched_artifacts_1 or matched_results_1:
        format_1(action=action, success=success, container=container,
            results=results, handle=handle)
        return
    add_list_1(action=action, success=success, container=container, results
        =results, handle=handle)
    return


<mask token>


def add_list_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('add_list_1() called')
    filtered_artifacts_data_1 = phantom.collect2(container=container,
        datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash']
        )
    filtered_artifacts_item_1_0 = [item[0] for item in
        filtered_artifacts_data_1]
    phantom.add_list(' Prior Hashes', filtered_artifacts_item_1_0)
    return


def on_finish(container, summary):
    phantom.debug('on_finish() called')
    return

<mask token>


def on_start(container):
    phantom.debug('on_start() called')
    filter_1(container=container)
    return


def filter_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('filter_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[['artifact:*.cef.fileHash', '!=', '']], name
        ='filter_1:condition_1')
    if matched_artifacts_1 or matched_results_1:
        decision_1(action=action, success=success, container=container,
            results=results, handle=handle, filtered_artifacts=
            matched_artifacts_1, filtered_results=matched_results_1)
    return


def decision_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('decision_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[[
        'filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'in',
        'custom_list: Prior Hashes']])
    if matched_artifacts_1 or matched_results_1:
        format_1(action=action, success=success, container=container,
            results=results, handle=handle)
        return
    add_list_1(action=action, success=success, container=container, results
        =results, handle=handle)
    return


def format_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('format_1() called')
    template = '{0} has been seen before!'
    parameters = ['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash']
    phantom.format(container=container, template=template, parameters=
        parameters, name='format_1')
    return


def add_list_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('add_list_1() called')
    filtered_artifacts_data_1 = phantom.collect2(container=container,
        datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash']
        )
    filtered_artifacts_item_1_0 = [item[0] for item in
        filtered_artifacts_data_1]
    phantom.add_list(' Prior Hashes', filtered_artifacts_item_1_0)
    return


def on_finish(container, summary):
    phantom.debug('on_finish() called')
    return

<mask token>
import phantom.rules as phantom
import json
from datetime import datetime, timedelta


def on_start(container):
    phantom.debug('on_start() called')
    filter_1(container=container)
    return


def filter_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('filter_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[['artifact:*.cef.fileHash', '!=', '']], name
        ='filter_1:condition_1')
    if matched_artifacts_1 or matched_results_1:
        decision_1(action=action, success=success, container=container,
            results=results, handle=handle, filtered_artifacts=
            matched_artifacts_1, filtered_results=matched_results_1)
    return


def decision_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('decision_1() called')
    matched_artifacts_1, matched_results_1 = phantom.condition(container=
        container, conditions=[[
        'filtered-data:filter_1:condition_1:artifact:*.cef.fileHash', 'in',
        'custom_list: Prior Hashes']])
    if matched_artifacts_1 or matched_results_1:
        format_1(action=action, success=success, container=container,
            results=results, handle=handle)
        return
    add_list_1(action=action, success=success, container=container, results
        =results, handle=handle)
    return


def format_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('format_1() called')
    template = '{0} has been seen before!'
    parameters = ['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash']
    phantom.format(container=container, template=template, parameters=
        parameters, name='format_1')
    return


def add_list_1(action=None, success=None, container=None, results=None,
    handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('add_list_1() called')
    filtered_artifacts_data_1 = phantom.collect2(container=container,
        datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash']
        )
    filtered_artifacts_item_1_0 = [item[0] for item in
        filtered_artifacts_data_1]
    phantom.add_list(' Prior Hashes', filtered_artifacts_item_1_0)
    return


def on_finish(container, summary):
    phantom.debug('on_finish() called')
    return

"""
"""

import phantom.rules as phantom
import json
from datetime import datetime, timedelta
def on_start(container):
    phantom.debug('on_start() called')
    
    # call 'filter_1' block
    filter_1(container=container)

    return

def filter_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('filter_1() called')

    # collect filtered artifact ids for 'if' condition 1
    matched_artifacts_1, matched_results_1 = phantom.condition(
        container=container,
        conditions=[
            ["artifact:*.cef.fileHash", "!=", ""],
        ],
        name="filter_1:condition_1")

    # call connected blocks if filtered artifacts or results
    if matched_artifacts_1 or matched_results_1:
        decision_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1)

    return

def decision_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('decision_1() called')

    # check for 'if' condition 1
    matched_artifacts_1, matched_results_1 = phantom.condition(
        container=container,
        conditions=[
            ["filtered-data:filter_1:condition_1:artifact:*.cef.fileHash", "in", "custom_list: Prior Hashes"],
        ])

    # call connected blocks if condition 1 matched
    if matched_artifacts_1 or matched_results_1:
        format_1(action=action, success=success, container=container, results=results, handle=handle)
        return

    # call connected blocks for 'else' condition 2
    add_list_1(action=action, success=success, container=container, results=results, handle=handle)

    return

def format_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('format_1() called')
    
    template = """{0} has been seen before!"""

    # parameter list for template variable replacement
    parameters = [
        "filtered-data:filter_1:condition_1:artifact:*.cef.fileHash",
    ]

    phantom.format(container=container, template=template, parameters=parameters, name="format_1")

    return

def add_list_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None):
    phantom.debug('add_list_1() called')

    filtered_artifacts_data_1 = phantom.collect2(container=container, datapath=['filtered-data:filter_1:condition_1:artifact:*.cef.fileHash'])

    filtered_artifacts_item_1_0 = [item[0] for item in filtered_artifacts_data_1]

    phantom.add_list(" Prior Hashes", filtered_artifacts_item_1_0)

    return

def on_finish(container, summary):
    phantom.debug('on_finish() called')
    # This function is called after all actions are completed.
    # summary of all the action and/or all detals of actions
    # can be collected here.

    # summary_json = phantom.get_summary()
    # if 'result' in summary_json:
        # for action_result in summary_json['result']:
            # if 'action_run_id' in action_result:
                # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)
                # phantom.debug(action_results)

    return