Branch was auto-updated.

playbooks/custom_functions/container_merge.json

@@ -1,6 +1,6 @@
 {
-    "create_time": "2021-10-18T12:31:32.500833+00:00",
-    "custom_function_id": "83776ecf4dd52c71d8497cb500dd332780eb9c72",
+    "create_time": "2022-02-25T14:52:47.172543+00:00",
+    "custom_function_id": "1f8ae8e7978b750272fbbaba5efe4e6127a9a6a7",
     "description": "An alternative to the add-to-case API call. This function will copy all artifacts, automation, notes and comments over from every container within the container_list into the target_container. The target_container will be upgraded to a case.\n\nThe notes will be copied over with references to the child containers from where they came. A note will be left in the child containers with a link to the target container. The child containers will be marked as evidence within the target container. \n\nAny notes left as a consequence of the merge process will be skipped in subsequent merges.",
     "draft_mode": false,
     "inputs": [
@@ -36,6 +36,6 @@
         }
     ],
     "outputs": [],
-    "platform_version": "5.0.1.66250",
+    "platform_version": "5.2.1.78411",
     "python_version": "3"
 }

playbooks/custom_functions/container_merge.py

@@ -162,7 +162,7 @@ def container_merge(target_container=None, container_list=None, workbook=None, c
     # Fetch any previous merge note
     params = {'_filter_container': '"{}"'.format(container['id']), '_filter_title': '"[Auto-Generated] Child Containers"'}
     note_url = phantom.build_phantom_rest_url('note')
-    response_data = phantom.requests.get(note_url, verify=False).json()
+    response_data = phantom.requests.get(note_url, params=params, verify=False).json()
     # If an old note was found, proceed to overwrite it
     if response_data['count'] > 0:
         note_item = response_data['data'][0]

playbooks/custom_functions/find_related_containers.json

@@ -1,6 +1,6 @@
 {
-    "create_time": "2021-10-07T15:52:23.940165+00:00",
-    "custom_function_id": "24c4ef5ecd259674a07cd3c747f4223f09b5dd8f",
+    "create_time": "2022-02-10T18:24:50.244936+00:00",
+    "custom_function_id": "5781e3d5a4773b2c48afd429768fd81b5e733e54",
     "description": "Takes a provided list of indicator values to search for and finds all related containers. It will produce a list of the related container details.",
     "draft_mode": false,
     "inputs": [
@@ -113,6 +113,6 @@
             "description": "Link to container"
         }
     ],
-    "platform_version": "5.0.1.66250",
+    "platform_version": "5.2.1.78411",
     "python_version": "3"
 }

playbooks/custom_functions/find_related_containers.py

@@ -96,7 +96,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
         filter_in_case = True
     
     # If value list is equal to * then proceed to grab all indicator records for the current container
-    if isinstance(value_list, list) and value_list[0] == "*":
+    if value_list and (isinstance(value_list, list) and "*" in value_list) or (isinstance(value_list, str) and value_list == "*"):
         new_value_list = []
         url = phantom.build_phantom_rest_url('container', current_container, 'artifacts') + '?page_size=0'
         response_data = phantom.requests.get(uri=url, verify=False).json().get('data')
@@ -127,15 +127,10 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
     for indicator_id in list(set(indicator_id_list)):
         params = {'indicator_ids': indicator_id}
         response_data = phantom.requests.get(indicator_common_container_url, params=params, verify=False).json()
+        
         # Populate an indicator dictionary where the original ids are the dictionary keys and the                     
         # associated continers are the values
         if response_data:
-            # Quit early if no related containers were found
-            if len(response_data) == 1 and response_data[0].get('container_id') == current_container:
-                phantom.debug(f"No related containers found for provided values: '{value_list}'")
-                assert json.dumps(outputs)  # Will raise an exception if the :outputs: object is not JSON-serializable
-                return outputs
-            
             indicator_id_dictionary[str(indicator_id)] = []
             for item in response_data:
                 # Append all related containers except for current container
@@ -167,8 +162,7 @@ def find_related_containers(value_list=None, minimum_match_count=None, container
 
             # Gather container data
             params = {'page_size': 0}
-            if offset_time:
-                params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
+            params['_filter__create_time__gt'] = f'"{format_offset_time(time_in_seconds)}"'
             containers_response = phantom.requests.get(uri=container_url, params=params, verify=False).json()
             all_container_dictionary = {}
             if containers_response['count'] > 0: