class_docstr: PhantomOutput handles all alert dispatching for Phantom
class_docstr_tok: ["PhantomOutput","handles","all","alert","dispatching","for","Phantom"]
docstr: Check to see if a Phantom container already exists for this rule
  
  Args:
      rule_name (str): The name of the rule that triggered the alert
      container_url (str): The constructed container url for this Phantom instance
      headers (dict): A dictionary containing header parameters
  
  Returns:
      int: ID of an existing Phantom container for this rule where the alerts
          will be sent or False if a matching container does not yet exists
docstr_tok: ["Check","to","see","if","a","Phantom","container","already","exists","for","this","rule","Args",":","rule_name","(","str",")",":","The","name","of","the","rule","that","triggered","the","alert","container_url","(","str",")",":","The","constructed","container","url","for","this","Phantom","instance","headers","(","dict",")",":","A","dictionary","containing","header","parameters","Returns",":","int",":","ID","of","an","existing","Phantom","container","for","this","rule","where","the","alerts","will","be","sent","or","False","if","a","matching","container","does","not","yet","exists"]
code: def _check_container_exists(cls, rule_name, container_url, headers):
      """Check to see if a Phantom container already exists for this rule
  
      Args:
          rule_name (str): The name of the rule that triggered the alert
          container_url (str): The constructed container url for this Phantom instance
          headers (dict): A dictionary containing header parameters
  
      Returns:
          int: ID of an existing Phantom container for this rule where the alerts
              will be sent or False if a matching container does not yet exists
      """
      # Limit the query to 1 page, since we only care if one container exists with
      # this name.
      params = {
          "_filter_name": '"{}"'.format(rule_name),
          "page_size": 1,
      }
      try:
          resp = cls._get_request_retry(
              container_url, params, headers, False
          )
      except OutputRequestFailure:
          return False
  
      response = resp.json()
      if not response:
          return False
  
      # If the count == 0 then we know there are no containers with this name and this
      # will evaluate to False. Otherwise there is at least one item in the list
      # of 'data' with a container id we can use
      return (
          response
          and response.get("count")
          and response.get("data")[0]["id"]
      )
  
file_path: streamalert/streamalert/alert_processor/outputs/phantom.py
imports: from collections import OrderedDict
  import os
  from streamalert.alert_processor.helpers import compose_alert
  from streamalert.alert_processor.outputs.output_base import OutputDispatcher, OutputProperty, OutputRequestFailure, StreamAlertOutput
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 2 for calling the PhantomOutput obj's underlying member method code with example usage: obj._check_container_exists(cls, rule_name, container_url, headers) and returns: unknown, False, False