class_docstr: PhantomOutput handles all alert dispatching for Phantom
class_docstr_tok: ["PhantomOutput","handles","all","alert","dispatching","for","Phantom"]
docstr: Send alert to Phantom
  
  Publishing:
      By default this output sends the current publication in as JSON to Phantom.
      There is no "magic" field to "override" it: Simply publish what you want to send!
  
  Args:
      alert (Alert): Alert instance which triggered a rule
      descriptor (str): Output descriptor
  
  Returns:
      bool: True if alert was sent successfully, False otherwise
docstr_tok: ["Send","alert","to","Phantom","Publishing",":","By","default","this","output","sends","the","current","publication","in","as","JSON","to","Phantom",".","There","is","no","``","magic","''","field","to","``","override","''","it",":","Simply","publish","what","you","want","to","send","!","Args",":","alert","(","Alert",")",":","Alert","instance","which","triggered","a","rule","descriptor","(","str",")",":","Output","descriptor","Returns",":","bool",":","True","if","alert","was","sent","successfully",",","False","otherwise"]
code: def _dispatch(self, alert, descriptor):
      """Send alert to Phantom
  
      Publishing:
          By default this output sends the current publication in as JSON to Phantom.
          There is no "magic" field to "override" it: Simply publish what you want to send!
  
      Args:
          alert (Alert): Alert instance which triggered a rule
          descriptor (str): Output descriptor
  
      Returns:
          bool: True if alert was sent successfully, False otherwise
      """
      creds = self._load_creds(descriptor)
      if not creds:
          return False
  
      publication = compose_alert(alert, self, descriptor)
      record = alert.record
  
      headers = {"ph-auth-token": creds["ph_auth_token"]}
      container_id = self._setup_container(
          alert.rule_name, alert.rule_description, creds["url"], headers
      )
  
      LOGGER.debug(
          "sending alert to Phantom container with id %s", container_id
      )
  
      if not container_id:
          return False
  
      artifact = {
          "cef": record,
          "container_id": container_id,
          "data": publication,
          "name": "Phantom Artifact",
          "label": "Alert",
      }
      artifact_url = os.path.join(creds["url"], self.ARTIFACT_ENDPOINT)
      try:
          self._post_request_retry(
              artifact_url, artifact, headers, False
          )
      except OutputRequestFailure:
          return False
  
      return True
  
file_path: streamalert/streamalert/alert_processor/outputs/phantom.py
imports: from collections import OrderedDict
  import os
  from streamalert.alert_processor.helpers import compose_alert
  from streamalert.alert_processor.outputs.output_base import OutputDispatcher, OutputProperty, OutputRequestFailure, StreamAlertOutput
  from streamalert.shared.logger import get_logger
label_desc: Use image node_id 4 for calling the PhantomOutput obj's underlying member method code with example usage: obj._dispatch(alert, descriptor) and returns: True, False, False, False