code: def data_has_value_with_substring(data, search_value):
      """Recursively search for a value with the given substring
  
      Args:
          data (dict, list, primitive)
          search_value (string)
  
      Returns:
          (bool) True or False if found
      """
      if isinstance(data, list):
          return any(
              data_has_value_with_substring(item, search_value)
              for item in data
          )
  
      if isinstance(data, dict):
          return any(
              data_has_value_with_substring(v, search_value)
              for v in data.values()
          )
  
      return isinstance(data, str) and search_value in data
  
file_path: streamalert/rules/helpers/base.py
imports: from fnmatch import fnmatch
  import logging
  import json
  import random
  import time
  import pathlib2
  from streamalert.shared.utils import get_first_key, get_keys, in_network, valid_ip
label_desc: Use image node_id 8 for calling a global function with example usage: data_has_value_with_substring(data, search_value) and returns: unknown, any, any