Dedup - Generic v2 Deprecated Hidden

Deprecated. Use the Dedup Generic v3 playbook instead. This playbook identifies duplicate incidents using one of the supported methods.

Common Playbooks · 14 tasks · 9 inputs · 2 outputs

Inputs

  • DuplicateMethod — Select a method for identifying duplicate incidents. Can be "ml", "rules", or "text". 'rules' - defines specific rules, such as similar incident fields & labels. This method works best if you know the exact logic to find similar incidents. 'text' - text similarity, based on TF-IDF - unique word frequency in the incidents (based on similar incident fields) 'ml' - machine learning model, which was trained on similar phishing incidents. Considers similar labels, incident fields, and indicators.
  • DuplicateThreshold — The similarity threshold by which to consider an incident as a duplicate (0-1), where "1" is a duplicate and "0" is not a duplicate. Use this argument in the ML or text methods.
  • TimeFrameHours — The time frame (in hours) in which to check for duplicate incident candidates.
  • IgnoreCloseIncidents — Whether to ignore closed incidents. Can be "yes" or "no".
  • MaxNumberOfCandidates — The maximum number of candidates to check for duplication.
  • CloseAsDuplicate — Whether to close incidents identified as duplicates. Can be "true" or "false".
  • TimeField — The Time field by which to query for past incidents to check for duplicate incident candidates. Values: created, occurred, modified
  • similarLabelsKeys — A comma-separated list of similar label keys. Comma separated value. Also supports allowing X different words between labels, within the following way: label_name:X, where X is the number of words. X can also be '*' for contains. For example: the value "Email/subject:*" will consider email subject similar, if one is substring of the other. Relevant for 'Rules' method.
  • similarIncidentFields — Fields to compare. Can be label name, incident fields or custom fields. Comma separated value. Relevant for 'Text' and 'Rules' methods.

Outputs

  • isSimilarIncidentFound — Whether a similar incident was found? Can be "true" or "false".
  • similarIncident — The similar incident.

Commands used

linkIncidents

Flowchart

ml rules text yes yes yes Start Start Select method to identify duplicates Select method to identify... Identify duplicates by text - FindSimilarIncidentsByText Identify duplicates by text FindSimilarIncidentsByText Check if duplicates were found Check if duplicates were ... Identify similar incidents using rules - FindSimilarIncidents Identify similar incident... FindSimilarIncidents Identify duplicates using ML - GetDuplicatesMlv2 Identify duplicates using ML GetDuplicatesMlv2 Close investigation as duplicate - CloseInvestigationAsDuplicate Close investigation as du... CloseInvestigationAsDuplicate Done Done Text Text ML ML Rules Rules Close duplicates? Close duplicates? Link similar incidents - linkIncidents Link similar incidents linkIncidents Is Core REST API enabled? Is Core REST API enabled?