DeDup incidents Deprecated Hidden

Deprecated. Check for duplicate incidents for the current incident, and close it if any duplicate has found.

Deprecated Content (Deprecated) · 5 tasks · 5 inputs · 1 output

Details

IDclose_incident_if_duplicate_found
From Version5.0.0
Tasks5

README

DEPRECATED. Checks for duplicate incidents for the current incident, and close it if any duplicate has found.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

This playbook does not use any integrations.

Scripts

  • CloseInvestigationAsDuplicate
  • FindSimilarIncidents

Commands

This playbook does not use any commands.

Playbook Inputs

Name Description Default Value Required
similarIncidentKeys The identical incident keys. - Optional
similarLabels The identical similar labels keys. You allow difference in X words between labels. For example, the input: Email\subject:2,Email\from Will demand: 1. Email\from to be identical 2. Email\subject to be similar with 2 max words difference - Optional
similarContextKeys Identical Similar context keys. You allow difference in X words between values. - Optional
similarCustomFields Identical Similar custom fields. You allow difference in X words between values. - Optional
hoursBack Checks incidents within X hours back. 24 Optional

Playbook Outputs

Path Description Type
isSimilarIncidentFound Whether the similar incident was found. Must be, “true” or “false”. unknown

Playbook Image

DeDup_incidents

Inputs

  • similarIncidentKeys — Identical incident keys
  • similarLabels — Identical\Similar labels keys. You allow difference in X words between labels. For example, the input: Email\subject:2,Email\from Will demand: 1. Email\from to be identical 2. Email\subject to be similar with 2 max words difference
  • similarContextKeys — Identical\Similar context keys. You allow difference in X words between values.
  • similarCustomFields — Identical\Similar custom fields. You allow difference in X words between values.
  • hoursBack — Check incidents within X hours back.

Outputs

  • isSimilarIncidentFound — Is similar incident found? (true\false)

Flowchart

yes Start Start Find duplicate incidents - FindSimilarIncidents Find duplicate incidents FindSimilarIncidents Close as duplicate - CloseInvestigationAsDuplicate Close as duplicate CloseInvestigationAsDuplicate Is duplicate incident found? Is duplicate incident found? Done Done

Source

playbook-DeDup_incidents.yml playbook-DeDup_incidents_-_ML.yml playbook-DeDup_incidents_-_ML_README.md
Download History Raw 
DEPRECATED. Checks for duplicate incidents of the current incident, and closes it if a duplicate has been found. This is accomplished though the `machine-learning find duplicates` automation.

## Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.

## Sub-playbooks
This playbook does not use any sub-playbooks.

## Integrations
This playbook does not use any integrations.

## Scripts
* GetDuplicatesMlv2
* Print
* CloseInvestigationAsDuplicate

## Commands
This playbook does not use any commands.

## Playbook Inputs
---

| **Name** | **Description** | **Default Value** | **Required** |
| --- | --- | --- | --- |
| closeThreshold | The candidate with a score above the threshold will close the investigation automatically, and mark it as a duplicate to the current incident. | 0.75 | Required |

## Playbook Outputs
---

| **Path** | **Description** | **Type** |
| --- | --- | --- |
| foundDuplicates | Whether any duplicate incidents were found. | boolean |
| duplicateCandidate | The duplicate top candidate. | unknown |

## Playbook Image
---
![DeDup_incidents_ML](https://raw.githubusercontent.com/demisto/content/1bdd5229392bd86f0cc58265a24df23ee3f7e662/docs/images/playbooks/DeDup_incidents_-_ML.png)