Drop-Duplicates

Details

ID	`686bab0b-e6e2-4dbb-8c50-4895d21eca57`
Action	Drop and update
Links To	oldest
Order	1
Search Closed Incidents	No
Look Back	30 days
From Version	6.10.0

New event must match

sourceBrand isEqualString CheckPointXDR

Existing incident must match

dbotMirrorId isIdenticalIncident ${incident.dbotMirrorId}

Source

preprocessingrule-eliminate-duplicates.json

Download History Raw

{
    "id": "686bab0b-e6e2-4dbb-8c50-4895d21eca57",
    "version": -1,
    "packID": "",
    "itemVersion": "",
    "toServerVersion": "",
    "name": "Drop-Duplicates",
    "newEventFilters": [
        [
            {
                "operator": "isEqualString",
                "left": {
                    "value": {
                        "simple": "sourceBrand"
                    },
                    "isContext": true
                },
                "right": {
                    "value": {
                        "simple": "CheckPointXDR"
                    },
                    "isContext": false
                },
                "type": "sourceBrand"
            }
        ]
    ],
    "readyNewEventFilters": [
        [
            {
                "operator": "isEqualString",
                "left": {
                    "value": {
                        "simple": "sourceBrand"
                    },
                    "isContext": true
                },
                "right": {
                    "value": {
                        "simple": "CheckPointXDR"
                    },
                    "isContext": false
                },
                "type": "sourceBrand"
            }
        ]
    ],
    "existingEventsFilters": [
        [
            {
                "operator": "isIdenticalIncident",
                "left": {
                    "value": {
                        "simple": "dbotMirrorId"
                    },
                    "isContext": true
                },
                "right": {
                    "value": {
                        "simple": "${incident.dbotMirrorId}"
                    },
                    "isContext": true
                },
                "type": "shortText"
            }
        ]
    ],
    "readyExistingEventsFilters": [
        [
            {
                "operator": "isIdenticalIncident",
                "left": {
                    "value": {
                        "simple": "dbotMirrorId"
                    },
                    "isContext": true
                },
                "right": {
                    "value": {
                        "simple": "${incident.dbotMirrorId}"
                    },
                    "isContext": true
                },
                "type": "shortText"
            }
        ]
    ],
    "searchClosed": false,
    "period": {
        "by": "days",
        "fromValue": 30
    },
    "action": "dropAndUpdate",
    "linkTo": "oldest",
    "scriptName": "",
    "enabled": true,
    "index": 1,
    "locked": false,
    "system": false,
    "fromVersion": "6.10.0"
}