Incident De-Duplication - Administrator Guide - EoL - 6.5 - Cortex XSOAR - Cortex - Security Operations

Pre-Process rules enable you to perform certain actions on incidents as soon as they are ingested into Cortex XSOAR directly from the user interface. Through these rules, you can select incoming events on which to perform actions, for example, link the incoming incident to an existing incident, or under pre-configured conditions, drop the incoming incident altogether.

You can de-duplicate incidents by selecting the Link and Close action in the Pre-Process Rules tab. To create a pre-process rule, see Create Pre-Process Rules for Incidents. After you create a pre-process rule, in the Pre-Process Rules tab, you can do the following:

The Link and Close action creates an entry in the Linked Incidents table of the existing incident to which you link, and closes the incoming incident. If an existing incident matching the defining criteria is not found an incident is created for the incoming event.

For troubleshooting, you might need to identify which pre-process rule was triggered. To store pre-process logs in a separate file, go to Settings → About → Troubleshooting → Add Server Configuration and add preprocess.logs.file with the value true.

There are several out-of-the-box playbooks you can run to identify and close duplicate incidents. Alternatively, you can use these playbooks as the basis for customized de-duplication playbooks. For example, instead of automatically closing the duplicate incidents, include a manual review of the duplicate incidents.