Manually De-Duplicate Incidents - Administrator Guide - 6.6 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide

Product
Cortex XSOAR
Version
6.6
Creation date
2022-09-29
Last date published
2024-11-12
End_of_Life
EoL
Category
Administrator Guide
Abstract

De-duplicate incidents manually. Mark as duplicate in Cortex XSOAR. Related incidents page.

You can manually de-duplicate incidents from the Incidents page or the Related Incidents tab.

  • To de-duplicate incidents from the Incidents page:

    1. Select the incident checkboxes that are duplicates.

    2. Click Mark as Duplicate.

    3. Type the ID of the incident that you want to retain.

    4. Click Validate.

    5. Click Close others as duplicate.

      The duplicated incident is removed from the table.

  • To de-duplicate incidents from the Related Incidents tab:

    1. From the Incidents page, select the relevant incident checkbox.

    2. In the Related Incidents tab, click the related incident you want to de-duplicate.

    3. Click Duplicate.

    4. Click Close as duplicate.

      The duplicated incident is closed and marked as duplicate.