Skip to main content

Dedup - Generic

This Playbook is part of the Deprecated Content (Deprecated) Pack.#


Use "Dedup - Generic v2" playbook instead.

DEPRECATED. Use "Dedup - Generic v2" playbook instead. Identifies duplicate incidents using one of the supported methods.


This playbook uses the following sub-playbooks, integrations, and scripts.


This playbook does not use any sub-playbooks.


This playbook does not use any integrations.


  • FindSimilarIncidentsByText
  • FindSimilarIncidents
  • CloseInvestigationAsDuplicate
  • GetDuplicatesMlv2


This playbook does not use any commands.

Playbook Inputs#

NameDescriptionDefault ValueRequired
DuplicateMethodSelect a method for identifying duplicate incidents. Can be, "ml", "rules", or "text".mlRequired
DuplicateThresholdThe similarity threshold to consider an incident as a duplicate. Can be, "0" or "1". Chose "1" when it is a duplicate and "0" when it is not a duplicate. Use this argument in the ML or text methods.0.75Required
TimeFrameHoursThe time frame (in hours) in which to check for duplicate incident candidates.72Required
IgnoreCloseIncidentsWhether to ignore closed incidents. Can be, "yes" or "no".yesRequired
MaxNumberOfCandidatesThe maximum number of candidates to check for duplication.1000Optional
CloseAsDuplicateWhether to close incidents identified as duplicates. Can be, "true" or "false".trueOptional
TimeFieldThe time field by which to query past incidents to check for duplicate incident candidates. The values can be, "created", "occurred", or "modified".createdOptional

Playbook Outputs#

isSimilarIncidentFoundWhether a similar incident was found. Can be, "true" or "false".boolean
similarIncidentThe similar incident.unknown

Playbook Image#