Skip to main content


This Script is part of the Base Pack.#

Finds similar incidents based on indicators' similarity. Indicators' contribution to the final score is based on their scarcity.

Script Data#

Script Typepython3
Cortex XSOAR Version5.0.0

Used In#

This script is used in the following playbooks and scripts.

  • Dedup - Generic v4


Argument NameDescription
incidentIdIncident ID to get the prediction of. If empty, predicts the current incident ID.
maxIncidentsInIndicatorsForWhiteListThe maximum number of incidents that an indicator can be associated with to be retained. This helps to filter out indicators that appear in many incidents
minNumberOfIndicatorsThe minimum number of indicators related to the incident required before running the model.
thresholdThreshold to similarity value which is between 0 and 1.
indicatorsTypesType of indicators to take into account. If empty, uses all indicators types.
showActualIncidentWhether to show the incident you are investigating.
maxIncidentsToDisplayThe maximum number of incidents to display.
fieldsIncidentToDisplayFields to add in the table of incident
fromDateThe start date by which we retrieve information on incidents.
queryArgument for the query of similar incidents.


There are no outputs for this script.