topic Re: How to find duplicates incidents in Cortex XDR Discussions

How to find duplicates incidents

D.Szr008688 — Tue, 14 Oct 2025 12:29:06 GMT

Hello! I would like to ask if anyone can help me find duplicate incidents based on key value pairs in Context data?

Re: How to find duplicates incidents

eluis — Tue, 21 Oct 2025 11:47:07 GMT

Hi @D.Szr008688

Not sure what you mean by duplicates. There should be no duplicates.

If an incident is closed and reproduces, this is not a duplicate.

If new alerts are produced they should be part of the same incident.

So I dont see like a duplicate by mistake, if there are these type of duplicates (for example same incident ID), please open a TAC support ticket.

If you dont handle and close incidents the same situation and an incident can be produced again for example with the same description "but different incident ID" . We cant consider this as a duplicate

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thank you.

Luis

Re: How to find duplicates incidents

D.Szr008688 — Tue, 21 Oct 2025 13:18:49 GMT

My problem is that with the !FindSimilarIncidents automation, I don't know how to search for duplicates based on context data. The attached image shows that I want to find incidents based on the Email.From field that have the same value in the Email.From field. Can you help me put together a command for this? No matter how I try to enter the Email.From field into another argument, it doesn't work.