Deduping in Playbooks

sackett — Mon, 27 Oct 2025 21:54:42 GMT

I'm confused as to how to use the DedupBy command/script in my Playbook. I have a set command that grabs all the UPNs from a list of alerts in the data. This results in the Context data of:
Defender:{
UPNs:[
0:"user1@domain.com"
1:"user2@domain.com"
2:"user1@domain.com"
3:"user3@domain.com"]
}

I'd like to Dedup this list to use later on in my Playbook but I'm not sure the best way to go about it. After a bit of Googleing I found the command DedupBy, but I've tried all kinds of combinations for keys and/or value inputs, and I cannot get it to work. What is the proper usage here? Or am I making this harder than it should be?

Re: Deduping in Playbooks

jason_blackburn — Fri, 07 Nov 2025 15:24:04 GMT

I'd leverage the unique transformer

topic Deduping in Playbooks in Cortex XSOAR Discussions

Deduping in Playbooks

Re: Deduping in Playbooks