Put alerts of the same type in just a single one daily.

[Josep]

Hello, 

I receive many alerts of the same type each day creating an incident for each. 

I would like to put together all them in an incident and avoid creating incidents individually. So it will be solved just once.  

[MBeauchamp2]

Sounds like you need a preprocessing rule or more likely a script.   Checkout the training video on Preprocessing:

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success...

Alternatively you could use the Dedup - Generic v4 playbook as one of the first steps in the playbook, and have it search for an existing Incident and link & close the new one to that.

[Josep]

Thanks for the reply,

Yes, a preproccessing rule which saves in a list the daily data with a daily job creating an incident with all the data.