| name | check-duplicate-cases |
| description | Use when checking SOAR cases for overlapping entities to detect duplicate incidents. |
| category | common |
| version | 1.0.0 |
| type | Skill |
| title | Skill: Common Step: Check for Duplicate/Similar SOAR Cases |
| generated | {"by":"human:dandye","at":"2025-11-10T22:21:35.000Z"} |
Common Step: Check for Duplicate/Similar SOAR Cases
Objective
Identify potentially duplicate or similar existing SOAR cases based on the context of a current case or alert.
Scope
This sub-runbook executes the siemplify_get_similar_cases action in the SOAR platform using specified criteria. It returns a list of potential duplicate/similar case IDs.
Inputs
${CASE_ID}: The ID of the current case to check against.${ALERT_GROUP_IDENTIFIERS}: Relevant alert group identifiers for the current case.- (Optional)
${SIMILARITY_CRITERIA}: A structure or set of flags indicating the criteria for similarity search (e.g., Rule Generator, Port, Entity Identifier - specific to the siemplify_get_similar_cases tool). Defaults might be defined here or passed by the caller.
- (Optional)
${DAYS_BACK}: How many days back to search for similar cases (default could be 7 or passed by caller).
- (Optional)
${INCLUDE_OPEN}: Boolean, whether to include open cases (default: true).
- (Optional)
${INCLUDE_CLOSED}: Boolean, whether to include closed cases (default: false).
Outputs
${SIMILAR_CASE_IDS}: A list of case IDs identified as potentially similar or duplicate.${SIMILARITY_CHECK_STATUS}: Confirmation or status of the check attempt.
Tools
secops-soar: siemplify_get_similar_cases
Workflow Steps & Diagram
- Receive Input: Obtain
${CASE_ID}, ${ALERT_GROUP_IDENTIFIERS}, and optional criteria (${SIMILARITY_CRITERIA}, ${DAYS_BACK}, etc.) from the calling runbook.
- Check Similar Cases: Call
soar-mcp_siemplify_get_similar_cases with the provided inputs. Use defaults if optional inputs are not provided.
- Return Results: Store the list of similar case IDs found in
${SIMILAR_CASE_IDS} and the status of the check in ${SIMILARITY_CHECK_STATUS}. Return these to the calling runbook.
sequenceDiagram
participant CallingRunbook
participant CheckDuplicates as check_duplicate_cases.md (This Runbook)
participant SOAR as secops-soar
CallingRunbook->>CheckDuplicates: Execute Duplicate Check\nInput: CASE_ID, ALERT_GROUP_IDS, CRITERIA (opt), DAYS_BACK (opt)...
%% Step 2: Check Similar Cases
Note over CheckDuplicates: Prepare arguments for siemplify_get_similar_cases
CheckDuplicates->>SOAR: siemplify_get_similar_cases(case_id=CASE_ID, alert_group_identifiers=ALERT_GROUP_IDS, ...)
SOAR-->>CheckDuplicates: Similar Case List (SIMILAR_CASE_IDS), Status (SIMILARITY_CHECK_STATUS)
%% Step 3: Return Results
CheckDuplicates-->>CallingRunbook: Return Results:\nSIMILAR_CASE_IDS,\nSIMILARITY_CHECK_STATUS
Completion Criteria
The siemplify_get_similar_cases action has been attempted. The list of potential similar case IDs (${SIMILAR_CASE_IDS}) and the status (${SIMILARITY_CHECK_STATUS}) are available.
