What happens if a duplicate is found?

The skill provides a guided usage pattern to review the similar case and either close the current incident as a duplicate or note the correlation and continue analysis.

Which SOAR platforms does this skill support?

This skill is specifically designed for Google Chronicle SOAR (formerly Siemplify) and requires the chronicle.editor role.

Can I adjust how far back the skill looks for duplicates?

Yes, you can configure the optional DAYS_BACK parameter to search any historical timeframe; the default search window is 7 days.

Does it only search for currently open cases?

By default, it includes open cases, but you can toggle the INCLUDE_CLOSED parameter to search through resolved incidents as well.

When should I run this skill?

It is best practice to run the check-duplicates skill before performing enrichment or deep analysis to save time and resources.

Security Incident Deduplication

Name: Security Incident Deduplication
Author: dandye

bydandye

•

Security & Testing

Identifies duplicate or similar security incidents within Chronicle SOAR to streamline analysis and prevent redundant investigations.

The Security Incident Deduplication skill optimizes Security Operations Center (SOC) efficiency by automatically identifying similar or duplicate cases before an analyst begins deep investigation. By leveraging the Siemplify API, it searches for historical and current incidents based on alert group identifiers across a configurable timeframe. This prevents multiple analysts from working on the same threat, ensures consistency in incident handling, and facilitates the rapid closure of redundant alerts with standardized documentation and root-cause analysis.

Key Features

01Configurable search windows with custom look-back periods

02Dual-mode searching for both open and closed cases

03Seamless integration with Google Chronicle SOAR (Siemplify)

04Standardized workflows for closing redundant incidents

0587 GitHub stars

06Automated similarity checks using alert group identifiers

Use Cases

01Correlating related incidents across different timeframes

02Preventing redundant investigations into recurring security alerts

03Automatically closing duplicate alerts to reduce SOC backlog

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add dandye/ai-runbooks check-duplicates

For use in Claude.ai and ChatGPT

Download Skill