Overview

Configure case deduplication actions to prevent duplicate cases from being created in Blink.

Case deduplication is the process of automatically identifying and linking related alerts and their observables to an existing case, rather than creating a new case for each alert. This reduces noise, prevents alert fatigue, and provides a consolidated view of an ongoing incident.

Case Deduplication Action

The Case Deduplication action relies on defined conditions—such as matching observables (e.g., usernames, file hashes, IP addresses) and their relationships— defined in the Deduplication Rules section to determine if a new alert is part of an existing investigation. When a match is found, the alert and its observables are linked to the existing case, enabling more efficient triage, investigation, and response. If no match is found, a new case is created entirely.

---

How It Works

1. Duplication Check

   • When an alert is processed, the action first looks for a matching deduplication rule based on the alert name and/or vendor associated with the alert. These rules are defined in the Deduplication Rules Section.

   • These rules specify the criteria for identifying whether an incoming alert should be linked to an existing case.

     • Name-Based Check:

       • If the deduplication rule focuses on the alert’s name, the system searches for cases with the same name. If a match is found, it updates the variables to include details from the duplicate case.

     • Observable-Based and/or Relation-Based Check:

       • If the rule uses observables (e.g., file hashes, IPs, URLs) or observable relations (such as “Source” or “Created By”), the system searches for cases related to those observables or observable relations.

2. Linking to an Existing Case:

   • If a match is found, the system links the alert and its observables and its relations (if they exist) to the identified existing case. This helps consolidate all related information under one case, making it easier to analyze and respond efficiently.
   • The system considers the following during the deduplication check:
     • Open cases are always eligible for deduplication.
     • Closed cases are considered only if they fall within a defined lookback period, which determines how far back the system searches for duplicates among closed cases.

3. Creating a New Case:

   • If no duplicate is found, the system creates a new case. It pulls relevant data from the alert, such as observables and metadata, and structures it into a new case record.

Case Deduplication Action Fields

Parameter	Description
Alert ID	The Alerts ID
Create a case for unique alerts	When checked, a new case will be created if no duplicate is found.
Case Name	The title of the case.
Case Status	The Current status of the Case - (i.e New, In Progress, Closed).
Case Type	The case type defines the classification or category assigned to the case.
Case Manager	The user or group assigned to handle the case.
Severity	The Case’s severity rank- (i.e Low, Medium, High or Critical)
Inherit highest alert severity	If checked, the case’s severity will automatically update to match the highest severity among newly linked alerts.
Append Alert’s Vendor	If checked the alert’s vendor will automatically be added to the case’s “Vendors” field.

Note: To prevent the step from failing, make sure the specified vendor is added in the ‘Vendors’ tab under the Case section of Case Management Settings. If you check the ‘Append Alert’s Vendor’ option without first adding the vendor, the step will not run successfully.

---

‘Case Deduplication’ Action Output

When a deduplication match is found, the alert is automatically associated with the appropriate case, helping reduce redundancy and improve investigation efficiency. If no match is found, a new case will be created. The structured JSON output provide output from this action informs downstream workflow steps about how the alert was handled, which case it relates to, and what observables were involved.

Note: The following images and JSON outputs are provided for illustrative purposes only. The actual results you see may vary depending on how you have configured the Case Deduplication action and the associated Deduplication Rules.

'Case Deduplication' Action Output Example

{
  "is_unique": false,
  "matched_rule": true,
  "rule": "False Executable",
  "case": {
    "name": "FalseExecutableExtension",
    "case_ids": null,
    "close_reason": null,
    "updated_by": "8681d697-b686-48b7-8cb1-915452a19593",
    "auto_id": 4,
    "id": "dd52de81-815f-4d4f-984c-0b7f0dfd7a79",
    "closed_by_automation": false,
    "task_ids": null,
    "mitre_attack": null,
    "closed_by": null,
    "alert_ids": [
      "a7a702ff-cdf0-4493-a125-9252316bfa85"
    ],
    "attachment_ids": null,
    "severity": 2,
    "created_by": "8681d697-b686-48b7-8cb1-915452a19593",
    "type": "Malware",
    "case_tags": null,
    "collaborators": null,
    "sla_expiry": null,
    "closed_at": null,
    "status": "NEW",
    "sla": null,
    "observable_ids": [
      "045cb3b7-68e8-43e2-9ebd-64d210b08615",
      "8aee406f-d970-4839-ba99-49daf34199b2",
      "7fbff996-e653-4f80-9efa-ab6b2a00a525",
      "a0a8f04c-8181-4f5b-acd5-1d43996251f7",
      "bca048c7-eeef-4125-ad5e-f2b4a620eeff",
      "9785b8cf-555c-4969-b0b8-cbeae5791d3f",
      "e2016490-a6c5-43a5-8f6f-21e786d2bcaa",
      "386e5762-340a-4629-b49a-8018a34299c2"
    ],
    "overview": null,
    "updated_at": 1744805810293,
    "created_at": 1744805810293,
    "summary": null,
    "case_manager": null,
    "vendors": null,
    "case_id": "INC-00004"
  },
  "log": [
    ""
  ]
}