check-duplicates

Compare CASE_ID against ALERT_GROUP_IDENTIFIERS to detect duplicate cases.

120|34|Updated May 9, 2025
One-click install
npx skills add https://github.com/dandye/ai-runbooks --skill check-duplicates
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: check-duplicates
Source: https://github.com/dandye/ai-runbooks/tree/main/skills/check-duplicates
Command: npx skills add https://github.com/dandye/ai-runbooks --skill check-duplicates

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams avoid re-investigating the same cases by detecting duplicates or highly similar incidents before proceeding with deep analysis.

Core Features & Use Cases

  • Similarity and duplicate detection for CASE_IDs across alerts and cases.
  • Provides a list of SIMILAR_CASE_IDS for triage decisions.
  • Use in incident response workflows to prevent duplicate investigations.

Quick Start

Provide CASE_ID and ALERT_GROUP_IDENTIFIERS to retrieve any similar or duplicate cases before proceeding with enrichment.

Frequently Asked Questions about check-duplicates

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check for duplicate cases before starting incident analysis?

To detect duplicate cases before analysis, compare a CASE_ID against ALERT_GROUP_IDENTIFIERS to identify similar incidents. This returns SIMILAR_CASE_IDS and a SIMILARITY_CHECK_STATUS to help you avoid re-investigating existing issues during triage.

What is the best way to prevent duplicate investigations in security operations?

Preventing duplicate investigations requires identifying similar incidents before deep analysis. By comparing a CASE_ID against ALERT_GROUP_IDENTIFIERS within a DAYS_BACK window, you can detect existing open or closed cases and prevent redundant triage work.

Can I filter similarity checks to only include open cases during triage?

Yes, you can filter similarity checks to include open or closed cases. By configuring the optional DAYS_BACK window and case status options, the workflow returns only the SIMILAR_CASE_IDS that match your specified parameters for downstream triage decisions.

How do I use a time window to limit duplicate alert detection?

You can limit duplicate alert detection by setting an optional DAYS_BACK window. This constrains the similarity check to compare the CASE_ID against ALERT_GROUP_IDENTIFIERS only within that specific timeframe, returning relevant SIMILAR_CASE_IDS.

What do I need to provide to identify similar incident cases?

To identify similar incident cases, you need to provide a CASE_ID and ALERT_GROUP_IDENTIFIERS. These inputs allow the deterministic workflow to detect duplicates and return a SIMILARITY_CHECK_STATUS for your incident response triage.

Why does my similarity check return a status instead of a simple duplicate flag?

The similarity check returns a SIMILARITY_CHECK_STATUS instead of a simple flag to support deterministic downstream decision making. This status, alongside the returned SIMILAR_CASE_IDS, helps triage workflows dynamically decide whether to proceed with or skip deep analysis.