https://community.splunk.com/t5/Getting-Data-In/Certain-Defender-ATP-alerts-are-being-onboarded-multiple-times/m-p/511762#M86884 <P>Hello,</P><P>I am trying to onboard Defender ATP alerts using&nbsp;<STRONG>Microsoft Defender ATP Add-on for Splunk (<A href="https://splunkbase.splunk.com/app/4959/" target="_blank" rel="noopener">https://splunkbase.splunk.com/app/4959/</A>)&nbsp;</STRONG>but I can see certain alerts being onboarded multiple times. Has anyone else come across this type of issue before?<BR /><BR />Thanks,</P><P>Revati</P> Thu, 30 Jul 2020 13:53:33 GMT RevatiLawrence 2020-07-30T13:53:33Z https://community.splunk.com/t5/Getting-Data-In/Certain-Defender-ATP-alerts-are-being-onboarded-multiple-times/m-p/511762#M86884 <P>Hello,</P><P>I am trying to onboard Defender ATP alerts using&nbsp;<STRONG>Microsoft Defender ATP Add-on for Splunk (<A href="https://splunkbase.splunk.com/app/4959/" target="_blank" rel="noopener">https://splunkbase.splunk.com/app/4959/</A>)&nbsp;</STRONG>but I can see certain alerts being onboarded multiple times. Has anyone else come across this type of issue before?<BR /><BR />Thanks,</P><P>Revati</P> Thu, 30 Jul 2020 13:53:33 GMT https://community.splunk.com/t5/Getting-Data-In/Certain-Defender-ATP-alerts-are-being-onboarded-multiple-times/m-p/511762#M86884 RevatiLawrence 2020-07-30T13:53:33Z