Duplicate cases in SOAR

[Joei]

After pulling cases from ES to Phantom a certain label is assigned to the event , later it is automatically promoted to a case . 

i have created an playbook that assign labels to the promoted cases (based on the triggered splunk rule) and it works 99% of the times but sometimes i get 2 identical cases with different labels (the newly assign one and the one that is configured in the Splunk app).

has anyone encountered this issue before ? 

[mushknizamoffic]

Hello. I am new to splunk soar. May I know how did soar automatically promotes the events to cases when notables gets ingested from ES? Did you configure something for it to automate it?