Splunk Enterprise Security

Duplicate cases in SOAR

Joei
Engager

After pulling cases from ES to Phantom a certain label is assigned to the event , later it is automatically promoted to a case . 

i have created an playbook that assign labels to the promoted cases (based on the triggered splunk rule) and it works 99% of the times but sometimes i get 2 identical cases with different labels (the newly assign one and the one that is configured in the Splunk app).

has anyone encountered this issue before ? 


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...