After pulling cases from ES to Phantom a certain label is assigned to the event , later it is automatically promoted to a case .
i have created an playbook that assign labels to the promoted cases (based on the triggered splunk rule) and it works 99% of the times but sometimes i get 2 identical cases with different labels (the newly assign one and the one that is configured in the Splunk app).
has anyone encountered this issue before ?
