Case Merge

[yasinmnk]

Hi
Our customer receive several cases and would like to prevent duplicates and merge cases for a better overview! Is that possible ? if yes,  how and is there any documentation or guide for that thanks in advance for answers!

[kentphelps · Accepted solution]

Merge is available on the Search Screen Let us know if that does not help here.

[kentphelps · Accepted solution]

Merge is available on the Search Screen Let us know if that does not help here.

[AymanC · Accepted solution]

hi @yasinmnk,

You can also look into alert grouping - so it identifies similar alerts (specified by your own conditions) within a specified time period, and will group these alerts into one case. Alternatively, another way to look into this which hypothetically sounds possible is by creating a playbook that gets attached to these specific cases, using the 'Get Similar Cases' action within the playbook, attach this as the first step, if there's a xxx% match (for example 100% entity match), along with the same/similar case name, to automatically close the case.

Reference: https://cloud.google.com/chronicle/docs/soar/investigate/working-with-alerts/alert-grouping-mechanis...

Kind Regards,

Ayman

[yasinmnk]

Hi @AymanC  Thanks so much for your answer, was very helpful:
Best Regards,
Yasin