When a custom connector runs automatically and ingests the same alerts, cases, or events (alertInfo/caseInfo objects), does it recreate them or avoid duplication if the same event already exists in the SOAR system under a different case number? While a new test-run is performed it found that it creates a new one but I am curious about the behavior during automatic execution !
LinkedIn
Twitter
