from ai-runbooks97
Find potentially duplicate or similar cases before deep analysis by running a similarity check against existing cases and returning matching case IDs.
This skill runs a similarity lookup for a given CASE_ID and optional alert-group identifiers to identify existing cases that may be duplicates or closely related. It queries the incident/case store (via a secops SOAR helper) and extracts SIMILAR_CASE_IDS and a check status. Use it to avoid re-investigating incidents that have already been handled or to surface related context quickly.
Run this skill early in an investigation workflow — before enrichment or deep analysis — whenever you receive a new case ID or alert bundle. It is especially useful for high-volume environments where duplicates are common and for triage workflows that need to avoid wasted analyst time.
This is aimed at SOAR/incident-response agents and runtimes that can call secops-soar helpers or integrate with Siemplify/Chronicle-style case APIs.
This skill has not been reviewed by our automated audit pipeline yet.
