Hi,

I want to avoid adding incident if the name (or anther field) is the same. We can do this with api query but I wondered if we can do this from rule or not. Any advice or document would be appreciated.

Best

------------------------------
Jasmine
------------------------------

Hi Jasmine,

Yes, you can do this from a script. Take a look at the query_builder():
https://www.ibm.com/support/knowledgecenter/en/SSBRUQ_36.0.0/doc/playbook/resilient_playbook_configscripts_writing_query.html

Take a look at lines 534-553 here for an example here:
https://github.com/ibmresilient/resilient-community-apps/blob/306eccb05a4fb67c31cea8b90b1f96680e54b446/sc_email_parser/EmailParser.py

------------------------------
Jared Fagel
Cyber Security Analyst I
Public Utility
------------------------------