‹ 首页

check-duplicates

@dandye · 收录于 5 天前 · 上游提交 3 个月前

Check for duplicate or similar cases. Use before deep analysis to avoid investigating the same incident twice. Takes a CASE_ID and returns list of similar cases.

场景安全事件调查案例去重

适合你，如果你经常处理安全事件，需要避免重复分析同一案例

/ 下载安装
https://github.com/dandye/ai-runbooks/tree/main/skills/check-duplicates ↗
/ 通过 npx 安装 校验哈希
npx oh-my-skill add dandye/ai-runbooks/check-duplicates
/ 通过 bash 安装
curl -fsSL https://oh-my-skill.com/install.sh | bash -s -- dandye/ai-runbooks/check-duplicates
/ 已经装过?验证本机副本,不用重装
npx oh-my-skill verify dandye/ai-runbooks/check-duplicates
安装目标可用 --agent / --scope 或 --to 明确指定;省略时只会在唯一已存在的 agent 目录上自动选择,零命中或多命中会停止并提示。content_hash 缺失或不一致均拒装。
119GitHub stars
~343上下文体积 · 单文件
索引托管

怎么用

商店整理自技能原文 · 版本 086cbf6 · 表述以原文为准
它做什么

在分析前，先检查当前案例是否与已有案例重复或相似，并返回相似案例列表。

什么时候触发

当你给出一个案例ID并请求检查重复或相似案例时触发。

装好后可以这样说
Claude会查询并返回相似案例列表。
Claude会执行相似度检查。
Claude会识别潜在重复。
技能原文 SKILL.md作者撰写 · Apache-2.0 · 086cbf6

Check Duplicates Skill

Identify potentially duplicate or similar existing cases before starting deep analysis.

Inputs
  • CASE_ID - The ID of the current case to check
  • ALERT_GROUP_IDENTIFIERS - Alert group identifiers for the case
  • (Optional) DAYS_BACK - How many days to search back (default: 7)
  • (Optional) INCLUDE_OPEN - Include open cases (default: true)
  • (Optional) INCLUDE_CLOSED - Include closed cases (default: false)
Workflow
Step 1: Execute Similarity Check
secops-soar.siemplify_get_similar_cases(
    case_id=CASE_ID,
    alert_group_identifiers=ALERT_GROUP_IDENTIFIERS,
    days_back=DAYS_BACK,
    include_open_cases=INCLUDE_OPEN,
    include_closed_cases=INCLUDE_CLOSED
)
Step 2: Process Results

Extract the list of similar case IDs from the response.

Outputs

| Output | Description | |--------|-------------| | SIMILAR_CASE_IDS | List of case IDs identified as potentially similar/duplicate | | SIMILARITY_CHECK_STATUS | Success/failure status of the check |

Usage Pattern
1. Check duplicates BEFORE enrichment
2. If duplicates found:
   - Review similar case(s)
   - If confirmed duplicate: close as duplicate
   - If related but distinct: note correlation, continue
3. If no duplicates: proceed with analysis
When Duplicates Are Found

If SIMILAR_CASE_IDS is not empty:

  1. Document: "Closing as duplicate of [Similar Case ID]"
  2. Close with:
  3. Reason: NOT_MALICIOUS
  4. Root cause: Similar case is already under investigation
按 Apache-2.0 许可原样转载,未经改动 · 在 GitHub 查看 →

评论

登录即可评论;带「已验证安装」的,是发布者名下有本店的安装或持有记录。
…