Use Case: SOC Operations
Alert deduplication
One LSASS dump. Four alerts: CrowdStrike, Defender, Splunk, and a custom SIEM rule. Four separate queue items. ManySignal groups them into one case with all four sources contributing evidence.
The same threat, four different tickets
Enterprise security stacks are built from multiple overlapping tools — each with good individual reasons to exist, but collectively creating a duplication problem. A malicious process executing on an endpoint is detected by the EDR, generates a Sysmon event ingested by the SIEM, triggers a network detection in the NIDS, and possibly fires a cloud posture rule if the process interacts with cloud APIs. Each tool generates its own alert. Without deduplication, the analyst sees four queue items for one threat.
The cost is not just analyst time — it's investigation quality. Analysts who see the same event four times assume someone else is handling it, or dismiss subsequent alerts as duplicates without reading the context that might have been unique to each source.
approach: entity_based_deduplication
matching_criteria:
primary:
- entity: user_account OR host OR ip_address OR file_hash
- time_window: configurable (default: 30 minutes)
- event_category: authentication OR process OR network OR file
secondary (fuzzy):
- ioc_match: same_hash, same_domain, same_ip
- rule_family: rules with same underlying data source pattern
result_per_case:
- one_case: presented to analyst
- all_sources: aggregated as contributing evidence tabs
- unique_context: each source's unique evidence highlighted
- priority: highest_severity_source determines case priority
metrics:
- deduplication_ratio: alerts_received / cases_created
- typical_result: 4-6x reduction in case countAlert deduplication FAQ
How does ManySignal determine that two alerts from different tools are about the same event?
ManySignal uses entity-based deduplication: alerts are grouped when they involve the same entity (same user account, same host, same IP, same file hash) within a configurable time window. Additional matching considers: the event type (authentication failure, file access, network connection), the data source category, and the specific IOC if present. Fuzzy matching handles cases where the same event is described differently across sources.
What's the typical duplication rate in enterprise environments?
Organizations running multiple security tools (EDR + SIEM + CSPM + email security) typically see 3-7x duplication for high-volume alert categories. A single LSASS dump event might fire in CrowdStrike, Microsoft Defender, Splunk (via the Sysmon data), and a custom SIEM rule simultaneously — four alerts for one event.
Does deduplication hide context from analysts?
No. Deduplicated alerts are grouped rather than hidden. The analyst sees one case, but the case shows all source alerts, each with their own context and evidence. Alerts from different tools often contribute complementary evidence — CrowdStrike has the process tree, Splunk has the network context, CSPM has the IAM context. Deduplication groups all three into one investigation.
How does ManySignal handle alerts that are related but not identical?
Related alerts (same user doing different suspicious things within an hour) are linked as correlated events in the same case rather than deduplicated. Deduplication is for identical events from multiple sources. Correlation is for related events that together paint a picture. ManySignal does both.
See one case per threat, not one alert per tool
Entity-based deduplication that groups all sources into a single investigation without losing any context.