Can I disable the deduplication of my Panther alerts?

Last updated
Save as PDF

QUESTION

ANSWER

Panther’s deduplication has a default value of 1 hour, while you can adjust this value, you can not completely disable it.

If you want to receive all the alerts without them being grouped, you can use the dedup() function instead. This function overrides the default "group by title" behavior and lets you specify a string for grouping your alerts.