Threat Intelligence Security Center Entities De-duplication logic - 2.0<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } De-duplication Logic Updates - Threat Intelligence Security Center v4.2.0 (March Store Release)Deduplication logic has been simplified and optimized. When multiple records exist for the same parent observable from the same source, only the most recently created record advances to aggregation. All older records for that parent-source combination are marked as duplicates, ensuring the aggregated observable always reflects the latest information from each source. Example: Feed X and Feed Y both ingest IP 1.2.3.4. Feed X has ingested it 3 times and Feed Y has ingested it 2 times. Only the latest record from Feed X and the latest record from Feed Y advance to aggregation — the 3 older records across both feeds are marked as duplicates. Older version deduplication Logic - KB1587754 Related KB Please refer to the following knowledge base articles for detailed information regarding other elements of TISC processing workflow: KB2920946: This KB article documents the unique identification keys used for different threat intelligence entities within the TISC system. These keys are utilized during the Parent Identification phase, which occurs prior to the De-duplication process.KB2920912: This KB article provides details regarding the aggregation logic implemented in the TISC Processing layer, which is executed immediately following the De-duplication phase.