Fixes the Entra ID failure "access review agent lost Entra ID Graph delta token - full resync triggered and campaign ev" by acting on the exact message, proving the fix on one item, then rerunning and reconciling counts. Use when this error blocks an export, review or check. Not for platform outages or permission erro…
Fetch the existing object first and update it in place, or merge the duplicates and keep the record with the fuller history, instead of creating a second one. Use when you see this exact failure in Vitally and the affected record or object can be named. Not for a different Vitally error with another message, or for ge…
Fixes incomplete Exchange message trace results for a campaign older than the trace window, by using historical trace and hunting data instead. Use when a campaign investigation reaches beyond the standard trace period. Not for recent campaigns inside the normal window.
Fixes an agent SHA256 lookup missing because the hash was computed on the raw MIME part instead of the decoded attachment, by hashing the decoded file bytes. Use when attachment hashes do not match any feed or sandbox record. Not for polymorphic attachments that genuinely change per recipient.
Vectle found the following relevant skills: - triage agent lost the graph delta token after a mailbox folder rename and rescanned from scratch - [agent couldn't read the shared mailbox after the service principal token expired mid-run; delegated…
Vectle found the following relevant skills: - dmarc aggregate reports stopped arriving after changing the rua address - agent couldn't parse the dmarc aggregate xml when the report feed broke mid-run
Fixes duplicate incidents for one campaign caused by forwarded reports having no message ID deduplication key, by keying dedup on stable message identifiers. Use when one campaign spawns many agent incidents. Not for genuinely separate campaigns with similar subjects.
Vectle found the following relevant skills: - agent created duplicate HubSpot contacts because dedupe key was missing - agent cannot parse component mapping spreadsheet with duplicate IDs: parsing failed with error and the workflow broke
Fixes reported phish webhooks returning 502 so messages never reach the triage agent queue, by repairing the webhook receiver and adding a durable fallback. Use when a submissions webhook errors and alerts are lost. Not for agent side processing failures after successful delivery.
Fixes a triage agent losing its Graph delta token after a mailbox folder rename and rescanning from scratch, by handling token invalidation and persisting sync state safely. Use when a mail triage agent restarts a full scan after a folder change. Not for first run full scans by design.
Vectle found the following relevant skills: - agent couldn't read the shared mailbox after the service principal token expired mid-run; delegated auth failed - the triage agent hung when Graph API throttling error blocked delta sync mid-scan
Fixes Advanced Hunting returning no results for a reported phish cluster that was already purged, by querying the right tables and time windows. Use when a hunter finds no trace of a cluster users reported. Not for clusters that were never delivered to the tenant.
Fixes an agent workflow failure behind this query: shrink what the agent carries: summarise the incident history into a compact state block, drop raw logs and full timelines from context, and split the workflow so each step starts with only the state it needs. Use when an automated status page run fails with this patt…
Fixes agents double-reporting the same backup and breaking dedupe: give each backup event a stable identity and make reporting idempotent. Use when duplicate agent reports break downstream dedupe. Not for scheduler double-firing of tests themselves.
Vectle found the following relevant skills: - agent error: failed to dedupe and double deployed the same patch to overlapping waves - agent double-resolved the same servicenow incident: webhook dedupe
Fixes an agent losing the idempotency key on a journal POST retry, so the duplicate entry fails the ledger balance check: quarantine the duplicates, re-establish one key per intended journal, and make retries key-preserving. Use when a retry recreated an unkeyed journal. Not when the journal API has no duplicate at al…
Vectle found the following relevant skills: - agent generated a new idempotency key per retry: created 3 duplicate invoices - agent sent duplicate interview confirmations - the idempotency key was the candidate email but the retry used a...
Fixes an agent retrying a failed journal-entry POST and double-posting the adjustment to the GL: use idempotency keys on journal creation, verify posting state before any retry, and reverse the duplicate. Use when a retry created two journals. Not for two intentionally separate adjustments.
Vectle found the following relevant skills: - agent error: failed to dedupe and double deployed the same patch to overlapping waves - agent failed to dedupe string catalog collapsing distinct keys with same english text