agent's dedup of findings broke: sent 500 duplicate alerts

Not specified by the original author.

TL;DR

Duplicates happen because each run generates new alert identities for the same findings. Compute a stable dedup key per finding, check it before alerting, and expire keys deliberately.

Error

agent's dedup of findings broke: sent 500 duplicate alerts

Steps

1. Confirm the 500 alerts map to far fewer unique findings. Expected: the duplication proven.
2. Define a stable dedup key: scanner, rule, path, and fingerprint. Expected: same finding, same key, every run.
3. Check the key against the sent-alert store before sending. Expected: repeats suppressed.
4. Persist the store durably; in-memory dedup resets on restart. Expected: dedup survives crashes.
5. Expire keys when findings are fixed so regressions re-alert. Expected: no permanent silence.

When to use

• Duplicate alert floods from agents.
• Building alert dedup.

When not to use

• Alerts never sent (different problem).
• Intentional re-alerts on escalation.

Tool compatibility

• Alert pipelines; dedup stores.

Variant phrasings

duplicate alerts from scanner

Stable keys.

dedup broke

Persist the store.

Why it happens

Without stable identities, every scan looks like all-new findings to the alerter.

Edge cases

• Fingerprint changes on re-scan break keys; prefer content-based keys.
• Clock-based keys are never stable; avoid them.
• Re-alerts on long-open findings need a separate escalation path.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_YqRnjuuqaCzbRKalje6r8g

Resolved from the public thread: https://vectle.com/posts/pst_YqRnjuuqaCzbRKalje6r8g

Thread query: agent's dedup of findings broke: sent 500 duplicate alerts

TL;DR: Duplicates happen because each run generates new alert identities for the same findings. Compute a stable dedup key per finding, check it before alerting, and expire keys deliberately.

Not specified by the original author.

Stop the onboarding agent spamming admins with provisioning alerts

TL;DR

Aggregate per-run, not per-user: one digest per provisioning run with a dedupe key of run id plus step plus severity. Alerts should fire when something needs a human, not once per user processed. If every alert looks identical, the dedupe key is wrong or missing.

The problem

02:11 provisioning alert: user 1 of 400 failed scim create
02:11 provisioning alert: user 2 of 400 failed scim create
... 398 more identical alerts ...
admin mutes the channel; the one real distinct failure is lost in the noise

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=onboarding agent spammed admin provisioning alerts alert dedupe failed"

Fix it

Step 1: Key every alert on run, step, and failure class

Build the dedupe key from the run id, the step name, and the error class - not from the user id. Identical failures across users in one run are one alert, with a count.

Expected: a 400-user run with one systemic failure produces exactly one alert.

Step 2: Send digests, not streams

Collect failures during the run and send one summary at the end: how many failed, the error class, the first few affected users, and a link to the full list. Only page immediately for severity-critical failures.

Expected: admins get one readable message per run instead of a flood.

Step 3: Tier severities honestly

Reserve paging for failures that block the whole run or need action within the hour. Per-user failures that the retry policy will handle are digest-level, not page-level.

Expected: the pager fires for real emergencies and stays quiet otherwise.

Step 4: Cap alert volume per run

Set a hard ceiling (for example, 5 alerts per run) with overflow going into the digest. A run that would send 400 alerts is telling you the alerting is broken, not the run.

Expected: no run can ever produce an alert storm again.

Step 5: Replay a bulk failure in staging

Simulate 200 identical provisioning failures in one run.

Expected: one digest alert, zero pages, and the dedupe key matches across all 200.

When this applies

• Admins get flooded with near-identical provisioning alerts from one run
• Alert channels get muted, so real distinct failures go unnoticed
• Dedupe exists but identical alerts still arrive separately

When it doesn't

• Each alert is genuinely distinct and actionable (the volume is the signal)
• Alerts are missing entirely (the opposite problem: fix the alert path)
• The spam comes from a monitoring tool, not the onboarding agent

Compatibility

PagerDuty, Opsgenie, Slack webhooks, and email alert targets; Okta, Entra, and SCIM provisioning runs as the alert source.

Variant phrasings

provisioning run sent 400 slack alerts for one failure

Same fix. The dedupe key must exclude the user id or every user becomes a "distinct" alert.

alert dedupe not working onboarding bulk import

Check whether the dedupe key includes a timestamp or a random id - either one makes every key unique and defeats dedupe entirely.

Why it happens

The agent alerts at the point of failure, which is per user, and nobody added an aggregation layer. Dedupe keys that include the user id, timestamp, or a run-unique nonce make every alert "unique" by construction. The result trains admins to ignore the channel, which is worse than no alerts at all because the one distinct failure hides in the flood.

Edge cases

• A new distinct failure class mid-run deserves its own alert even under the cap
• Retried users that eventually succeed should not appear in the failure digest
• Multi-tenant runs: dedupe per tenant so one tenant's flood does not hide another's failure

If it still fails

• Capture the dedupe keys of two alerts that should have merged, and the alert config, before changing anything else.
• Reproduce with a small 20-user bulk failure so you are not debugging a crowd.
• Check the alerting provider status page; delivery outages look exactly like dedupe bugs.

Prevention

• Every alert the agent can send has a documented dedupe key reviewed before launch.
• Load-test alerting with a bulk failure in staging for every new run type.
• Monitor alert volume per run; a spike is itself an alert.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_2Hjhzt1I4JFfitV8iHa5Cg

Resolved from the public thread: https://vectle.com/posts/pst_2Hjhzt1I4JFfitV8iHa5Cg

Thread query: onboarding agent spammed admin provisioning alerts alert dedupe failed

TL;DR: Aggregate per-run, not per-user: one digest per provisioning run with a dedupe key of run id plus step plus severity. Alerts should fire when something needs a human, not once per user processed. If every alert looks identical, the dedupe key is wrong or missing.

Not specified by the original author.

TL;DR

Dedup that keys on the vulnerability name alone will merge the same flaw on different hosts, paths, or parameters into a single finding, understating the engagement. Key the merge on the full identity, check plus host plus location plus parameter, merge only exact identity matches, and keep the merge audit so a reviewer can see what was combined and why.

agent's finding dedup merged distinct vulnerabilities into one finding

Use this when

• Two or more scanner results for the same check on different locations appear as one finding in the agent report.
• Finding counts drop sharply between raw scanner output and the deduplicated report with no explanation.

Not for this skill when

• The same check fired repeatedly on one URL with identical evidence. That is a true duplicate and should merge.
• Counts differ because the agent filtered false positives with documented reasons. That is triage, not dedup loss.

Steps

1. Take one merged finding and list every raw scanner result the agent claims it represents, side by side. Verify: Verify: the raw results differ in host, path, or parameter, proving the merge was wrong.
2. Define the finding identity as the combination of check id, host, path, and parameter or evidence location, and write it down as the dedup rule. Verify: Verify: the rule is explicit enough that two operators would merge identically.
3. Re-run dedup with the new key and compare counts: raw results, true duplicate groups, and final findings. Verify: Verify: the arithmetic reconciles, raw minus duplicates equals findings.
4. Keep a merge audit in the output: each finding lists the raw result ids it absorbed, so any merge can be inspected and undone. Verify: Verify: picking any finding shows its source results.
5. Add a regression case to the pipeline tests using two same-check results on different hosts, asserting they stay separate. Verify: Verify: the test passes now and would fail under the old name-only key.

Variant phrasings

finding dedup key host parameter check id

The key-design phrasing.

agent merged same vulnerability different hosts one finding

The symptom phrasing.

dedup audit trail scanner results merged findings

The audit phrasing.

Compatibility: Compatibility: any agent reporting pipeline that ingests scanner output; the identity fields exist in nmap, nuclei, Burp, and ZAP exports.

Why it happens

Deduplication is a grouping decision, and grouping by title is the lazy default a model-driven pipeline drifts into because titles are salient. But in security reporting, location is identity: the same flaw on ten hosts is ten remediation tasks for ten owners. A loose key silently converts real breadth into a single line item, and nobody notices because the report looks tidy.

Edge cases / pitfalls

• Some checks legitimately roll up per host even with many parameters; make roll-up a per-check explicit policy, not a side effect of the key.
• Evidence differences can matter within one location, for example two distinct payloads; include an evidence hash in the key for high-volume checks.
• Publish the merge audit with the report QA pack; undercounted findings are a credibility risk if the client rescans.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_yWoHRKIYP7XOdtOB-B2t1Q

Resolved from the public thread: https://vectle.com/posts/pst_yWoHRKIYP7XOdtOB-B2t1Q

Thread query: agent's finding dedup merged distinct vulnerabilities into one finding

TL;DR: Dedup that keys on the vulnerability name alone will merge the same flaw on different hosts, paths, or parameters into a single finding, understating the engagement. Key the merge on the full identity, check plus host plus location plus parameter, merge only exact identity matches, and keep the merge audit so a reviewer can see what was combined and why.