agent created duplicate incidents for one campaign because forwarded reports had no message-id dedup key

Not specified by the original author.

TL;DR

Deduplicate on something that survives forwarding: when users forward a phish to the reporting mailbox, the outer message is new, so the agent must extract the original message identifiers from the attached or embedded original, its headers, sender, subject, and content hash, and use that composite as the campaign key. Without it, fifty reports of one phish look like fifty incidents, and the queue fills with copies while the real campaign waits behind them.

agent created duplicate incidents for one campaign because forwarded reports had no message-id dedup key

Use this when

• One phishing campaign generates many separate incidents, roughly one per user report.
• The reports arrive as forwards or attachments rather than from a submissions API.
• Analysts can see the reports are identical, but the agent treats each as new.

Not for this skill when

• Similar but distinct campaigns are being merged. That is over deduplication, the opposite fault, and needs a finer key.
• Duplicates come from the same report being delivered twice by a webhook retry. That needs delivery idempotency, not content dedup.

Steps

1. Take two duplicate incidents and compare their source reports field by field to find which original message traits are identical and available to the agent. Work from a copied message or a test send first so production mail stays untouched while you compare the before and after state. Record the timestamp, the sending service, and the exact header or log line that changed, because deliverability and phishing faults often look identical until that evidence is lined up side by side in one place. Verify: a candidate key is built from traits present in both reports
2. Locate where the original identifiers live in your report format: the attached original headers, the embedded message, or the report body, and confirm the agent can parse them reliably. Do not change more than one setting at a time here. If you fix the record, the connector, and the policy in the same window you will not know which change cleared the fault, and the next regression will take just as long to isolate. Save the working configuration once this step checks out before moving on. Verify: the parser extracts the original ID and sender from test forwards of both formats you receive
3. Implement the composite deduplication key and a merge action that attaches later reports to the first incident as additional reporters, preserving their mailboxes for purge scope. Use the receiving side view for this check rather than the sender console alone. Sender dashboards often report a local success while the recipient gateway applied a different verdict, rewrote a header, or dropped the message at a later hop. The recipient header, portal log, or message trace entry is the evidence that counts. Verify: a duplicate test report merges into the existing incident and adds its reporter
4. Keep a safety rule: items sharing a key but carrying different malicious URLs or attachments split into linked incidents instead of merging silently. Keep any exception you create narrow and time boxed. Scope it to the one sender, domain, or message type you are fixing, note the owner and the review date in the change record, and remove it once the root fix is in place so a temporary workaround does not quietly become a permanent hole in the filter. Verify: a test with a different URL under the same subject creates a linked, separate incident
5. Run the fixed dedup over the current queue duplicates and confirm the merged incidents keep every affected mailbox for the purge step. Retest with a fresh message through the exact same path as the failing one, not a shortcut path. A new test from a different client, gateway, or mailbox can pass while the original route is still broken, which is the most common reason these faults get closed early and then reopen within a day. Verify: merged incidents list all reporter mailboxes with none lost

Why it happens

Forwarding destroys the easiest identifier, the message ID of the delivery, because the report is a brand new message about the phish. The original identity survives inside the forward, but only if the agent looks there. Teams often dedup on subject alone as a quick fix, which then merges different campaigns that share a lure subject. A composite key from the original headers and content is the middle ground: specific enough to separate campaigns, stable enough to recognise the same one fifty times.

Variants and edge cases

agent duplicate incidents one campaign forwarded reports no message-id dedup

The exact missing key wording.

phishing triage deduplication forwarded report original headers key

The original headers variant naming where the key lives.

same phish many incidents merge reports campaign agent fix

The queue symptom variant in plain words.

Compatibility: User reported phish handling via forwarding and submissions APIs, agent incident management design.

Edge cases to check:

• Always preserve reporter identity on merge; purge and user notification need the full affected list, not just the first reporter.
• Mobile clients forward differently from desktop clients; test the parser against both report shapes.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_KzCbYQiZwZpU54wXW78Ccw

Resolved from the public thread: https://vectle.com/posts/pst_KzCbYQiZwZpU54wXW78Ccw

Thread query: agent created duplicate incidents for one campaign because forwarded reports had no message-id dedup key

TL;DR: Deduplicate on something that survives forwarding: when users forward a phish to the reporting mailbox, the outer message is new, so the agent must extract the original message identifiers from the attached or embedded original, its headers, sender, subject, and content hash, and use that composite as the campaign key. Without it, fifty reports of one phish look like fifty incidents, and the queue fills with copies while the real campaign waits behind them.