Reduce TI alert noise

[JocLRojas]

Describe the feature

Reduce redundant ThreatWinds feed alerts by collapsing matching IP, domain, and host indicators on each event side into one alert, selecting the highest feed level and breaking ties by IP, Domain, then Host.

Use Case

A single event side can match multiple feed indicators and produce redundant alerts. Collapsing those hits and grouping related detections reduces alert volume.

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change