Duplication Policies for Tenants

duplication policies help prevent repeated events for identical market listings, forum posts, chat messages, paste files, and stealer logs when two or more identical items are detected, repeated events are not created for each one based on the active policy these policies let you customize your preferences based on parameters such as content, source, and actor by preventing events for identical data, they reduce noise and redundancy so you can stay focused on new and relevant threats or incidents this keeps event volume manageable and helps you avoid alert fatigue to enable or disable a policy, select it from the tenant duplication policies list, then use the enable toggle in the toggle global policy panel the panel also displays a summary of what the selected policy does types of tenant duplication policies following policies are available in flare these policies are enabled by default, but they can be turned off, if needed prevent events for identical active market listing when enabled, this policy prevents creating events for a market listing identical to another active listing listings are considered identical when their title and contents are precisely the same, and when they are on the same source and by the same actor a listing is considered active if it was available to view in the last 48 hours, based on the last seen at date this policy reduces the number of events caused by dark web actors repeatedly reposting the same content to gain more visibility prevent events for identical forum posts when enabled, this policy prevents creating events for a forum post identical to another forum post forum posts are considered identical when their title and contents are precisely the same, and when they are on the same source and by the same actor this policy reduces the number of events caused by dark web actors repeatedly reposting the same content to gain more visibility prevent events for identical chats when enabled, this policy prevents creating events for a chat message identical to another chat message chat messages are considered identical when their contents are precisely the same, and when they are on the same source and by the same actor this policy reduces the number of events caused by dark web actors repeatedly reposting the same content to gain more visibility prevent events for identical attachments (coming august 26, 2026) when enabled, this policy prevents creating events for an attachment identical to another attachment within the same conversation attachments are considered identical when their file hash is precisely the same, and when they are on the same source and within the same conversation if the same attachment is shared across different conversations, a separate event is created for each this policy reduces the number of events caused by the same attachment being shared multiple times within a single conversation prevent events for identical pastes when enabled, this policy prevents creating events for a paste file identical to another paste file paste files are considered identical when their contents are precisely the same, and when they are on the same source and by the same actor this policy reduces the number of events caused by files being shared repeatedly on a single paste site prevent events for identical stealer logs when enabled, this policy prevents creating events for a stealer log identical to another stealer log stealer logs are considered identical when they originate from the same infected device