What is the deduping alert logic in Kinectify?
Kinectify checks every event for duplicates before it decides whether to create an Active alert. If an event duplicates an event Kinectify already detected, no alert is created for it. The duplicate isn't deleted. It's recorded in the Non-Escalated Events log with the outcome reason Duplicate, so you keep a record of every detection, and you can still escalate it yourself if it needs investigating.
Prerequisites
Active alerts turned on for your organization.
To review duplicates: permission to View the Non-Escalated Events log, under Logs > Non-Escalated Events.
To escalate a duplicate: permission to Edit the Non-Escalated Events log.
Deduplication for Active alerts includes:
A duplicate check on every detected event, before any other escalation check
A record of each duplicate in the Non-Escalated Events log
A link from each duplicate to the original event
An Escalate event option to override the outcome
A settings warning when an alert type's setup will produce duplicates
Why duplicates happen
Kinectify looks back over each alert type's Detection Window every time monitoring runs. When the Detection Window is longer than the time between monitoring runs, the windows overlap, and the same activity can be detected again on the next run. Without a duplicate check, that would create a second alert for activity you're already reviewing.
What counts as a duplicate
An event is a duplicate when it repeats an earlier event for the same player and the same typology (alert type) within an overlapping detection window. The earlier event is called the original event.
When the duplicate check runs
The duplicate check is the first thing Kinectify does with an event, before it looks at the Confidence Score.
Duplicate check. If the event is a duplicate, it is not escalated and none of the steps below apply.
Escalation threshold. Events whose Confidence Score is below the alert type's threshold score are not escalated.
Pattern qualification. Where it's set up, events that don't yet meet the required number of qualifying events are not escalated.
Because of this order:
A high Confidence Score doesn't override the duplicate check. A duplicate is never escalated automatically, whatever its score.
Duplicates don't count toward pattern qualification. Only original events count as qualifying events.
Deep Analysis is not applied to duplicates. It runs only on events that are escalated.
How to review duplicate events
Go to Logs > Non-Escalated Events.
Filter Outcome Type by Duplicate.
In the table, hover over the info icon next to Duplicate to see a short explanation and the ID of the original event it duplicates. The card stays open until you close it.
Open the event and select the Governance tab. Under Event outcome reason, you'll see Duplicate followed by the original event's number, for example Duplicate of event STC-1A2B3C4D.
To open the original event, select the View link that follows, which shows the original event's number.
If Kinectify couldn't find the original event, the Governance tab shows Duplicate detection-flagged event; original not resolved. instead, with no View link, and the hover card shows a dash in place of the original event's ID. The event is still a duplicate and is not escalated.
Duplicate events are kept for the same period as other non-escalated events.
How to escalate a duplicate
If you believe a duplicate still needs to be investigated, you can escalate it yourself.
Open the event from the Non-Escalated Events log.
Select Escalate event.
Enter a Justification. You can't escalate without one.
Select Escalate event to confirm.
Kinectify creates an alert on the Alerts Work Page, and the event shows as Manually Escalated in the log. Escalating the same event again doesn't create a second alert. Once escalated, the event no longer appears when you filter by Duplicate.
Escalate event is available on any non-escalated event, not only duplicates.
Alerts built from several events
When an Active alert is built from several qualifying events that share transactions, Kinectify never counts the same transaction twice in the alert's totals. An event whose transactions are all already counted isn't counted again, so the event count reflects how many times the activity actually occurred.
The settings warning
In Settings > Alerts (Beta), a warning appears on an alert type when its Detection Window is longer than how often monitoring runs for it:
Your configured detection window for this typology will result in duplicate events.
The warning tells you to expect duplicate events for that alert type in the Non-Escalated Events log.
How this differs from Legacy alerts
For Legacy alerts, Kinectify doesn't create an alert when an alert of the same type, for the same player and property, already contains exactly the same transactions. If the transactions or the alert type differ in any way, a new alert is still created. The duplicate isn't recorded anywhere you can see. For Active alerts, every duplicate is recorded in the Non-Escalated Events log and can be escalated.
What deduplication does not do
Does not delete events. Every duplicate stays in the Non-Escalated Events log.
Related Articles
What happens to events below the escalation threshold?
What is the alert window?