SASI Alert Dedup icon

SASI Alert Dedup

Dedup a SASI Alert/Message

SASI Alert Dedup

AI-generated

Overview

The SASI Alert Dedup node is designed to deduplicate SASI alerts or messages using an AWS DynamoDB table. It checks whether a given alert (identified by its id field in the input JSON) has already been processed for a specific monitoring system, as defined by the "Monitoring System ID". If the alert is new (not found in the table), it marks it as not duplicated; otherwise, it flags it as duplicated.

Common scenarios:

  • Preventing duplicate processing of alerts/messages in automated workflows.
  • Ensuring that only unique alerts are acted upon in monitoring or notification systems.
  • Integrating with AWS DynamoDB for scalable and persistent deduplication across distributed systems.

Practical example:
A security operations workflow receives alerts from multiple sources. This node ensures each unique alert is processed only once per monitoring system, avoiding redundant notifications or actions.

Properties

Name Meaning
Table Name DynamoDB table to be used for deduplication. Options are dynamically loaded from your AWS account.
Monitoring System ID Unique numeric identifier for this monitoring system instance. Used to separate deduplication scopes.

Output

The node outputs the original input data with additional fields in the json object:

  • duplicated: Boolean.

    • true if the alert/message was already present in the DynamoDB table (i.e., it's a duplicate).
    • false if the alert/message is new (not a duplicate).

  • errored: Boolean (optional).

    • Present and set to true if there was an error during processing and the node is configured to continue on failure.

Example output:

{
  "id": "alert-123",
  "message": "CPU usage high",
  "duplicated": false
}

If an error occurs and "Continue On Fail" is enabled:

{
  "id": "alert-123",
  "message": "CPU usage high",
  "errored": true
}

Dependencies

  • AWS Credentials:
    Requires valid AWS credentials configured in n8n to access DynamoDB tables.
  • DynamoDB Table:
    The specified table must exist in your AWS account.
  • n8n Configuration:
    The node expects the AWS credential type named aws to be available.

Troubleshooting

  • Missing or Incorrect AWS Credentials:
    Error: "The security token included in the request is invalid."
    Resolution: Ensure your AWS credentials are correctly configured in n8n.

  • Table Not Found:
    Error: "Requested resource not found" or similar.
    Resolution: Verify the selected DynamoDB table exists and the name is correct.

  • Input Data Missing id Field:
    Error: May result in unexpected deduplication behavior.
    Resolution: Ensure each input item contains a unique id field.

  • Insufficient Permissions:
    Error: "User is not authorized to perform: dynamodb:PutItem"
    Resolution: Update your AWS IAM policy to allow required DynamoDB actions.

Links and References

Discussion