Conflict resolution

Overview

When importing content, either manually, from the Library, or from a content pack, it is possible that the content to be imported conflicts with content that is already present in the target setup. Investigations, alerts, modules, etc. with the same name as those found among the imported items may already exist in the same locations where the items are copied. Learn here how to deal with these conflicts and resolve them.

Options for resolving conflicts

The resolution of conflicts is a step in the import process, regardless of the method used for importing content. A dialog displays a list of the offending items along with a choice of possible correction actions to remediate the different issues.

The options available for resolving conflicts depend on the type of content to be imported. The default option proposed by the system to resolve a conflict follows this conservative rule:

Existing content must not be broken.

See below the list of all possible actions with an explanation of their meaning. Keep in mind that not all of the options are eligible for any kind of item to be imported and that they may have different effects on different kinds of items:

Skip

The item will not be imported.

Replace

The item to be imported takes the place of the conflicting existing item.

Replace all

All the existing items will be replaced with the new ones.

Import a copy and Keep both

Both options keep a copy of both the existing item and the item to be imported by automatically renaming this latter, adding a numerical index to its name. The system displays one option or the other for selection depending on whether renaming the item to be imported may break dependencies or not.

Merge

The item to be imported is combined with the existing item to produce an item that is a mixture of both.

Conflicts in metrics

While all other items are identified solely by their name, metrics can also be identified by their unique identifier (UID). Although not visible to the user, the system can verify the UIDs of two conflicting metrics that have the same name to determine if they are different versions of the same original metric (same UIDs) or if they are actually two completely different metrics that happen to have the same name (different UIDs).

The options for resolving conflicts between metrics are different when they have the same UID and when they have distinct UIDs.

Choosing the appropriate option

Skip

When the system detects that the item to be imported has exactly the same definition as the existing item with which it is in conflict, it automatically skips the import, notifying the user by displaying the action Skip (identical) in the list of conflicting items.

For the cases when the content is not identical, choose Skip if you want to preserve the definition of the existing item.

Replace

Replacing the definition of an existing item by that of an imported item has consequences that depend on the type of item imported:

Metrics

Replacing a metric clears the history of the metric in the Portal only if its new definition introduces major changes (for instance, it has different grouping options). You can only replace a metric by another when both have the same UID.

Services

Replacing a service resets its corresponding Service View in the Finder and its previously computed baselines. Nevertheless, the history of the service is preserved in the Portal.

Import a copy and Keep both

When keeping a copy of both the existing item and the imported item, the latter is renamed with an index. For instance, if you have an item called Compliance and you import another item with the same name (therefore causing a conflict with the existing item), the system assigns it the name Compliance (2) to indicate that it is a different version of the item.

There are two formulations for this option depending on the type of the items to be imported. The system suggests either one of:

Import a copy, for categories and services

Since conditions in investigations and metrics may depend on the names of categories and services, renaming the imported categories and services may result in broken conditions.

Keep both, for investigations, folders of investigations, alerts, one-clicks, metrics with different UIDs, and modules

The system proposes this formulation for all other types of items that may be renamed safely. The case of modules is special in the sense that keeping both the existing and the imported modules is the only available action for resolving the conflict; therefore, the system automatically takes this action without prompting the user.

Merge

Two types of items may merge with others of their kind:

Folders (of investigations, alerts, or one-clicks)
Categories

When folders are merged, the resulting folder combines the contents of the existing and the imported folders. If individual items inside the folder conflict, you must resolve those conflicts separately.

When merging two categories, all the keywords that are present in the category to be imported and not in the existing category are added to the resulting category. The result of the merge, understood as a set operation, is thus the union of the keywords in the two categories.

To determine what to do with the keywords that are present both in the category to be imported and in the existing category, but defining different auto-tagging rules, the merge operation comes in two flavors:

Merge - preserving auto-tagging rules

To preserve the auto-tagging rules of the keyword in the existing category against the auto-tagging rules defined by the keyword to be imported.

Merge - replacing auto-tagging rules

To substitute the auto-tagging rules of the keyword in the existing category for the auto-tagging rules of the keyword to be imported.

For categories, it is recommended to choose first Import a copy before committing on a Merge. Decide later whether you really want to merge the two categories. If so, re-import and choose Merge. After merging, check the order of the keywords in the resulting category.