Remove Unique Label — Shared Indicator Cleanup

Overview

This playbook removes the unique label from an Indicator when it has been labelled with both 'unique' and 'shared-indicators' at the same time. This occurs when an Indicator initially seen from a single feed is later ingested by a second feed, leaving both labels present simultaneously.

It is the companion cleanup playbook to Indicator Feed Labelling — Unique and Shared and should be deployed alongside it.

Dependencies

This playbook depends on the Indicator Feed Labelling — Unique and Shared playbook being active. The unique and shared-indicators labels must exist in the platform before activation.

This playbook is also required for this Threat Intelligence Quality dashboard

How to Use It

A. Import and Configure Import the playbook JSON via Automations → Playbooks → Import. It will import in a disabled state.

Open the Listen for Indicator Events trigger node and select the unique and shared-indicators labels in the label filter dropdowns.

Open the Remove Unique Label node and select the unique label in the label action dropdown.

B. Activate Click Start. No ongoing interaction is required — the playbook runs automatically whenever an Indicator is updated with both labels present.

C. Expected Outcome When an Indicator carries both unique and shared-indicators labels, the unique label is removed, leaving only shared-indicators. You can confirm this is working by checking the Labels field on recently updated Indicators and reviewing execution history in Automations → Playbooks.