WIP - Add Exception Duplication Checking

[eric-forte-elastic]

Pull Request

Issue link(s):

Resolves: #5664

Summary - What I changed

Note

It is unclear and needs to be determined if item_ids are unique across spaces and can function as an identifier similarly to list_ids

1. New helper: _deduplicate_comments()

• Purpose: Removes duplicate comments on an exception item by comment text.
• Behavior: Takes an exception item dict, shallow-copies it, and builds a new comments list that keeps only the first occurrence of each comment (using a seen_texts set).
• Return: The copied item with comments replaced by the deduplicated list; the original is not mutated.

2. Changes to parse_exceptions_results_from_api()

• Item deduplication by item_id:
  • Added seen_item_ids: set[str] to track already-seen exception item IDs.
  • For each API result that is an exception item: if it has an item_id and that ID is already in seen_item_ids, the result is skipped (duplicate).
  • When an item is kept and has an item_id, that ID is added to seen_item_ids.
• Comment deduplication: Before appending an exception item, the code calls _deduplicate_comments(result) and appends the returned item instead of the raw result.

Result

• Items: Duplicate exception items from the Kibana export API (same item_id) are dropped before building TOML.
• Comments: Duplicate comments within each kept item are removed so the repo doesn’t accumulate repeated comments (e.g. auto-generated “pre-filled from alert” text).

How To Test

Checklist

• Added a label for the type of pr: bug, enhancement, schema, maintenance, Rule: New, Rule: Deprecation, Rule: Tuning, Hunt: New, or Hunt: Tuning so guidelines can be generated
• Added the meta:rapid-merge label if planning to merge within 24 hours
• Secret and sensitive material has been managed correctly
• Automated testing was updated or added to match the most common scenarios
• Documentation and comments were added for features that require explanation

Contributor checklist

• Have you signed the contributor license agreement?
• Have you followed the contributor guidelines?