The Management Team is the parent of the SOC Team and, through hierarchy, owns all records of its child teams (Level 1, Level 2, Level 3).
The SOC Team is the direct parent of Level 1, Level 2, and Level 3 teams, meaning it owns all their records.

The falcon.log file records search-related activities and includes Elasticsearch operations such as indexing and query execution.

Duplicate actions often result from:
Multiple triggers (e.g., duplicate alerts)
Lack of idempotency checks
This is a subtle but common issue in automation workflows.