Duplicate incidents are created when an AD user group, Endpoint keyword/protocol rule, and an IDM/EDM rule exist in a single policy