During an incident response post-mortem, security analysts observed that an automated containment workflow inadvertently isolated a core database server following a low-fidelity intrusion alert. To maintain rapid automated response capabilities for routine systems while protecting vital infrastructure from self-inflicted service disruptions, which implementation modification should be applied to the playbook design?
- Add conditional logic to evaluate host criticality tags and divert high-impact system containment actions to a human-in-the-loop approval step.Answer
- BIncrease the playbook execution polling frequency to re-issue network isolation commands continuously until acknowledged by an analyst.
- CReclassify the automated action from an operational containment control to an administrative access review control.
- DConfigure the orchestration platform to require multi-factor authentication for service account API token requests prior to alert triage.
Answer
Add conditional logic to evaluate host criticality tags and divert high-impact system containment actions to a human-in-the-loop approval step.
Adding conditional evaluation of asset criticality tags allows SOAR playbooks to handle routine, low-risk systems fully automatically while routing high-value target alerts through a human-in-the-loop approval step. This prevents automated security tools from unintentionally disrupting critical services during false-positive alerts.
Step-by-Step Solution
Key Concept
SOAR Playbook Conditional Logic and Human-in-the-Loop (HITL) Integration