A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to contain endpoints exhibiting active ransomware encryption behavior. During testing, an automated containment playbook executed on a Domain Controller following a false-positive detection, causing enterprise-wide service disruptions. Which modification to the SOAR playbook logic best balances rapid automated containment with operational risk management for critical infrastructure?
- Insert a conditional decision node that routes host isolation actions for critical asset tags to an analyst manual approval step while automatically isolating non-critical endpoints.Answer
- BConfigure the automated playbook trigger to execute full network isolation on all endpoints regardless of asset tags whenever any high-severity endpoint alert is received.
- CRemove the automated containment playbook entirely and replace it with a detective SIEM dashboard counter to manually log ransomware indicators.
- DReconfigure the SOAR platform API integration with the endpoint detection tool from OAuth 2.0 bearer tokens to cleartext basic authentication.
Answer
The correct modification is to insert a conditional decision node that routes host isolation actions for critical asset tags to an analyst manual approval step while automatically isolating non-critical endpoints.
The correct choice implements asset-aware conditional logic within the SOAR playbook. By checking asset tags prior to containment actions, non-critical endpoints can be isolated immediately at machine speed, whereas high-impact assets (such as Domain Controllers or core servers) require a human-in-the-loop approval step to verify the alert before taking disruptive isolation measures.
Step-by-Step Solution
Key Concept
SOAR Playbook Triage and Safe Automated Containment Logic