An automated Security Orchestration, Automation, and Response (SOAR) workflow is triggered upon detecting malicious code execution on a workstation. In what order should the playbook execute the following response actions to ensure effective containment while preventing unauthorized operational disruption?
- 1Query Endpoint Detection and Response (EDR) and threat intelligence APIs to enrich the alert with host details and file hash reputation.
- 2Evaluate the enriched incident data against playbook conditional logic to assess asset criticality and threat severity.
- 3Issue an automated API call to the EDR agent to isolate the compromised workstation from the local network.
- 4Submit a human-in-the-loop (HITL) approval request to a Tier 2 analyst prior to revoking the associated user's domain credentials.
- 5Update the IT Service Management (ITSM) ticket with execution logs and automatically close the alert upon analyst sign-off.
Answer
The correct sequence of actions for the SOAR playbook is: 1) Query EDR and threat intelligence APIs to enrich the alert, 2) Evaluate enriched incident data against conditional logic, 3) Issue an automated API call to isolate the workstation, 4) Submit a human-in-the-loop approval request for credential revocation, and 5) Update the ITSM ticket and close the alert.
Effective SOAR playbooks follow a structured lifecycle: enrichment, evaluation, containment, human-in-the-loop approval for high-risk actions, and final ticketing/closure. Gathering threat intelligence and endpoint details first provides the necessary telemetry. Evaluating conditional logic determines response severity. Performing automated endpoint isolation halts lateral movement immediately. Requesting analyst approval before identity credential revocation avoids unnecessary business downtime. Finally, updating and closing the ITSM ticket documents the full audit trail.
Step-by-Step Solution
Key Concept
SOAR Playbook Incident Response Execution Order