During a incident response simulation, an automated Security Orchestration, Automation, and Response (SOAR) playbook triggered by a high-fidelity alert executed a host isolation script against a primary Domain Controller, causing an enterprise-wide network outage. Which modification to the playbook workflow best mitigates the operational risk to critical infrastructure while preserving automated response speed for standard endpoints?
- Insert a conditional filter to inspect asset classification tags, routing domain controllers to a human-in-the-loop approval step while continuing automated isolation for standard workstations.Answer
- BReclassify the host isolation script as a detective control within the playbook settings to prevent active execution on server assets.
- CUpdate the SOAR platform API credentials to use OAuth 2.0 access tokens instead of static API keys prior to calling isolation APIs.
- DModify the playbook trigger conditions to automatically execute perimeter firewall blocks against domain controller IP addresses upon alert generation.
Answer
Insert a conditional filter to inspect asset classification tags, routing domain controllers to a human-in-the-loop approval step while continuing automated isolation for standard workstations.
Effective SOAR playbook design pairs automation speed with operational risk management. Introducing conditional logic based on asset metadata ensures standard workstations are isolated rapidly upon alert detection, whereas high-criticality assets (such as Domain Controllers) trigger a human-in-the-loop (HITL) approval request to prevent accidental service outages.
Step-by-Step Solution
Key Concept
SOAR Playbook Conditional Branching and Human-in-the-Loop (HITL) Approval Controls