A security operations team is configuring an automated Security Orchestration, Automation, and Response (SOAR) workflow to handle initial triage and containment for incoming high-severity suspicious email alerts. Which of the following tasks represent safe, effective automated steps to include in the initial playbook execution prior to analyst review? (Select TWO.)
- Query external threat intelligence APIs to verify the reputation scores of URLs and attachment hashes found in the message.Answer
- Issue API calls to the email gateway to quarantine the matching message across all internal employee mailboxes.Answer
- CTrigger an automated script to isolate primary network domain controllers if their IP addresses appear in the email headers.
- DAutomatically disable the Active Directory user accounts of all recipients immediately upon alert ingestion.
Answer
The correct response steps are to query external threat intelligence APIs for domain and hash reputation and to quarantine the email message across internal mailboxes using email gateway API integrations.
Automated SOAR playbooks perform best when executing rapid enrichment (such as querying threat intelligence feeds for malicious domain reputation) and targeted, low-risk containment (such as quarantining an email message across mailboxes via API). These steps neutralize immediate exposure while providing rich contextual data for analyst decision-making.
Step-by-Step Solution
Key Concept
SOAR Playbook Design and Low-Risk Automated Response