An enterprise incident response team is evaluating a newly deployed Security Orchestration, Automation, and Response (SOAR) playbook intended to contain compromised systems. The playbook automatically executes a script that isolates host network interfaces upon receiving high-severity endpoint alerts. Security engineers are concerned that automated execution against critical infrastructure, such as domain controllers or primary database hosts, could cause severe business disruptions in the event of a false positive. Which of the following workflow modifications best mitigates this risk while preserving automated containment capabilities for standard endpoints?
- Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.Answer
- BAdjust the playbook logic to automatically suppress and clear all high-severity alerts that originate from critical infrastructure assets.
- CReclassify the automated host isolation script from a corrective control to a detective control by changing the SIEM log retention period.
- DConfigure the playbook to re-authenticate the asset's administrative service account credentials before determining if the system has permissions to be isolated.
Answer
Implement conditional branching that requires human-in-the-loop manual authorization before taking isolation actions against designated high-criticality assets.
Implementing conditional branching with human-in-the-loop (HITL) approval for critical assets allows security operations to isolate standard endpoints automatically while preventing accidental outages of critical infrastructure during false positives.
Step-by-Step Solution
Key Concept
SOAR Playbook Logic and Human-in-the-Loop (HITL) Governance
Estimated Time:1m 30s