A security team creates an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle alerts generated when a suspicious email attachment is reported. Place the following automated playbook steps in the correct chronological order from first to last.
- 1The SOAR platform ingests the alert payload from the email security gateway via a webhook.
- 2The playbook queries an external threat intelligence service to analyze the attachment's file hash.
- 3The playbook sends an API command to Endpoint Detection and Response (EDR) agents to quarantine the malicious file.
- 4The SOAR platform updates the IT Service Management (ITSM) ticket with the investigation findings and resolves the case.
Answer
The correct chronological order of the SOAR playbook steps is: 1) Ingest alert payload from email security gateway via webhook, 2) Query external threat intelligence service to analyze file hash, 3) Send API command to EDR agents to quarantine malicious file, and 4) Update ITSM ticket with findings and resolve case.
Standard SOAR playbooks follow a structured sequence: initial ingestion of alert data triggers the playbook, threat intelligence enrichment evaluates indicators of compromise, automated containment tools neutralize confirmed threats, and ticketing integrations record final documentation.
Step-by-Step Solution
Key Concept
SOAR Playbook Lifecycle (Ingest -> Enrich -> Contain -> Document)