Examkin

Soru

Zorluk: OrtaSecurity Automation and Orchestration (SOAR)

An enterprise security platform detects an exposed cloud service API key in a public code repository. Arrange the steps of an automated Security Orchestration, Automation, and Response (SOAR) playbook into the correct operational sequence from initial alert detection to incident ticket resolution.

  1. 1Ingest and parse the alert payload received via webhook from the secret detection scanner.
  2. 2Query cloud IAM and SIEM logs to enrich the alert with identity context, key permissions, and active usage logs.
  3. 3Execute automated API calls to revoke the leaked API key and terminate associated active session tokens.
  4. 4Query cloud audit logs to extract all API actions initiated by the key prior to revocation and attach them to the case file.
  5. 5Generate a high-priority ticket in the ITSM platform and notify the Security Operations Center team with summary metrics.

Cevap

The correct operational sequence for the SOAR playbook is: (1) Ingest and parse the alert payload received via webhook from the secret detection scanner, (2) Query cloud IAM and SIEM logs to enrich the alert with identity context, key permissions, and active usage logs, (3) Execute automated API calls to revoke the leaked API key and terminate associated active session tokens, (4) Query cloud audit logs to extract all API actions initiated by the key prior to revocation and attach them to the case file, and (5) Generate a high-priority ticket in the ITSM platform and notify the Security Operations Center team with summary metrics.
A standard automated SOAR playbook follows a precise operational lifecycle: (1) Incident ingestion & parsing, (2) Contextual enrichment via integrations, (3) Rapid automated containment, (4) Forensic artifact collection, and (5) Incident documentation & analyst notification.

Adım Adım Çözüm

1
Ingest and parse incoming webhook trigger.
The SOAR tool validates the alert payload content and starts playbook execution.
Automation requires a parsed payload to extract key parameters like API key ID and repository source.
2
Perform contextual enrichment using API integrations.
Identity, permission scope, and recent activity logs are gathered.
SOAR playbooks perform enrichment prior to taking action to evaluate impact and avoid disabling critical production systems blindly.
3
Perform automated containment via API integration.
Compromised credentials are neutralized immediately.
Fast automated mitigation reduces attacker dwell time and prevents lateral movement or data exfiltration.
4
Collect and attach forensic audit logs.
Historical event logs associated with the key are attached to the incident record.
Preserving audit trails immediately after containment ensures evidence integrity for secondary investigation.
5
Create an ITSM ticket and dispatch notifications.
An incident ticket is logged and human analysts are briefed on the automated actions taken.
Concluding with administrative logging and analyst notification completes the workflow and satisfies compliance tracking.

Anahtar Kavram

SOAR Incident Response Workflow Sequence
Bu soruyu puanla

Konular

Security Automation and Orchestration (SOAR)

Bu konudan daha fazla soru