An organization's security team integrates an automated SOAR playbook with their container orchestration platform to terminate and redeploy application pods whenever runtime security threats are detected. Following a threat feed update, a high volume of false-positive alerts triggers continuous pod terminations, resulting in an application service outage. Which of the following workflow modifications best prevents this cascading operational disruption while preserving automated remediation capabilities?
- Implement rate-limiting thresholds and conditional human-in-the-loop approval triggers within the playbook logic before executing bulk pod terminations.Cevap
- BReconfigure the playbook to automatically isolate the underlying Kubernetes worker nodes immediately upon ingesting any runtime threat alert.
- CReplace the active SOAR containment playbook with a passive network intrusion detection system rule to log recurring alert occurrences.
- DUpdate the SOAR platform service account authentication method to utilize short-lived OAuth 2.0 bearer tokens instead of long-lived API keys.
Cevap
Implementing rate-limiting thresholds and conditional human-in-the-loop approval triggers within the playbook logic prevents runaway automated pod terminations while maintaining automated response capabilities.
The correct response introduces rate limiting and conditional human-in-the-loop approval steps into the SOAR workflow. This ensures that high-volume or rapid-succession actions are paused for analyst verification, preventing automated playbooks from causing large-scale availability outages while retaining rapid response capabilities for isolated incidents.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Logic and Operational Guardrails
Tahmini Süre:1m 15s