A security analyst is configuring a Security Orchestration, Automation, and Response (SOAR) playbook to automatically handle alerts triggered when a cloud IAM access key is exposed in a public repository. Arrange the automated response workflow steps into the correct chronological sequence from first step to final step.
- 1Ingest the alert payload and query cloud audit logs to enrich the event with recent API activity associated with the exposed access key.
- 2Revoke active session tokens and attach an inline deny policy to the compromised IAM identity to prevent further unauthorized access.
- 3Generate a replacement access key pair and update the stored credential in the enterprise secrets manager.
- 4Send a notification containing the incident audit log and ticket reference to the application owner for validation and ticket closure.
Cevap
The correct execution sequence begins with event ingestion and log enrichment, followed by automated identity containment (session revocation and policy denial), automated credential remediation (key rotation in secrets manager), and concludes with stakeholder notification and incident documentation.
The standard SOAR playbook lifecycle dictates that alerts must first be enriched with contextual log data. Once scope is established, automated containment actions (revoking sessions and denying API actions) are applied to stop active exposure. Following successful isolation, remediation actions rotate credentials in secret stores, and finally, notification tasks update human analysts and close the automated ticket workflow.
Adım Adım Çözüm
Anahtar Kavram
SOAR Automated Incident Response Lifecycle