A Security Operations Center (SOC) team is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook to handle suspicious email attachments reported by end users. Place the following playbook execution steps in the correct operational sequence from initial alert ingestion to final incident closure.
- 1Parse the reported email artifact to extract indicators of compromise (IOCs), such as sender IP addresses, URLs, and attachment file hashes.
- 2Query threat intelligence feeds via API calls to retrieve reputation scores and contextual threat data for the extracted IOCs.
- 3Evaluate conditional branching logic to verify whether the aggregated threat score exceeds defined automated containment thresholds.
- 4Execute automated response actions to quarantine the email enterprise-wide and isolate affected host systems from the network.
- 5Update the ticketing system with full triage metrics, append execution logs, and notify the SOC team of the playbook completion.
Cevap
The correct operational sequence is: 1) Parse the email artifact to extract IOCs, 2) Query threat intelligence feeds via APIs for reputation data, 3) Evaluate conditional branching logic against policy thresholds, 4) Execute automated response actions (email quarantine and host isolation), and 5) Update the ticketing system and notify the SOC team.
Automated incident response playbooks follow a structured lifecycle: Ingestion/Parsing → Enrichment → Decision Evaluation → Remediation → Documentation. The playbook must first parse the reported email to identify specific indicators of compromise. It then enriches those indicators using threat intelligence APIs. Next, it evaluates conditional logic to confirm threat thresholds. Once confirmed, automated containment (such as mailbox quarantine and endpoint isolation) takes place. Finally, the playbook logs all actions in the ticketing system and notifies analysts.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Workflow Sequencing
Tahmini Süre:1m 30s