A security engineer is configuring an automated Security Orchestration, Automation, and Response (SOAR) playbook designed to ingest high-confidence malicious IP addresses from a Threat Intelligence Platform (TIP) and instantly push block rules to perimeter firewalls. During a recent threat feed update, a shared public DNS resolver IP was misclassified as malicious, causing the playbook to automatically block critical outgoing traffic. Which modification to the playbook workflow logic should be implemented to prevent future unintended outages?
- Incorporate an automated exclusion list verification step prior to invoking the firewall API block action.Cevap
- BReclassify the automated firewall blocking action from a corrective control to a detective control within the SOAR policy settings.
- CUpgrade the feed integration protocol from basic API key authentication to SAML-based user authorization grants.
- DSet the playbook execution trigger to run unconditionally on all ingested indicators without applying confidence score thresholds.
Cevap
Incorporate an automated exclusion list verification step prior to invoking the firewall API block action.
The correct response is to incorporate an automated exclusion list verification step prior to executing the blocking action. In SOAR playbook design, guardrails such as allow-lists or sanity-check filters prevent automated integrations from disrupting critical infrastructure or common enterprise services.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Guardrails and Conditional Logic