A cybersecurity analyst is configuring an automated incident response playbook within a Security Orchestration, Automation, and Response (SOAR) platform to process high-severity credential dumping alerts triggered by Endpoint Detection and Response (EDR) agents. To effectively contain potential lateral movement without introducing catastrophic operational downtime to enterprise operations, which of the following playbook logic designs should be implemented?
- AInitiate automated endpoint network isolation indiscriminately across any host triggering the EDR credential dumping alert rule.
- Apply automated host isolation to standard workstation alerts while routing alerts involving Tier-0 infrastructure, such as domain controllers, to a Human-in-the-Loop (HITL) manual approval gate before containment.Cevap
- CReclassify the SOAR playbook containment action from a corrective security control to a detective log archiving rule when high-value assets are identified.
- DConfigure the playbook to automatically authenticate to domain controllers via basic HTTP authentication webhooks to execute local account disablement scripts.
Cevap
Implement conditional branching that executes automated network isolation on standard endpoints while enforcing a Human-in-the-Loop (HITL) manual authorization step for critical Tier-0 infrastructure.
The correct option correctly implements conditional branching and Human-in-the-Loop (HITL) governance in SOAR workflows. Isolating standard endpoints immediately limits credential abuse and lateral movement, whereas requiring analyst verification for Tier-0 assets (like domain controllers) mitigates the risk of automated service denial across the enterprise.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Logic and Operational Risk Management