An enterprise integrates a Security Orchestration, Automation, and Response (SOAR) platform to process phishing reports. The automated playbook extracts embedded URLs, checks them against threat intelligence feeds, and upon finding a positive match, executes an automated script that revokes the compromised user's directory account and isolates their host machine. During a routine business operation, a false-positive threat feed match triggers the playbook, causing the domain administrator account to be automatically disabled and isolating a primary domain controller. Which of the following modifications to the SOAR playbook logic best mitigates the risk of operational disruption while preserving automated triage efficiency?
- Insert a conditional decision node requiring Human-in-the-Loop (HITL) approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.Cevap
- BLower the threat intelligence API confidence threshold trigger so automated containment actions execute only when low-fidelity indicators are detected.
- CReclassify the automated host isolation action from a corrective security control to a detective security control so domain controllers remain accessible during incident analysis.
- DReplace API key authentication between the SOAR platform and Active Directory with role-based authorization parameters on individual end-user workstations.
Cevap
Inserting a conditional decision node requiring Human-in-the-Loop approval prior to executing high-impact containment actions on identified critical infrastructure or privileged accounts.
The correct option addresses the root cause of automated operational failure by introducing a Human-in-the-Loop (HITL) approval step for critical systems and privileged accounts. SOAR playbooks should automate low-risk investigation and triage tasks automatically, but high-impact containment actions against critical infrastructure (like domain controllers) must incorporate analyst authorization to prevent business disruption caused by false positives.
Adım Adım Çözüm
Anahtar Kavram
SOAR Playbook Governance and Human-in-the-Loop (HITL) Safeguards