Question

Following the containment and eradication of a compromised service account that was used for data staging in a GCP project, your SOC lead asks you to run the post-incident review. During the review, one engineer admits they ignored an earlier low-severity SecOps alert about anomalous service account activity because they were overloaded. The team wants to prevent recurrence. Which approach best aligns with effective root cause analysis and post-incident practices?

Accepted Answer

Conduct a blameless post-incident review focused on the alert-triage workflow gap, document a timeline of detection-to-response, and produce actionable items such as tuning the low-severity detection and adjusting SOAR routing thresholds.

Answer

Formally reprimand the engineer who dismissed the alert and add their name to the incident report so accountability is clear to leadership.

Answer

Skip the retrospective since the incident is already contained, and instead immediately raise the severity of all service-account detections to Critical to guarantee they are never missed again.

Answer

Close the case and rely on the SOAR playbook's automatic remediation logs as the sole record, since they capture what actions were taken during containment.