Question

A SecOps analyst is designing a triage playbook in Google SecOps SOAR that fires for every endpoint malware alert. Analysts complain the playbook opens a case and pages the on-call engineer for every alert, including many that turn out to be benign quarantined files. The team wants to reduce paging noise without missing true positives. Which change to the playbook logic best addresses this while preserving investigative fidelity?

Accepted Answer

Add an early enrichment step that queries the EDR quarantine status and threat-intel reputation, then use a conditional block so cases only auto-escalate and page on-call when the file was not successfully quarantined or the reputation is malicious.

Answer

Lower the ingestion volume of EDR logs so fewer malware alerts are generated during peak hours.

Answer

Remove the paging action entirely and rely on analysts polling the case queue every hour during their shift.

Answer

Increase the detection rule severity threshold so only critical-severity alerts ever reach the playbook, discarding all medium and low alerts.