Question

During post-incident review of a confirmed data-exfiltration case, the SOAR playbook auto-closed 40 related alerts as duplicates before an analyst could confirm they were truly identical. The IR lead wants to prevent premature closure of alerts that may contain distinct evidence while still reducing analyst workload from duplicate noise. Which change to the incident-response process best balances these goals?

Accepted Answer

Configure the playbook to group similar alerts into a single case for analyst review, requiring an explicit analyst decision node before any alert is closed as a duplicate

Answer

Disable all automated alert grouping and require analysts to manually triage every alert individually

Answer

Increase the auto-close confidence threshold so only alerts with a 100% indicator match are closed, and let the rest auto-close after a 24-hour timer

Answer

Route all duplicate alerts to a low-priority queue that is purged weekly without analyst review