Question

A SecOps SOAR playbook is triggered for a high-severity alert indicating a compromised user account with confirmed credential theft. The playbook is designed to automatically disable the user in Google Workspace, revoke active OAuth tokens, and quarantine the user's Chrome-managed device. During a review, the incident response lead observes that the same playbook occasionally fires on false positives from a noisy detection rule, and an auto-disable of an executive account during business hours caused a significant operational disruption. The team wants to retain automated speed for clear-cut cases while preventing disruptive actions on ambiguous ones. What is the BEST playbook design change to achieve this?

Accepted Answer

Insert a conditional branch that evaluates enrichment/confidence signals; auto-execute containment when confidence is high, but route lower-confidence cases to a manual analyst approval step before disabling the account

Answer

Remove all automated containment actions and convert the playbook to a notification-only workflow so analysts always act manually

Answer

Keep the fully automated containment but schedule the playbook to only run outside of business hours to avoid disrupting executives

Answer

Lower the severity threshold that triggers the playbook so it fires less often and reduces the chance of false positives