Question

During a live incident, a Google SecOps SOAR playbook automatically disabled a compromised service account and quarantined a Compute Engine VM. The on-call analyst determines that the VM quarantine is disrupting a critical payment-processing service and decides to reverse only the VM containment while keeping the service account disabled. The SOC manager later needs to reconstruct exactly who reversed which containment action and why, for a regulated post-incident review. Which approach best supports both the immediate operational need and the audit requirement?

Accepted Answer

Have the analyst reverse the VM quarantine through a playbook manual action with a required justification field, so the reversal is executed as a tracked case action and logged with the analyst's identity and reason in the case wall.

Answer

Have the analyst log into the GCP console directly and remove the network isolation firewall rule, then verbally brief the SOC manager afterward.

Answer

Disable the containment playbook globally so no automated actions fire, then manually restore the VM through the cloud provider API using the shared SOC service account.

Answer

Wait until the incident is closed and reverse all containment actions in a single bulk rollback so the audit trail shows one consolidated change event.