Question

A Google SecOps SOAR playbook for automated endpoint isolation includes a manual approval node requiring a Tier-2 analyst to confirm before the containment action executes. During an overnight incident, the on-call analyst does not respond, and the approval node times out after 30 minutes while a confirmed ransomware process continues encrypting files on the host. The incident response lead wants to redesign the playbook so that time-sensitive, high-confidence detections are not stalled by an unavailable approver, while preserving human oversight for lower-confidence cases. Which redesign best achieves this?

Accepted Answer

Add a conditional branch that auto-executes containment for high-confidence detections above a defined risk threshold, while routing lower-confidence cases through the manual approval node with an escalation-on-timeout to a secondary approver.

Answer

Remove the manual approval node entirely so all containment actions execute automatically regardless of detection confidence.

Answer

Increase the approval node timeout from 30 minutes to 4 hours so the analyst has more time to respond during overnight shifts.

Answer

Keep the approval node but configure the playbook to close the case automatically if the approval times out, so the queue stays clean.