Question

During an active incident, a Google SecOps SOAR playbook is triggered on a Compute Engine VM confirmed to be running a cryptominer with an established outbound C2 channel. The incident commander wants to both preserve forensic evidence and stop the ongoing resource abuse and data risk. The playbook currently jumps straight to terminating (deleting) the compromised instance. What is the BEST modification to the automated containment sequence?

Accepted Answer

First isolate the VM by applying a deny-all firewall rule/removing it from its network, then capture a disk snapshot and export memory if available, and only then proceed to terminate the instance

Answer

Immediately terminate the instance to stop resource abuse, then recreate it from the last known-good image so the snapshot reflects a clean state

Answer

Leave the VM fully connected and running while the playbook opens a case, so analysts can observe live C2 traffic before any containment action

Answer

Capture the disk snapshot first while the VM remains connected to the network, then terminate it without altering firewall rules