Question

During an active incident, a SecOps SOAR playbook detects that a service account is being used to enumerate storage buckets from an unusual region. The playbook is configured to automatically disable any credential flagged as compromised. However, this service account is also used by a production data-pipeline job that runs hourly and feeds a customer-facing dashboard. The analyst on call must decide how the containment step should proceed. Which approach best balances rapid containment with operational risk in the playbook design?

Accepted Answer

Add a conditional node that checks the account's asset-criticality and dependency context, then routes high-impact accounts to a human approval gate before disabling while auto-disabling low-impact accounts

Answer

Configure the playbook to always disable the credential immediately regardless of context, since containment speed must never be compromised during an active incident

Answer

Skip credential disablement entirely for any service account and instead only send a notification to the account owner for manual review

Answer

Rotate the service account key silently in the background without disabling access or notifying anyone, so the pipeline keeps running while the old key is invalidated