Question

During an active incident, a SOAR playbook in Google SecOps has automatically isolated a production database VM after a high-confidence data-exfiltration detection. The isolation immediately broke a customer-facing billing service. The incident commander notes that the runbook did not account for the operational impact of containing a business-critical asset. Which improvement to the containment workflow best balances rapid response with business continuity for critical assets?

Accepted Answer

Add a conditional branch that checks the asset's criticality tier from enriched CMDB/asset context and routes critical-asset containment through a human approval gate before executing isolation

Answer

Remove automated isolation entirely and require all containment to be performed manually by analysts to avoid future service disruption

Answer

Increase the detection confidence threshold so the playbook only triggers on the most severe alerts, reducing the chance of isolating any asset

Answer

Configure the playbook to automatically roll back the isolation after five minutes if no analyst intervenes, restoring the service