Question

During a confirmed ransomware incident, a Google SecOps SOAR playbook must contain 40 compromised endpoints identified in a single case. The current playbook design loops through each asset sequentially, calling the EDR isolation API one host at a time, and the total isolation takes over 25 minutes—enough time for the ransomware to spread further across the fleet. Analysts also report that a few of the isolation calls fail intermittently due to transient EDR API errors, and the playbook halts entirely when any single call fails. Which playbook redesign best reduces containment time while preserving reliability?

Accepted Answer

Refactor the containment step to fan out isolation actions in parallel across all assets, and wrap each individual action with independent retry-on-failure logic so a single transient error does not stop the overall playbook.

Answer

Keep the sequential loop but increase the playbook's global timeout so it has enough time to complete all 40 isolations before failing.

Answer

Add a single global retry that restarts the entire playbook from the beginning whenever any isolation call fails, ensuring all hosts are eventually contained.

Answer

Insert a manual analyst approval node before each host's isolation so an analyst can confirm every action, preventing accidental isolation of critical systems.