Question

During an active data-exfiltration incident, your SOAR playbook automatically identifies a compromised GCS bucket that an attacker used to stage stolen files. The playbook is configured to delete the staged objects to stop further exfiltration. However, your legal team has just placed a litigation hold on the affected project because the incident may lead to regulatory action. As the SecOps engineer, what is the MOST appropriate way to modify the containment step to balance rapid response with legal obligations?

Accepted Answer

Replace the deletion action with a step that revokes external access via IAM/bucket policy and enables Bucket Lock or object retention, then flags the objects for evidence preservation

Answer

Keep the deletion action but first copy the objects to an analyst's personal workstation so a local forensic copy exists

Answer

Disable the containment step entirely and wait for legal to manually approve any action to avoid destroying evidence

Answer

Proceed with deletion because stopping active exfiltration always takes priority over evidence retention obligations