Question

A SecOps SOAR playbook automatically isolates any endpoint whose alert exceeds a risk score of 90. During a triage review, an analyst discovers that the playbook isolated a critical production database server based on a detection that was later confirmed to be a false positive caused by a legitimate backup agent. The isolation caused a two-hour outage before manual intervention. Leadership asks the incident response team to redesign the containment step so automated isolation remains fast for genuine threats but avoids catastrophic disruption to high-value assets. Which redesign best balances these requirements?

Accepted Answer

Add a conditional branch that checks asset criticality from the enriched CMDB/asset context; for critical-tier assets, route to a human approval gate before isolation while allowing automatic isolation to proceed for non-critical assets.

Answer

Lower the isolation risk-score threshold to 70 so more endpoints are contained earlier, reducing the chance that a real threat is missed on critical systems.

Answer

Remove automated isolation entirely and require all containment actions to be performed manually by a Tier 2 analyst after case review.

Answer

Keep the automated isolation but add a scheduled playbook that automatically un-isolates any host after 30 minutes regardless of investigation status.