Question

During an incident, a Google SecOps SOAR playbook detects that a service account's credentials were exfiltrated and are now being used from an unusual ASN to enumerate Cloud Storage buckets. The IR lead wants the playbook to stop the ongoing abuse quickly while preserving the ability to investigate what the attacker already accessed. Which containment action should the playbook execute first?

Accepted Answer

Disable the service account and revoke its active OAuth access tokens / keys via the IAM integration, then continue enrichment and evidence collection

Answer

Delete the service account entirely to guarantee the attacker cannot reuse it

Answer

Apply a VPC Service Controls perimeter change across the whole project to block all egress before taking any account action

Answer

Open a manual analyst decision node and wait for approval before any automated action is taken