Question

A SecOps SOAR playbook triggers on an endpoint alert initially graded 'Medium'. During execution, an enrichment step queries the asset CMDB and discovers the affected host is a production domain controller tagged 'crown jewel'. The playbook currently proceeds directly from enrichment to an automated 'isolate host' action gated by a 4-hour analyst approval SLA. The IR lead wants the playbook to react to this new context before waiting on the standard approval path. Which playbook design change best addresses this requirement?

Accepted Answer

Add a conditional branch after enrichment that recalculates case severity from asset criticality and, if it escalates to Critical, routes to an expedited on-call approval path with a shortened SLA before containment.

Answer

Remove the approval gate entirely for all domain controllers so isolation always executes automatically the moment enrichment identifies a crown-jewel asset.

Answer

Keep the static Medium severity but add a post-containment notification step that emails the IR lead after the 4-hour SLA elapses.

Answer

Configure the playbook to re-ingest the original alert as a new case with Critical severity so the SIEM detection engine re-scores it downstream.