Question

During response to a malware incident, a Google SecOps SOAR playbook has already isolated the affected host and removed the malicious binary. Before the playbook advances to the case-closure step, the responding engineer notices that the same file hash was written to a network file share that three other hosts mount. What is the MOST appropriate action to build into the playbook at this stage to prevent premature closure?

Accepted Answer

Add an eradication-scoping step that queries UDM for all hosts with the malicious hash or persistence artifacts across the environment before allowing the case to close

Answer

Close the case immediately since the originating host was isolated and the binary was deleted, then open a new case only if reinfection alerts fire

Answer

Restore the originating host from backup and re-enable network access to confirm the threat does not return

Answer

Escalate the case to the CISO for a manual decision because automated playbooks cannot handle multi-host malware