Question

A SOAR playbook in Google SecOps responds to a confirmed credential-phishing incident. It has already disabled the compromised user account, revoked active sessions, and forced a password reset. The lead responder wants the playbook to avoid prematurely closing the case and to ensure the threat is truly eradicated before the case is auto-resolved. Which playbook step should be added before the case-closure action to best support this goal?

Accepted Answer

Add a verification step that re-queries UDM for any post-remediation authentication or mailbox-rule activity tied to the affected identity, and gate closure on a clean result

Answer

Add a step that immediately deletes the user's mailbox and recreates the account from a backup template

Answer

Add a notification step that emails the SOC distribution list summarizing the actions taken

Answer

Add a step that increases the case severity to Critical so an analyst reviews it later