Question

A SecOps SOAR playbook has contained a compromised host by isolating it from the network, removed the malicious persistence mechanism, and rebuilt the host from a golden image. The incident commander wants to formally close the case. Before closing, what is the MOST important action the response team should take to ensure the eradication was effective and the threat does not silently reappear?

Accepted Answer

Deploy a time-bound detection rule and monitor the rebuilt host and related indicators for a defined recurrence window to confirm the threat does not return before closing the case.

Answer

Immediately close the case since the host was rebuilt from a trusted golden image, which eliminates any possibility of reinfection.

Answer

Delete the original disk snapshot and all captured forensic artifacts to reduce storage costs now that remediation is complete.

Answer

Re-run the containment isolation action a second time as an idempotency safeguard before closing the case.