Question

A SOAR playbook in Google SecOps automatically triages phishing alerts: it enriches the sender domain with GTI, extracts URLs, and detonates attachments in a sandbox. The security team wants the playbook to fully quarantine the user's mailbox and disable their account ONLY after a senior analyst reviews the enrichment results, because past false positives locked out executives during business-critical periods. However, the team also insists that time-sensitive containment must not stall indefinitely if no analyst responds. How should the playbook be designed to satisfy both requirements?

Accepted Answer

Insert a manual action (analyst decision) node after enrichment that gates the containment actions, and configure it with a timeout that routes to a defined fallback path (e.g., escalate/notify) if no response is received within the SLA window.

Answer

Remove all human input from the playbook and rely solely on the GTI confidence score threshold to decide whether to quarantine and disable the account automatically.

Answer

Run the containment actions immediately upon alert ingestion, then send the analyst a notification so they can manually roll back the changes if it turns out to be a false positive.

Answer

Split the workflow into two fully independent playbooks with no shared case context, one for enrichment and one for containment, and have the analyst manually launch the second playbook every time.