Question

During an active incident, a Google SecOps SOAR playbook executes a multi-step containment sequence against a compromised workload: (1) disable the associated GCP service account key, (2) apply a deny-all firewall rule to the VM, and (3) revoke the user's active OAuth sessions. Step 1 and step 2 succeed, but step 3 fails because the identity provider API times out. The playbook halts. The on-call engineer must decide how the playbook should be designed to handle this partial-failure state. Which design choice best preserves incident response integrity?

Accepted Answer

Design the playbook to preserve completed containment actions, record the partial-completion state in the case, and route the failed step to a manual analyst task with retry capability rather than rolling back.

Answer

Configure the playbook so that any step failure automatically rolls back all prior successful containment actions, restoring the workload to its pre-playbook state before escalating to an analyst.

Answer

Have the playbook silently retry step 3 indefinitely in a loop until the identity provider API recovers, keeping the case open with no analyst notification.

Answer

Mark the case as resolved after steps 1 and 2 succeed, since network and key-based access are already blocked, and treat the OAuth revocation as optional cleanup.