Question

Your SOC's SecOps SOAR platform runs a triage playbook that fires on every phishing alert. The playbook enriches each sender IP and URL against a third-party threat intelligence vendor whose API enforces a strict rate limit of 100 lookups per minute. During a large phishing campaign, hundreds of near-identical alerts arrive within a few minutes, and the playbook begins failing enrichment steps because the API returns HTTP 429 (Too Many Requests). Analysts complain that cases now open with empty enrichment context. Which change to the playbook best preserves enrichment quality while respecting the vendor's rate limit?

Accepted Answer

Add an enrichment result cache keyed on the indicator value with a short TTL so repeated indicators across grouped alerts reuse a single lookup instead of re-querying the API.

Answer

Remove the threat intelligence enrichment step entirely so cases open faster and never hit the rate limit.

Answer

Configure the playbook to retry the failed API call immediately in a tight loop until it succeeds for every alert.

Answer

Increase case severity automatically whenever an enrichment step returns HTTP 429 so analysts prioritize those cases.