Question

During a Google SecOps SOAR playbook run, an incoming alert about a suspicious OAuth token grant is automatically enriched. The playbook queries an internal IdP for the affected user's recent sign-in risk. The IdP returns a HTTP 200 with a body indicating the risk lookup is 'pending' rather than a final risk score. The playbook has a conditional branch that escalates the case severity to Critical only when risk is 'high', and otherwise closes the case as benign. As the SOAR engineer reviewing this design during a post-incident review, what is the BEST correction to the playbook logic?

Accepted Answer

Add an explicit branch for the 'pending' (indeterminate) state that routes the case to a manual analyst review or a retry-with-backoff step instead of auto-closing it as benign.

Answer

Treat any HTTP 200 response as a successful final result and rely on the existing high/benign branching, since a 200 status confirms the data is authoritative.

Answer

Immediately escalate every alert to Critical severity whenever enrichment does not return 'high', to guarantee no true positive is missed.

Answer

Remove the IdP enrichment step entirely and close all OAuth grant alerts as benign to reduce analyst workload and API rate-limit consumption.