Question

During an active investigation, a Google SecOps SOAR playbook is triaging a high-severity endpoint alert. The playbook is configured to enrich the host artifact with asset criticality from the CMDB, the user's recent authentication history, and a GTI reputation lookup on an outbound IP before deciding whether to auto-isolate the host. Mid-execution, the CMDB integration returns an error and the GTI lookup times out, but the authentication enrichment succeeds and shows the account performed an impossible-travel login moments before the alert fired. The playbook's containment gate requires a computed risk score. What is the MOST appropriate playbook design decision for handling this partial-enrichment situation?

Accepted Answer

Compute the risk score using only the successful authentication enrichment, apply a conservative default (e.g., treat asset as business-critical and IP as unknown-suspicious) for the failed sources, and route to an analyst decision node before auto-isolation.

Answer

Halt the playbook entirely and close the case as inconclusive because a complete risk score cannot be computed without all three enrichment sources.

Answer

Skip the risk-score gate and immediately auto-isolate the host, since the impossible-travel signal alone is definitive proof of compromise.

Answer

Retry the CMDB and GTI integrations in an infinite loop until both succeed, blocking the containment decision until complete enrichment data is available.