Question

Your SecOps SOAR team is designing an incident response workflow for high-severity SCC findings that indicate active credential abuse (anomalous IAM grants). The security lead requires that the triage-and-enrichment playbook begin executing within seconds of a finding being generated, rather than on a fixed polling interval, to minimize the window before containment. Which playbook trigger design best satisfies this requirement?

Accepted Answer

Configure an event-driven (real-time) trigger that fires the playbook as soon as the matching SCC finding is ingested into the SecOps case, using alert/finding attributes as the trigger condition.

Answer

Schedule the playbook to run every 5 minutes and query for any new high-severity findings that arrived since the last execution.

Answer

Use a manual trigger so an analyst can review each finding in the queue and launch the playbook only after confirming it is a true positive.

Answer

Configure a daily digest trigger that batches all high-severity findings and runs the enrichment playbook once per shift handover.