SOAR Playbook Development Flashcards

During SOAR playbook development, what is the primary purpose of defining 'triggers' at the start of a playbook?

Answer: To specify the conditions or events that initiate playbook execution

Triggers define the specific conditions, alerts, or events that automatically invoke a playbook, ensuring consistent and timely response.

A SOAR playbook for ransomware response includes a step to isolate an endpoint. Which integration type is most commonly used to perform this action automatically?

Answer: EDR or endpoint management platform API

EDR platforms expose APIs that SOAR tools use to quarantine or isolate endpoints without manual intervention during ransomware incidents.

What does a 'decision node' in a SOAR playbook represent?

Answer: A branching point where playbook flow changes based on a condition

Decision nodes evaluate conditions (e.g., severity score, asset criticality) and route the playbook down different execution paths accordingly.

When building a phishing playbook, which enrichment action adds the most contextual value to a suspicious URL before escalation?

Answer: Checking the URL against a threat intelligence reputation feed

Querying reputation feeds provides categorization, maliciousness scores, and historical context that inform whether the URL warrants escalation.

Which SOAR playbook design principle reduces alert fatigue by limiting analyst interruptions to truly critical decisions?

Answer: Automating low-risk, high-confidence actions and reserving human-in-the-loop steps for ambiguous situations

Automating routine, high-confidence actions while flagging only uncertain or high-risk decisions for human review balances speed with oversight.

A playbook action fails because an API key for an integrated threat intel platform has expired. What playbook design feature best handles this scenario?

Answer: Error handling logic that alerts the SOC team and gracefully degrades to a manual step

Robust error handling notifies operators of integration failures and falls back to manual processes, preventing silent failures during active incidents.

In the context of SOAR playbook lifecycle management, what does 'playbook versioning' primarily enable?

Answer: Tracking changes over time, rolling back to stable versions, and auditing modifications

Versioning records playbook changes, who made them, and when, enabling rollback if a new version introduces errors and supporting audit requirements.