Automation & Incident Orchestration Flashcards

Which orchestration concept ensures that automated incident workflows execute steps in a defined sequence while handling branching logic for different outcomes?

Answer: Conditional routing

Conditional routing allows orchestration workflows to branch based on specific conditions or outcomes, enabling dynamic, scenario-driven incident response.

A SOAR platform receives 500 low-severity alerts per hour. What is the primary benefit of using automated triage for these alerts?

Answer: Reduce mean time to acknowledge by auto-closing or escalating without manual review

Automated triage reduces MTTA by programmatically evaluating and acting on low-severity alerts without requiring manual analyst intervention.

What is an 'enrichment playbook' in incident orchestration?

Answer: An automated workflow that appends contextual data (e.g., threat intel, asset info) to an incident

An enrichment playbook automatically gathers and attaches relevant context—such as threat intelligence or asset ownership—to an incident record to aid analyst decision-making.

In automated incident orchestration, what does 'idempotency' mean?

Answer: Executing the same automation action multiple times without causing unintended duplicate effects

Idempotency ensures that re-running an automation step (e.g., due to retry logic) produces the same result as running it once, preventing duplicate tickets or redundant actions.

Which metric best reflects the efficiency of an automated incident containment playbook?

Answer: Mean Time to Contain (MTTC) before and after automation

MTTC directly measures how quickly incidents are contained, making it the most relevant metric for evaluating automated containment effectiveness.

When designing an incident orchestration workflow, why should human approval gates be included for high-impact actions like blocking IP ranges?

Answer: To ensure a qualified analyst validates the action before it causes unintended service disruption

High-impact automated actions can cause outages or business disruption if triggered incorrectly, so human approval gates add a critical safeguard.

A company integrates its ticketing system with a SOAR platform via REST API. What is the main purpose of using webhooks in this integration?

Answer: To push real-time event notifications from the ticketing system to the SOAR platform without polling

Webhooks enable event-driven communication, instantly notifying the SOAR platform when a ticket is created or updated, eliminating the latency and overhead of polling.