350-201 Question 253
Select 3A security operations team is using a SOAR platform to manage incident response processes. They are overwhelmed with repetitive tasks, such as gathering threat intelligence, enriching alerts, and triaging incoming incidents. Which of the following actions can effectively leverage automation, orchestration, or machine learning within the SOAR platform to address these challenges?
- A
Automate the collection of threat intelligence from multiple external sources to enrich alerts.
- B
Manually assign incidents to analysts based on their expertise.
- C
Use machine learning to prioritize incidents based on historical data and patterns.
- D
Orchestrate communication between the SIEM, firewall, and ticketing system for faster response.
- E
Perform manual correlation of alerts from different security tools.
Show answer and explanation
Correct answers: A, C, D
Explanation
SOAR platforms are designed to reduce manual workloads by automating repetitive tasks, enabling orchestration between tools, and leveraging machine learning to improve decision-making. Automating threat intelligence gathering, using machine learning to prioritize incidents, and orchestrating tool communication align directly with these goals. Conversely, manual tasks such as assigning incidents or correlating alerts are inefficient and do not leverage the platform's capabilities.
- A. Correct.
Automating the collection of threat intelligence from multiple sources is a key use case for SOAR platforms. It reduces manual effort and ensures alerts are enriched with actionable data.
- B. Incorrect.
Manually assigning incidents contradicts the purpose of automation and orchestration within a SOAR platform, which aims to streamline processes and reduce manual intervention.
- C. Correct.
Using machine learning to prioritize incidents based on historical data and patterns is a practical use of SOAR's advanced capabilities, improving efficiency and reducing response times.
- D. Correct.
Orchestrating communication between different tools like the SIEM, firewall, and ticketing system is a classic example of SOAR orchestration, enabling seamless collaboration between systems.
- E. Incorrect.
Manually correlating alerts undermines the automation capabilities of a SOAR platform and is not an efficient use of the system's capabilities.