350-201 Question 256
Select 3A security operations team is using a SOAR platform to manage incident response workflows. They aim to reduce manual effort and improve the efficiency of their processes. Which of the following actions represent opportunities to leverage automation, orchestration, or machine learning within the SOAR platform?
- A
Automatically enriching security alerts with threat intelligence feeds to provide context.
- B
Manually reviewing log files to identify potential Indicators of Compromise (IoCs).
- C
Integrating the SOAR platform with an endpoint detection and response (EDR) tool to automate quarantining of infected devices.
- D
Using machine learning algorithms to detect anomalous patterns in user behavior.
- E
Requiring analysts to manually assign severity levels to all incoming incidents.
Show answer and explanation
Correct answers: A, C, D
Explanation
SOAR platforms are designed to reduce manual effort and streamline workflows by leveraging automation, orchestration, and machine learning. Automatically enriching alerts (automation), integrating with other tools to take automated actions (orchestration), and using machine learning for anomaly detection are all examples of leveraging these capabilities. On the other hand, manual tasks like reviewing logs or assigning severity levels go against the purpose of a SOAR platform and are inefficient.
- A. Correct.
This option is correct because automating the enrichment process ensures alerts are provided with actionable context, reducing manual tasks for analysts.
- B. Incorrect.
This option is incorrect because manually reviewing log files is a time-consuming process that does not utilize automation or orchestration features of a SOAR platform.
- C. Correct.
This option is correct because integrating with an EDR tool and automating device quarantine is a key example of orchestration within a SOAR platform.
- D. Correct.
This option is correct because machine learning can be used within a SOAR platform to identify anomalies, assisting in threat detection and response.
- E. Incorrect.
This option is incorrect because requiring analysts to manually assign severity levels increases manual effort and does not utilize the automation capabilities of the SOAR platform.