A SOC lead reviews the phishing triage metrics for the past quarter and finds that analysts spend a mean of 42 minutes per reported email manually extracting the sender domain, submitting each URL to a sandbox, and pasting the verdict into the ticket. The same three steps run identically on every case, and volume has doubled. Which process improvement would most directly reduce the mean time to respond for this workflow?
- ARaise the severity threshold so that only emails from external senders generate a triage ticket in the first place.
- BBuild a SOAR playbook that automates the domain extraction, sandbox submission, and verdict write-back so analysts only review the enriched result. Correct
- CAdd two more analysts to the phishing queue so the doubled volume is shared across a larger team.
- DSchedule the phishing queue to be worked once at the start and once at the end of each shift as a batch.
Why A is wrong: Filtering by external sender is tempting because fewer tickets feels faster, but it drops legitimate reports unexamined and does nothing to speed up the manual steps on the cases that remain.
Why B is correct: The three steps are deterministic and repeated identically on every case, which is exactly the profile SOAR automation targets, cutting the per-ticket handling time and lowering mean time to respond.
Why C is wrong: More staff can absorb volume, but it leaves the 42-minute manual process untouched, scales cost linearly, and does not reduce the mean time to respond per case.
Why D is wrong: Batching may feel efficient, but delaying triage to fixed windows increases the time a malicious email sits unactioned and worsens mean time to respond rather than improving it.