A regional bank's SOC currently triages every phishing report by hand: an analyst opens the email, copies any URLs into a sandbox, queries the threat intelligence platform for the sender domain, searches the SIEM for other recipients, and then either closes the ticket or escalates. The mean time to triage is forty minutes per report and the team handles roughly two hundred reports a week. The chief information security officer wants the team to redesign the workflow using a SOAR platform so that simple, repetitive cases close themselves and analysts only see reports that genuinely need judgement. Which design best reflects the intended use of SOAR for this workflow?
- ABuild a SOAR playbook that ingests each phishing report, enriches it by calling the sandbox, threat intelligence and SIEM APIs, auto-closes reports whose indicators are already known benign or already mitigated, and presents only the residual cases to an analyst with the enrichment attached. Correct
- BReplace the SIEM with the SOAR platform so that all alert correlation, log retention, and detection rule tuning move into the SOAR engine and the SOC standardises on one tool for both detection and response.
- CWrite a single PowerShell script that an analyst runs from a jump host at the start of each shift to pull the day's phishing queue, run the sandbox check, and email the results to the team mailbox for manual review.
- DKeep the manual workflow and instead hire two additional tier one analysts so that the existing forty minute triage time per report can be sustained as report volume grows over the next year.
Why A is correct: This matches the canonical SOAR use case: orchestrate enrichment across existing tools, automate the repeatable steps, and escalate only the cases that genuinely need human judgement, which is exactly the outcome the CISO has asked for.
Why B is wrong: Tempting because consolidating tools sounds efficient, but SOAR is an orchestration and response layer that calls SIEMs, sandboxes, and intelligence sources, not a replacement detection or log retention platform; collapsing the two confuses the role of each control.
Why C is wrong: A one-off script automates a fragment of the work but leaves analysts doing the triage decision themselves and provides no playbook engine, case management, or auditable orchestration across tools, so the benefits SOAR is meant to deliver are not realised.
Why D is wrong: Adding headcount is tempting because it is simple to justify, but it ignores the objective entirely: the point of automation and orchestration is to remove repetitive work, not to scale human effort linearly with workload.