A SOC team receives multiple alerts by a rule that detects requests to malicious URLs and informs the incident response team to block the malicious URLs requested on the firewall. Which action will…

Blocking all HTTP/HTTPS traffic for any user who triggers the rule is disproportionate and disrupts legitimate business activity, rather than surgically blocking only the identified malicious URLs.

Sending an automated email to the affected user notifies them after the fact but does not contain or remediate the threat, leaving the malicious URL accessible.

Emailing the incident response team is already part of the existing manual workflow; automating only the notification still requires a human to log in and apply the firewall rule, preserving the bottleneck.

A SOAR-style automation script that fires a firewall block rule immediately upon alert trigger removes human latency from the response chain, reducing mean time to respond (MTTR). Every triggered alert results in an immediate, consistent block without requiring an analyst to read an email and manually apply a firewall change, making the process both faster and more reliable at scale.