CAS-005 · Question #212
An organization recently acquired another company that is running a different EDR solution. A SOC analyst wants to automate the isolation of endpoints that are found to be compromised. Which of the…
The correct answer is A. Using a SOAR solution to look up entities via a TIP platform and isolate endpoints via APIs. Using a SOAR solution integrated with a Threat Intelligence Platform (TIP) enables automated, intelligence-driven decisions to isolate endpoints via APIs. This workflow balances automation with validation to reduce false positives while quickly containing threats, especially…
Question
An organization recently acquired another company that is running a different EDR solution. A SOC analyst wants to automate the isolation of endpoints that are found to be compromised. Which of the following workflows best mitigates the risk of false positives and reduces the spread of malicious code?
Options
- AUsing a SOAR solution to look up entities via a TIP platform and isolate endpoints via APIs
- BSetting a policy on each EDR management console to isolate all endpoints that trigger any alerts
- CReviewing all alerts manually in the various portals and taking action to isolate them
- DAutomating the suppression of all alerts that are not critical and sending an email asking SOC
How the community answered
(20 responses)- A65% (13)
- B5% (1)
- C10% (2)
- D20% (4)
Explanation
Using a SOAR solution integrated with a Threat Intelligence Platform (TIP) enables automated, intelligence-driven decisions to isolate endpoints via APIs. This workflow balances automation with validation to reduce false positives while quickly containing threats, especially across multiple EDR platforms.
Community Discussion
No community discussion yet for this question.