PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #75
Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall…
The correct answer is D. Create a request in the Google SecOps SOAR settings that includes a field for the firewall rule. The best approach is to create a SOAR request with a field for the firewall rule and trigger a playbook based on that request. Configure the playbook so that the firewall rule change step requires approval from the system administrator, including the relevant parameters. This…
Question
Your company's SOC analysts frequently submit manual change requests to a system administrator to make changes to the firewall rules on a specific router. You have the integration for the firewall installed and configured with credentials. You want to use the integration to trigger firewall rule changes directly from the Google Security Operations (SecOps) SOAR. Your system administrator requires the ability to manually approve the requested changes prior to deployment. How should you implement the workflow for analysts to trigger on demand?
Options
- ACreate an email template for the analyst to get approval for the change from the system
- BCreate an account for the system administrator in your Google SecOps instance to allow the
- CCreate a playbook where the firewall rule change is a manual step, allowing the analyst to edit the
- DCreate a request in the Google SecOps SOAR settings that includes a field for the firewall rule.
How the community answered
(23 responses)- A13% (3)
- B4% (1)
- C9% (2)
- D74% (17)
Explanation
The best approach is to create a SOAR request with a field for the firewall rule and trigger a playbook based on that request. Configure the playbook so that the firewall rule change step requires approval from the system administrator, including the relevant parameters. This allows analysts to initiate changes on demand while ensuring that all modifications are reviewed and approved before deployment, automating the workflow while respecting the approval requirement.
Topics
Community Discussion
No community discussion yet for this question.