PROFESSIONAL-SECURITY-OPERATIONS-ENGINEER · Question #77
During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the…
The correct answer is C. Configure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the. To ensure timely escalation for high-priority phishing incidents, you should configure a SOAR notification loop that sends escalating alerts to Tier 1 analysts, Tier 2 analysts, and the SOC manager at regular intervals until the case is reassigned or acted upon. This enforces…
Question
During a high-priority phishing incident at your company, Google Security Operations (SecOps) created and assigned the case to a Tier 1 analyst. The analyst added email headers and attached the malicious file as evidence but failed to escalate the case, violating an internal SLA of 30 minutes for a phishing response. The delay led to multiple users opening the file before containment actions were initiated. You want to optimize the case management workflow for future high-priority incidents. What should you do?
Options
- ABuild a playbook that automatically ingests reported phishing emails, enriches entities with threat
- BChange the default case assignment logic to route all phishing alerts to the Tier 2 team.
- CConfigure a SOAR notification loop that sends escalating email alerts to the Tier 1 analysts, the
- DUpdate the playbook to automatically close phishing cases after 60 minutes if no manual
How the community answered
(49 responses)- A4% (2)
- B2% (1)
- C84% (41)
- D10% (5)
Explanation
To ensure timely escalation for high-priority phishing incidents, you should configure a SOAR notification loop that sends escalating alerts to Tier 1 analysts, Tier 2 analysts, and the SOC manager at regular intervals until the case is reassigned or acted upon. This enforces SLA compliance and ensures that delays do not allow threats to propagate, optimizing the case management workflow without relying solely on manual escalation.
Topics
Community Discussion
No community discussion yet for this question.