SOAR (Security Orchestration, Automation, and Response) platforms help automate and orchestrate incident response tasks, including phishing triage.
Parsing phishing emails (checking headers, links, attachments).
Running automated playbooks to check for known malicious indicators.
Escalating real threats while dismissing false positives.
Why Not Other Options?
C (Implement EDR) → EDR is useful for endpoint protection but does NOT specifically reduce phishing triage time.
D (Install a " Report Phishing " button) → Helps report phishing but does NOT automate the triage process.
[Reference: CompTIA CySA+ CS0-003, Chapter 7: "Security Operations and Automation," Section: "SOAR and Incident Response Efficiency", , , , ]
Submit