The SOC analyst needs to design a playbook that filters for high severity events.
The playbook must also attach the event information to an existing incident.
Analyzing the Provided Exhibit:
The exhibit shows the available actions for a local connector within the playbook.
Actions listed include:
Update Asset and Identity
Get Events
Get Endpoint Vulnerabilities
Create Incident
Update Incident
Attach Data to Incident
Run Report
Get EPEU from Incident
Evaluating the Options:
Get Events: This action retrieves events but does not attach them to an incident.
Update Incident: This action updates an existing incident but is not specifically for attaching event data.
Update Asset and Identity: This action updates asset and identity information, not relevant for attaching event data to an incident.
Attach Data to Incident: This action is explicitly designed to attach additional data, such as event information, to an existing incident.
Conclusion:
The correct action to use in the playbook for filtering high severity events and attaching the event information to an incident is Attach Data to Incident .
[References:, Fortinet Documentation on Playbook Actions and Connectors., Best Practices for Incident Management and Playbook Design in SOC Operations., , , ]
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit