Analysts at an MSSP want a stored playbook to enrich an alert, open a ticket, and block an address without a person clicking each step. Which platform runs that playbook?
Select an answer to reveal the explanation.
Short Explanation
A bell that only rings is not a crew that also files the report and shuts the valve. You want SOAR when the MSSP playbook must enrich an alert, open a ticket, and block an address without a person clicking each step. A SIEM can correlate and alert, while a log store and a packet broker stop short of those actions.
Full Explanation
SOAR stores a playbook and executes the steps: enrich the alert, open the ticket, and push a block, without an analyst clicking through each one. That is the platform the MSSP is asking for. SOAR runbook execution that enriches the alert, opens a ticket, and blocks the address on its own. Correlation and notification are the neighboring job. A SIEM that correlates the events and raises the alert without running those response steps can put the incident on the screen and still leave enrichment, the ticket, and the block to a person or to another system. Retention is earlier still. A log manager that only retains the alert records and does not enrich them, open a ticket, or block keeps history and does not act. A copy of packets is not a response. A packet broker that only copies traffic toward monitoring tools and does not run any response steps feeds sensors and never opens a ticket or blocks an address. Exam caveat: one vendor may sell log storage, SIEM, and SOAR together, but this exam separates them. Playbook execution of the response steps is the SOAR role. Correlation that stops at the alert is the SIEM role. Operational check: run the playbook in a test tenant and confirm it enriches, opens the ticket, and blocks the address with no manual click between the steps.