The SOC builds a low-code flow that enriches indicators of compromise from allowlisted feeds before an analyst reviews the case. Which AI/automation approach for security tasks does this illustrate?

Low-code scripting that assists enrichment while keeping human review in the loop lets the SOC pull indicators of compromise from allowlisted feeds into the case before an analyst decides next steps, reducing toil without surrendering judgment. That approach illustrates responsible AI/automation for security tasks: accelerate context gathering, retain analyst ownership of investigation and response. Low-code scripting that assists enrichment while keeping human review on the loop puts the analyst on the loop in a supervisory role rather than in the loop for required review, and does not provide analyst review of the case before proceeding. Low-code scripting that assists model enrichment while keeping human review in the loop improves models rather than pulling indicators of compromise from allowlisted feeds into the case before analyst review. Low-code scripting that assists enrichment while keeping human review in the audit places human review retrospectively in the audit rather than in the loop, and does not pull indicators of compromise from allowlisted feeds into the case for required review before next steps. Exam caveat: low-code IoC enrichment plus human review is the desired pattern; enrichment with human review on the loop, model enrichment with human review in the loop, and enrichment with human review in the audit are distractors. Operational check: allowlist enrichment sources, log automation actions on cases, keep on-the-loop supervision, model enrichment, and audit-only review outside of pre-case enrichment, and require analyst review of enriched indicators before containment from enriched tickets.