A city integrates EDR, email gateway, CMDB, and ITSM into one SOAR case. What integration pattern is that?

A city that integrates EDR, email gateway, CMDB, and ITSM into one SOAR case is using multi-tool integration to assemble full IR context. Phishing and malware cases need mail evidence, endpoint telemetry, asset ownership from CMDB, and a ticket trail in ITSM. Pulling those into one case reduces swivel-chair work, speeds correlation, and gives municipal responders a single narrative for containment and after-action reporting instead of four disconnected consoles. Why the other options fail by concept: Unified SOAR response orchestration that triggers civic containment actions in EDR, mail, CMDB, and ITSM describes outbound action execution rather than inbound context assembly, so it fires containment across tools instead of pulling EDR, mail, CMDB, and ITSM evidence into one SOAR case. Federated SOAR query layer that streams live civic EDR, mail, CMDB, and ITSM results to analysts keeps data distributed as live query hits rather than assembling EDR, mail, CMDB, and ITSM evidence into a single persistent SOAR case. Bidirectional SOAR synchronization that mirrors civic IR case state across EDR, mail, CMDB, and ITSM mirrors case state back out to each tool rather than pulling EDR, mail, CMDB, and ITSM context into the SOAR case. Exam caveat: Broad integrations increase credential and data-flow surface area; each connector still needs least privilege, logging, and failure handling. Operational check: map required fields from EDR, mail, CMDB, and ITSM into the case schema, verify enrichment on sample municipal incidents, and ensure partial connector failure still leaves a usable case for analysts.