A county uses independent webhooks so losing the ticketing connector does not stop enrichment. What integration design is that?

A county that uses independent webhooks so losing the ticketing connector does not stop enrichment is decoupling SOAR integrations. Enrichment against intel, EDR, and identity should not be strictly serialized behind ITSM availability. When ServiceNow or another ticket system blinks, independent paths let threat context continue to accumulate while ticket sync retries or queues. That design keeps civic IR moving during partial outages instead of freezing the entire playbook on one dependency.

Why the other options fail by concept: Decoupling SOAR webhook authentication so enrichment continues if the ticketing connector fails isolates the wrong layer — separating authentication flows does not separate tool execution paths, so losing the ticketing connector would still stall enrichment if the integrations themselves remain coupled. Decoupling SOAR enrichment outputs so enrichment continues if the ticketing connector fails describes output handling, not connector independence — managing where enriched results go does not create the independent webhook paths that let enrichment keep running when the ticketing connector itself is lost. Decoupling SOAR playbook scheduling so enrichment continues if the ticketing connector fails addresses job timing and order, not fault isolation — adjusting when playbooks run does not provide the decoupled tool integrations that let enrichment continue while ticket sync retries or queues.

Exam caveat: Decoupling improves resilience but requires idempotent writes and clear eventual-consistency rules so duplicate tickets or stale case fields do not confuse responders. Operational check: implement independent webhooks or queues per connector, test ITSM outage scenarios, and confirm enrichment and analyst notification continue while ticket sync recovers.