A county enables auto-isolate playbooks and wants to know whether containment is safe as well as fast. Which metric best captures that SOAR effectiveness concern?

A county that enables auto-isolate playbooks and cares whether containment is safe as well as fast should track the false containment rate after those playbooks go live. False containment—isolating the wrong host, the wrong identity, or a critical civic service without justification—turns speed into an outage risk. Measuring that rate makes the effectiveness question two-sided: mean time to contain can improve only if mistaken isolations stay within an accepted municipal threshold. SOC and change owners then tune allowlists, confidence gates, and human approvals where false positives concentrate.

Why the other options fail by concept: Tracking mean time to isolate endpoints after auto-isolate playbooks go live measures speed alone and ignores whether the isolations are correct, so it cannot tell the county whether containment is safe as well as fast. Tracking the playbook success rate after auto-isolate playbooks go live confuses successful execution with correct containment and does not show whether isolations hit the right host, so it cannot tell the county whether containment is safe as well as fast. Tracking mean triage enrichment time after auto-isolate playbooks go live measures efficiency in one workflow step, not whether auto-isolate containment is safe or accurate.

Exam caveat: a zero false-containment target can discourage legitimate isolation; define an accepted residual rate and severity classes for municipal hosts rather than treating every mistake as identical. Operational check: after auto-isolate go-live, tag each isolation as true/false positive within a review SLA, publish the false containment rate weekly, and pause or re-gate the playbook if the rate exceeds the county’s agreed threshold.