A water utility holds weekly SOAR case reviews to remove noisy playbook branches that waste analyst time. What continuous-improvement practice is that?

A water utility that holds weekly SOAR case reviews to remove noisy playbook branches that waste analyst time is practicing continuous improvement by pruning those branches through regular case reviews to reduce civic analyst toil. Playbooks accumulate dead enrichment steps, obsolete vendor queries, and alert paths that never produce actionable outcomes; scheduled reviews use real case evidence to cut that noise so operators spend minutes on genuine water-utility threats instead of false leads. The practice treats SOAR content as living operational code subject to hygiene, not a one-time deployment artifact.

Why the other options fail by concept: Tuning upstream SIEM correlation rules through regular case reviews to reduce civic analyst toil confuses upstream detection with downstream handling; tuning changes what the SIEM fires into the queue but does not prune noisy branches inside SOAR playbooks already running. Extending slow enrichment timeouts through regular case reviews to reduce civic analyst toil misstates the effect; extending timeouts keeps branches waiting longer for slow sources rather than retiring low-yield branches to save time. Archiving aged closed SOAR cases through regular case reviews to reduce civic analyst toil mixes toil reduction with records management; archiving cleans up closed cases to satisfy retention, it does not clean live playbook logic to save analyst time.

Exam caveat: pruning must preserve forensic and compliance-relevant branches that are rare but required; “noisy” means low-value routine churn, not infrequently used but mandated steps. Operational check: in each weekly review, list branches with high run counts and low actionable yield, retire or gate them behind stronger conditions, and confirm the next week’s mean analyst touch time on phishing or SCADA-adjacent cases trends downward.