A transit SOC wants evidence preservation to finish before eradication playbooks run. How should automated IR actions be ordered?

A transit SOC that wants evidence preservation to finish before eradication playbooks run should order automated IR so evidence preservation completes before eradication playbooks execute. Eradication actions—wiping hosts, resetting images, purging malicious artifacts—can destroy volatile and disk evidence needed for forensics, prosecution support, insurance, and after-action learning. Automation that enforces preserve-then-eradicate sequencing protects the municipal investigative record while still allowing timely cleanup once collection and hashing succeed. Why the other options fail by concept: Ordering automated IR so evidence snapshot capture completes before eradication playbooks execute lets eradication begin as soon as a snapshot is captured, before off-host collection, hashing, and cataloging are done, so destructive actions can destroy the only copy before preservation ever completes. Ordering automated IR so preservation job submission completes before eradication playbooks execute lets destructive playbooks start as soon as a job is submitted, before actual collection and hashing are done, so evidence can be lost before preservation ever completes. Ordering automated IR so host-local evidence staging completes before eradication playbooks execute leaves the evidence staged only on the system being wiped, so eradication can destroy the staged data before off-host collection and hashing finish. Exam caveat: preservation scope should be risk-based; not every low-severity host needs a full memory image, but the playbook must still finish the defined preservation gates before destructive steps. Operational check: in the transit SOAR flow, make eradication steps depend on successful preservation task completion and hash catalog entries, and fail closed (pause for human) if preservation errors rather than continuing to wipe.