Which SOAR trigger policy fits the city's risk tolerance?
Select an answer to reveal the explanation.
Short Explanation
WHOIS and hash lookups are like asking the library catalog who checked out a book—safe to automate. Disabling the CIO is changing the locks on city hall. Match impact to auto versus approved.
Full Explanation
Analysts match playbook impact to trigger style. Enrichment such as WHOIS, hash reputation, or extra Splunk events is appropriate to auto-trigger. Account-disable on a high-privilege civic identity such as the CIO needs approval. Treating WHOIS as destructive or auto-disabling identities inverts that impact model.