Learn how to leverage SOAR (Security Orchestration, Automation, and Response) to contain identity-based threats. In this scenario, you will select the appropriate automation playbook to isolate a compromised account.
You are a Tier 2 SOC Analyst monitoring the cloud identity queue. A critical alert has fired indicating "Impossible Travel and Anomalous Working Hours" for the VP of Finance. An attacker appears to have bypassed MFA and is currently accessing sensitive SharePoint directories. To prevent immediate data exfiltration while you investigate, you need to trigger a SOAR playbook to halt their access.
Your task is to identify the correct playbook category designed to contain an identity compromise.
A Security Operations Center (SOC) analyst receives a high-priority alert indicating unusual user activity. An employee account is attempting to access company resources from a different country and outside of their normal working hours. This behavior raises concerns about potential account compromise or unauthorized access to automate the initial response and quickly restrict access while further investigating the incident, which SOAR Playbook would be relevant to adapt and implement?
We are dealing with a compromised identity. The attacker has logged in using a valid credential and bypassed MFA (potentially via an AiTM proxy attack or session token theft). Because they are actively accessing sensitive files, the analyst cannot afford to manually log into Active Directory, disable the account, force an Azure AD sync, and then manually revoke active web sessions. We need SOAR to automate this containment sequence instantly.
The prompt asks how to "quickly restrict access" to resources. A "Deprovisioning Users" playbook—or a slight adaptation of one, such as a "Suspend User" playbook—is designed specifically to interact with IAM infrastructure. When triggered, it automatically disables the user's AD/Entra ID account, revokes active OAuth tokens, and resets passwords, effectively kicking the attacker out of the environment instantly.
A. Phishing Investigations: Used to extract URLs, detonate attachments, and search mailboxes. It does not stop an active session.
B. Alert Enrichment: Used to gather context (e.g., querying VirusTotal for the Russian IP address). Enrichment informs the analyst, but it does not *contain* the threat.
D. Malware Containment: Used to isolate a physical or virtual *endpoint* (e.g., using CrowdStrike to network-isolate a laptop). This alert is about a compromised cloud identity, not a compromised local endpoint.
In modern cloud environments (AWS, Azure, GCP), the traditional perimeter is gone; *Identity is the new perimeter*. Speed is critical during a cloud breach because an attacker can exfiltrate gigabytes of data via API in seconds. Senior analysts rely heavily on SOAR to execute "Revoke-AzureADUserAllRefreshToken" and disable the account simultaneously across hybrid environments, turning a 15-minute manual process into a 5-second automated API call.
Do not confuse containing a device with containing a user:
Practice more realistic scenarios to prepare for your EC-Council CSA exam.
Explore more CSA simulations