QuestionQ2
Incident responseThe organization requires that the SOC director be notified by email about escalated incidents and their results before a case is closed. You need to create a process that automatically sends this email when an escalated case is closed. You must ensure that the email is sent reliably for the appropriate cases. Which process should you use?
- A Use the Close Case button in the UI to close the case. If the case is marked as an incident, export the case from the UI and email it to the director.
- B Write a job to check closed cases for incident escalation status, pull the case status details if a case has been escalated, and send an email to the director.
- C Navigate to the Alert Overview tab to close the Alert. Run a manual action to gather the case details. If the case was escalated, email the notes to the director Use the Close Case action in the UI to close the case.
- D Create a playbook block that includes a condition to identify cases that have been escalated. The two resulting branches either close the alert and email the notes to the director, or close the alert without sending an email.
Community Discussion