You are writing a Google Security Operations (SecOps) SOAR playbook that uses the VirusTotal v3 integration to look up a URL that was reported by a threat hunter in an email. You need to use the results to make a preliminary recommendation on the maliciousness of the URL and set the severity of the alert based on the output. What should you do? Choose 2 answers

In Google Security Operations (SecOps) SOAR, a playbook automates response workflows. When an integration like VirusTotal returns data, the playbook must process it to make decisions. A conditional statement (e.g., an if/else block) is the fundamental playbook component for this. First, a conditional statement is used to evaluate the VirusTotal output (e.g., malicious detections > 0) to make a recommendation and classify the URL as suspicious or benign (A). Second, based on the specific number of malicious detections returned in the JSON response, another conditional statement can be used to programmatically set the alert's severity to an appropriate level, such as Low, Medium, High, or Critical (E). These two actions directly fulfill the requirements using standard SOAR automation logic.

B. Pass the response back to the SIEM. This action doesn't involve processing or decision-making within the playbook itself; it merely forwards raw data without making a recommendation or setting severity.
C. Verify that the response is accurate by manually checking the URL in VirusTotal. This contradicts the primary purpose of SOAR, which is to automate repetitive tasks. A playbook should not require manual intervention for a routine data enrichment step.
D. Create a widget that translates the JSON output to a severity score. Widgets in Google SecOps are for data visualization and presentation within the case view, not for implementing the core automation logic that sets an alert's properties.

1. Google Cloud Documentation, Chronicle SOAR, "Use conditional statements": This document explains how to use conditional branches (If, Else If, Else) to control the flow of a playbook based on the outputs of previous steps, such as an integration's JSON response. This directly supports using conditionals to evaluate VirusTotal results and take actions like setting severity. (See section: "Configure the If branch").

2. Google Cloud Documentation, Chronicle SOAR, "Playbook overview": This document outlines the purpose of playbooks, which is to "automate the security response workflow by codifying security processes." This includes enrichment (VirusTotal lookup), logic (conditionals), and response (setting severity), confirming that options A and E are core playbook functions, while C (manual steps) is an anti-pattern.

3. Google Cloud Documentation, Chronicle SOAR, "Marketplace and integrations": This page describes how integrations like VirusTotal are used within playbooks to provide data that informs subsequent actions. The output, typically JSON, is parsed and used as input for other playbook blocks, such as conditional statements and actions to modify alert fields. (See section: "Use an integration in a playbook").