Your organization requires the SOC director to be notified by email of escalated incidents and their results before a case is closed. You need to…

Chronicle SOAR playbooks are the designed mechanism for automating security operations workflows. A playbook can be triggered by an event, such as a case status change. By creating a playbook block with a conditional statement, the process can automatically check if a case has an "escalated" status upon closure. If the condition is met, a branch of the playbook executes an action to send a formatted email to the SOC director. This approach is fully automated, reliable, and ensures the notification is sent only for the appropriate cases, directly fulfilling all requirements.

A. A scheduled job is a polling mechanism, not an event-driven one. This is less efficient and introduces a delay, making it a suboptimal design compared to a trigger-based playbook.

C. This describes a completely manual process. It is not automated and is prone to human error, as an analyst could forget to perform the required steps, failing the reliability requirement.

D. This is also a manual process that relies on an analyst to remember to export and email the case details after closure. It lacks the required automation and reliability.

1. Google Cloud Documentation

Chronicle SOAR

"Overview of playbooks": "Playbooks are a set of defined actions and conditional statements that are automatically executed in Chronicle SOAR after being triggered by an event... Playbooks automate the security operations workflow

including the incident response process." This source validates that playbooks are the primary tool for automating conditional workflows.

2. Google Cloud Documentation

Chronicle SOAR

"Use conditional statements": "You can add conditional statements to a playbook to control the playbook flow... The playbook flow branches based on whether the condition is evaluated as true or false." This source directly supports using conditional branches to check for an escalation status as described in the correct answer.

3. Google Cloud Documentation

Chronicle SOAR

"Integrations - Mail Sender": The Mail Sender integration documentation states its purpose is to "Send emails using SMTP." Playbooks utilize such integrations as actions. This confirms that sending an email is a standard

automatable action within a playbook.