All DLP-related cases should include a defined root cause specific to one of five DLP event types when closed in SecOps. How would you implement this?

• A. Customize the Close Case dialog to add the five DLP event types as root cause options.
• B. Customize the Case Name format to include the DLP event type.
• C. Create a SOAR playbook that auto-assigns case tags.
• D. Create case tags and have analysts assign them manually.

Answer: (A)

Capturing a defined root cause at the moment a case is closed ensures every DLP-related case records a standardized, constrained category. By customizing the Close Case dialog to present the five DLP event types as explicit root-cause options, you enforce consistency and completeness: analysts must select one of the predefined categories, so the root cause data is structured, comparable, and usable for reporting, analytics, and downstream automation. This makes it easy to trend DLP incidents, measure response performance by type, and trigger appropriate remediation workflows.

Putting the event type into the case name doesn’t guarantee a structured field or enforce a choice at closure, so it’s not reliable for analytics. A SOAR playbook that auto-assigns tags helps with tagging but doesn’t ensure the root-cause field is populated or restricted to the five types. Letting analysts manually assign case tags is error-prone, inconsistent, and may leave the root-cause field missing or ambiguous. Enforcing a defined root-cause option during closure provides the strongest data quality and operational value.