During a high-priority phishing incident, what workflow helps ensure timely escalation if analysts fail to escalate within SLA?

• A. Build a playbook that auto ingests phishing emails, enriches, determines impact, and assigns case for review.
• B. Change default assignment to route phishing alerts to Tier 2.
• C. Configure a SOAR notification loop that sends escalating email alerts to Tier 1, Tier 2, and SOC manager every five minutes until case is reassigned.
• D. Update playbook to auto-close after 60 minutes if no manual response.

Answer: (C)

Automated escalation through continuous, time-bound notifications is the mechanism that ensures high-priority incidents don’t stall when someone misses an SLA. Configuring a SOAR notification loop to alert the next responder levels—Tier 1, Tier 2, and the SOC manager—every five minutes until the case is reassigned guarantees immediate visibility and accountability. This creates a persistent escalation path, so if the initial analyst doesn’t escalate or the case isn’t reassigned in time, someone higher up is alerted promptly, keeping the incident moving and meeting SLA expectations. It also provides an auditable trail showing who was notified and when, which helps with post-incident reviews. Other options don’t enforce escalation: auto-ingest and enrich improves detection but not escalation; changing routing may shift responsibility but doesn’t push timely escalation; auto-closing after a fixed period terminates the case rather than pushing for action.