How should you implement on-demand approvals for firewall changes requested by SOC analysts?

• A. Email template for approval; manual action to change rule.
• B. Create an account for the system admin in SecOps and escalate cases.
• C. Playbook where firewall change is a manual step; analyst emails admin; proceed after approval.
• D. Create a SOAR Request with a field for the firewall rule and a playbook triggered by this request, including an approval step to the system administrator that includes the parameter being changed.

Answer: (D)

On-demand approvals for firewall changes should be governed by a structured, auditable SOAR-driven workflow. Create a SOAR Request that includes a dedicated field for the firewall rule and its parameters, and trigger a playbook from that request. The playbook automates the workflow steps—routing, logging, and applying the change—while including an explicit approval step to the system administrator, with visibility into the exact parameter being changed. This provides a clear, traceable record of what was requested, who approved it, and when, and ensures the change is reviewed with full context before implementation. The approach balances speed with governance: analysts can request changes quickly, but the final authorization and execution are controlled, auditable, and repeatable.

Other approaches fall short because they lack a formal, automated, auditable flow. An email-based approval with manual change relies on scattered processes and offers little traceability. Creating a privileged admin account in SecOps introduces unnecessary access risk and does not define a workflow. A manual step inside a playbook with email-based approval still depends on ad hoc handoffs and lacks a centralized, verifiable approval gate and context for the change.