Phishing alerts are ingested directly into SecOps SOAR from an email inbox, and analysts currently use a SIEM query; you want the query results to be automatically included in the case without writing new code. What should you do?

• A. Custom action in SecOps IDE to run SIEM query via API.
• B. Modify detection rule to include query results.
• C. Add a widget in Default Case View for analysts to query directly.
• D. Add an action to the playbook that runs the SIEM query and returns the results.

Answer: (D)

The idea is to automate data enrichment by using a playbook action that fetches the SIEM results and feeds them directly into the case. In SecOps SOAR, a playbook can orchestrate interactions with external tools during or after an alert is ingested. By adding an action to the playbook that runs the SIEM query and returns the results, those results can be automatically appended to the case (as notes or artifacts) without writing new code. This matches the requirement of automatic inclusion and leverages existing integrations within the SOAR platform.

Using a custom action would require creating new code, which isn’t the goal here. Modifying a detection rule affects how alerts are generated, not how data is enriched in an already opened case. Adding a widget would enable manual querying, not automatic enrichment of the case content.