SOC director must be notified by email of escalated incidents and their results before a case is closed. Create a process to automatically send the email upon closing an escalated case. Ensure reliability. What process?

• A. Use Close Case button; if incident, export and email.
• B. Write a job to check closed cases for escalation status and email.
• C. Close the Alert; run manual action to gather case details; email notes if escalated; then Close Case.
• D. Playbook block with a condition to identify escalated cases; branches either close alert & email notes to director or close alert without email.

Answer: (D)

Automate the notification as part of the closure workflow, using a conditional path that checks if the case was escalated and then acts accordingly. A playbook block triggered during closure can branch: if the case is escalated, close the alert and email the director with the case notes and results; if not escalated, simply close the alert without emailing. This ensures the director is notified for escalated incidents every time, and the notification happens in lockstep with the case closure, preserving reliability and consistency.

Manual approaches or post-closure jobs risk human error or delay. Relying on a manual Close Case flow invites the chance of forgetting to email, while a separate job that scans closed cases and emails afterward would violate the requirement to notify before closure and may miss context or timing. The conditional playbook path provides an automated, auditable, repeatable solution aligned with the notification need.