To automate updating IOC sources based on IC-Score thresholds, which automation construct would you implement?

• A. Playbook
• B. Alert grouping
• C. Data retention
• D. Manual tuning

Answer: (A)

Automating a response workflow with a Playbook lets you define a repeatable sequence of actions that execute when an IC-Score threshold is reached. The Playbook can be triggered by the threshold event and automatically pull updated IOC feeds from trusted threat intel sources, update your IOC repository, and push those updates to your security tooling. It also handles logging, error handling, and notifications, providing a consistent, auditable process that speeds up how you refresh indicators without manual intervention.

Other constructs serve different purposes: alert grouping only aggregates alerts for easier review, data retention governs how long data is stored, and manual tuning requires human intervention—none of which automate the actual updating of IOC sources in response to score thresholds.