To minimize analyst effort when containing an endpoint via Gmail integration and require approval, which playbook design is most effective?

• A. Set containment action to Manual and assign to the user.
• B. Set containment action to Manual and assign to the appropriate tier; analyst emails user for approval.
• C. Send Email + Wait For Thread Reply, then analyst contains manually.
• D. Generate an approval link for the containment action and include the placeholder in the Send Email body; configure additional playbook logic to handle approved/denied outcomes.

Answer: (D)

Automating the approval step and tying it to the containment action within the playbook minimizes analyst effort. By generating an approval link for the containment action and embedding that placeholder in the email body, the recipient can approve or deny directly from Gmail without manual follow-ups. The playbook then uses additional logic to handle the two outcomes—proceeding with containment on approval and stopping or escalating on denial. This creates an end-to-end, hands-off flow where the containment happens automatically only after explicit approval, keeping actions auditable and reducing back-and-forth.

Other approaches rely more on manual steps or back-and-forth emails, which increases workload and delay. For example, manual containment assigned to a person or tier requires a human to initiate the action, and waiting for a thread reply delays response. Using an approval link with conditional logic keeps the process streamlined and scalable while still enforcing approval.