When Container Threat Detection alerts that an added binary has been executed in a business-critical workload, which two actions are most appropriate?

• A. Notify the workload owner. Follow the response playbook, and involve threat hunting to identify the root cause
• B. Review the finding, investigate the pod and related resources, and research the related attack and response methods
• C. Quarantine the cluster containing the running pod and delete the running pod
• D. Silence the alert in the SCC console, as the alert is low severity

Answer: (A)

When a container security alert indicates that a new binary was executed in a business-critical workload, the priority is to engage the right people quickly and follow a guided, repeatable response. Notifying the workload owner ensures that the business unit affected is aware of the risk, can assess impact, and coordinates the necessary resources for mitigation. At the same time, following the established response playbook preserves a structured, auditable track of actions, containment steps, evidence collection, and communication. Bringing in threat hunting to identify the root cause helps determine how the compromise occurred, whether other components are affected, and what indicators of compromise to look for, enabling faster containment and a more thorough remediation.

Investigating the pod or related resources is important, but without notifying the owner and adhering to a formal playbook (including threat hunting), actions can be misaligned with business priorities and may miss broader indicators of compromise. Quarantining the cluster and deleting the pod can be too disruptive and may destroy evidence or hinder root-cause analysis. Silencing the alert is inappropriate for an active incident, as it prevents timely triage and coordinated response.