You have ransomware incidents and need automated detection and containment. Which single action would most effectively achieve automated detection and containment?

• A. Enable Windows Threats category in curated detections.
• B. Enable Risk Analytics for UEBA curated detections.
• C. Install SOAR EDR integrations for endpoint containment; create a playbook to contain impacted Windows devices based on curated detections.
• D. Install SOAR EDR jobs for remote containment; create a playbook.

Answer: (C)

Automated detection and containment rely on an integrated response where the security tooling can act on detections without human intervention. Installing the EDR integration with your SOAR platform and building a containment playbook for Windows devices enables detections to trigger automatic containment actions on the endpoints, such as isolating the device, stopping malware processes, and blocking network activity. The playbook codifies exactly what containment steps to take, ensuring fast, consistent, and scalable responses to incidents.

Other options improve detection visibility or analytics but don’t automatically contain. Enabling broader threat categories or UEBA risk analytics enhances what gets detected, yet containment remains a manual or separate step unless paired with an automated response. The remote containment approach could work, but endpoint-focused containment is generally more reliable and immediate since it operates directly on the affected machines and aligns with typical ransomware containment needs.