You want to reduce pivoting when triaging alerts using SecOps case management. Which approach should you take first?

• A. Create a general, low-priority enrichment playbook for case entities.
• B. Develop a dedicated enrichment playbook per threat family.
• C. Automate full remediation for high-severity cases.
• D. Route all alerts to a single analyst.

Answer: (A)

Focusing on giving analysts solid, consistent context at the very start reduces the need to chase information or move cases between teams, which is what often drives pivoting during triage. A general, low-priority enrichment playbook for case entities automatically attaches common, foundational data to every alert—things like assets, users, related tickets, and basic indicators—so triage decisions can be made quickly with the same baseline information across all alerts. This builds a reliable foundation for faster, more scalable triage.

Starting with broad enrichment makes sense before adding deeper, threat-specific enrichments or taking automation steps. A dedicated enrichment playbook per threat family adds complexity and specialty later, once the general data flow is stabilized. Automating full remediation for high-severity cases is risky without proper triage context and human oversight, as it can propagate errors or cause unintended effects. Routing all alerts to a single analyst creates bottlenecks and does not address information gaps that fuel pivoting.