問題文
A SOC has both adaptive response actions on its detections and playbooks in Splunk SOAR. Which statements correctly describe the relationship? (Select two.)
選択肢
- Playbooks are built in the automation product and can be run against an investigation, either automatically for the investigation type or by an analyst on demand.
- Playbooks replace adaptive response actions, so a SOC that has the automation product does not need to configure any actions on its detections.
- Adaptive response actions can contain conditional branching and multiple steps in the same way playbooks can.
- Response actions attached to a detection run in response to that detection matching, without any analyst involvement.
- A playbook can only be triggered by an adaptive response action, so every playbook the SOC wants to run has to be attached to a detection first and there is no path for an analyst to start one during an investigation that was opened manually.