Domain 3 of 4 · Chapter 5 of 6

Improving Security Operations Processes

Unlock the complete study guide.

Bundled into the existing CompTIA CySA+ premium course — no separate purchase.

14-day money-back guarantee — no questions asked.

Included in this chapter:

  • Three moves for improving security operations
  • Playbooks and runbooks
  • Team coordination and case handoffs
  • Exercising and updating procedures
  • Automation, orchestration, and SOAR
  • Choosing what to automate first
  • Infrastructure as code
  • Data enrichment
  • Rule and alert tuning
  • Dashboard creation
  • APIs, webhooks, and plug-ins
  • Securing and verifying integrations
  • Efficiency and process improvement scenarios

Integration approaches: API requests, webhooks, and plug-ins

Decision factorAPIWebhookPlug-in
Who starts the exchangeThe calling tool, whenever it needs data or an actionThe source service, when an event occursDepends on the plug-in; it may call an API or receive events
Fits whenLookups or actions on request, such as enriching an alert or updating a caseThe receiver should react to a new alert or case update without asking repeatedlyA plug-in for the product you need can be installed into the platform, instead of building the integration yourself
Key security controlCredentials limited to the permissions the workflow needsAuthenticate the sender and validate the content before actingIts stored credentials and permissions, limited the same way
Failure to check forExpired credential or changed interface, so requests fail or return nothingUnreachable endpoint or failed sender checks, so events are not delivered or are rejected before processingShown as enabled while credentials, permissions, or field mapping block the data

Decision tree

Most alerts from the same ruleend known-benign?YesTune the detection ruletest benign and malicious activityNoSame scenario handledinconsistently or from memory?YesWrite or update a playbookwith runbooks for its tasksNoRepetitive work spans severaltools in a set order?YesOrchestrationa SOAR workflowNoAutomate the single tasksuch as lookups through an APIActions that change access or availability: automatic only when policyhas preauthorized them; actions outside that authorization need human approval
Cheat sheet

Cheat sheet

  • Playbooks make scenario handling repeatable
  • Runbooks provide detailed instructions for repeatable tasks
  • A useful handoff preserves ownership, evidence, and unresolved decisions
  • Procedures must be exercised and updated as operations change
  • Automation executes tasks while orchestration coordinates a workflow
  • Repetitive evidence gathering is a useful early automation target
  • Infrastructure as code makes deployments repeatable and changes reviewable
  • Repeatable deployment can repeat a security error unless definitions are checked
  • Repeated nonactionable alerts call for tuning the responsible detections
  • Detection tuning must be tested against both benign and malicious activity
  • Data enrichment adds context needed to prioritize and interpret an alert
  • Dashboards should expose the operational condition that needs action
  • APIs let security tools exchange data and actions programmatically
  • Webhooks deliver event-driven notifications to another service
  • Incoming integration data needs authentication and validation
  • An installed connector is not proof of a working integration

Unlock with Premium — includes all practice exams and the complete study guide.

Also tested in

References

  1. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-61r3.pdf
  2. https://genai.owasp.org/llmrisk/llm062025-excessive-agency/
  3. https://www.comptia.org/en-us/certifications/cybersecurity-analyst/v4/
  4. https://www.ncsc.gov.uk/collection/incident-management/cyber-incident-response-processes
  5. https://www.cisa.gov/sites/default/files/2024-08/Federal_Government_Cybersecurity_Incident_and_Vulnerability_Response_Playbooks_508C.pdf
  6. https://csrc.nist.gov/glossary/term/orchestration
  7. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-215.pdf
  8. https://www.cisa.gov/resources-tools/resources/guidance-siem-and-soar-implementation
  9. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-204C.pdf
  10. https://cheatsheetseries.owasp.org/cheatsheets/Infrastructure_as_Code_Security_Cheat_Sheet.html
  11. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-92.pdf
  12. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-150.pdf
  13. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-94.pdf
  14. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-137.pdf
  15. https://csrc.nist.gov/glossary/term/application_programming_interface
  16. https://www.rfc-editor.org/rfc/rfc8417.html
  17. https://www.rfc-editor.org/rfc/rfc8935.html
  18. https://csrc.nist.gov/glossary/term/least_privilege
  19. https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-228-upd1.pdf