In Google Security Operations (SecOps) SOAR, a playbook automates response workflows. When an integration like VirusTotal returns data, the playbook must process it to make decisions. A conditional statement (e.g., an if/else block) is the fundamental playbook component for this.

First, a conditional statement is used to evaluate the VirusTotal output (e.g., malicious detections > 0) to make a recommendation and classify the URL as suspicious or benign (A). Second, based on the specific number of malicious detections returned in the JSON response, another conditional statement can be used to programmatically set the alert's severity to an appropriate level, such as Low, Medium, High, or Critical (E). These two actions directly fulfill the requirements using standard SOAR automation logic.

B. Pass the response back to the SIEM.

This action doesn't involve processing or decision-making within the playbook itself; it merely forwards raw data without making a recommendation or setting severity.

C. Verify that the response is accurate by manually checking the URL in VirusTotal.

This contradicts the primary purpose of SOAR, which is to automate repetitive tasks. A playbook should not require manual intervention for a routine data enrichment step.

D. Create a widget that translates the JSON output to a severity score.

Widgets in Google SecOps are for data visualization and presentation within the case view, not for implementing the core automation logic that sets an alert's properties.

1. Google Cloud Documentation

Chronicle SOAR

"Use conditional statements": This document explains how to use conditional branches (If

Else If

Else) to control the flow of a playbook based on the outputs of previous steps

such as an integration's JSON response. This directly supports using conditionals to evaluate VirusTotal results and take actions like setting severity. (See section: "Configure the If branch").

2. Google Cloud Documentation

Chronicle SOAR

"Playbook overview": This document outlines the purpose of playbooks

which is to "automate the security response workflow by codifying security processes." This includes enrichment (VirusTotal lookup)

logic (conditionals)

and response (setting severity)

confirming that options A and E are core playbook functions

while C (manual steps) is an anti-pattern.

3. Google Cloud Documentation

Chronicle SOAR

"Marketplace and integrations": This page describes how integrations like VirusTotal are used within playbooks to provide data that informs subsequent actions. The output

typically JSON

is parsed and used as input for other playbook blocks

such as conditional statements and actions to modify alert fields. (See section: "Use an integration in a playbook").