A security analyst is designing an automation workflow in XSIAM to automatically quarantine endpoints exhibiting specific malware behavior identified by XDR. The workflow needs to first enrich the endpoint details from an external CMDB, then check if the endpoint belongs to a critical asset group, and finally, if both conditions are met, initiate a quarantine action via an API call to the endpoint security solution. Which XSIAM automation construct would be most suitable for this conditional logic and external system interaction?
正解：C
XSIAM Playbooks are designed for complex, multi-step automation workflows, precisely matching the scenario. They support 'Conditional Steps' to implement 'if-then' logic (e.g., checking for critical asset groups) and 'External API Integrations' to interact with third-party systems like a CMDB for enrichment and an endpoint security solution for quarantine. Options A, B, D, and E are either too simplistic, not designed for workflow automation, or involve manual intervention.
