A campaign alert identifies affected users and devices across multiple sites.

Option A converts a correlated campaign finding into consistent, repeatable containment. Zscaler’s Splunk deployment guide documents a sample SOAR playbook that uses NSS data and Zscaler APIs, adds an unclassified malicious domain to the ZIA denylist, and identifies exposed users. Its Microsoft Sentinel deployment guide describes playbooks for URL blocking and endpoint or account containment. The workflow can also create an auditable incident ticket. Manual site-by-site triage is slower and produces inconsistent handling. Disabling notifications removes coordination without improving evidence. Raising severity changes queue placement but does not contain the threat. Automated actions should still use scoped credentials, required approvals, error handling, and recorded outcomes.