in the incident response process which of the following security orchestration, automation, and response (soar) system automation components is often used to document the processes and procedures that are to be used by a human during a manual intervention
