Triage

Triage is deciding quickly what deserves a proper look and what does not, knowing some decisions will be wrong.

It is uncomfortable and unavoidable: the volume of events is always larger than the capacity to investigate them. The failure is not getting individual calls wrong, it is having no deliberate basis for making them, so the queue gets worked in whatever order it arrived. Good triage is explicit about what it is choosing to ignore, which at least makes the trade visible.

Checked against the primary source.

More on Detection & SOC