Definition
Incident triage is the process of rapidly assessing and prioritizing security incidents to determine the appropriate response. It involves quickly categorizing an incident based on its severity, potential impact, and scope. This allows security teams to allocate resources effectively and address the most critical threats first. In practice, triage involves initial analysis, classification, and assignment of an incident to the relevant response team. It is crucial for minimizing damage, reducing downtime, and maintaining business continuity during a security event. For example, a phishing email reported by an employee might be triaged as low severity unless it contains a known exploit or targets high-value individuals. This differs from incident response, which is the broader process of handling the incident after triage. Incident triage is a key concept covered in CompTIA Security+, CySA+, and CISSP certifications.