Threat triage is the first-pass review of a security alert, claim, or artifact to decide whether it is likely real, urgent, or just noise. Analysts quickly check the source, context, indicators, and supporting logs before spending time on deeper investigation. The goal is not to prove every detail immediately, but to sort weak signals from evidence that deserves escalation.
In cyber security, triage matters because defenders face more alerts than they can investigate fully. A ransomware claim, suspicious hash, or named target may be a useful lead, but it can also be exaggeration, false attribution, or automation noise. Good triage helps teams prioritize containment, verify access logs, inspect endpoints, and decide whether to dismiss, monitor, or escalate an event. Poor triage wastes time or lets a real intrusion slip by.