A triage cue is a signal that tells defenders to quickly verify a claim, alert, or artifact before drawing conclusions. It is not proof of compromise by itself; instead, it is a prompt to check logs, asset inventories, endpoint telemetry, and user reports.
Triage cues matter because security teams often face incomplete or misleading information, such as a suspicious hash, a redacted victim name, a threat actor label, or a sudden spike in authentication failures. In real operations, these cues help analysts decide what to inspect first and whether an event deserves escalation. Good triage reduces wasted effort and prevents false assumptions, while bad triage can let a real intrusion blend into background noise. In defensive workflows, a triage cue is the starting point for validation, not the finish line.