A targeted examination of selected systems to quickly identify whether deeper investigation is needed. Triage scans usually combine lightweight forensics, memory inspection, and file system review, giving analysts faster insight into suspicious hosts without requiring full disk imaging or exhaustive collection.
What a triage scan is used for
A triage scan is a fast, targeted examination of a small set of systems to decide whether deeper investigation is warranted. It is designed for speed and signal, not completeness, so analysts can separate likely noise from cases that need full forensic treatment.
That makes the technique especially useful during incident response, security operations, and ad hoc investigations when responders need an early read on suspicious hosts without committing to full disk imaging or a broad evidence pull.
What triage scans typically examine
Triage scans usually focus on high-value sources that can quickly reveal compromise indicators or unusual activity. Common targets include memory artefacts, running processes, logged-on sessions, recent file activity, persistence locations, and other lightweight host artefacts that can be collected or reviewed quickly.
The value of this approach is that it combines multiple shallow checks into one decision point. Instead of proving every detail, the scan helps answer a narrower question: does this system look suspicious enough to justify full acquisition, deeper parsing, or containment?
How triage scans differ from full forensic collection
A triage scan is deliberately narrower than full forensic collection. Full imaging and exhaustive evidence preservation aim to support later analysis, legal defensibility, and comprehensive reconstruction. Triage, by contrast, is a rapid diagnostic step that accepts less completeness in exchange for faster prioritisation.
In practice, that trade-off means triage scans are most effective when time, scale, or operational pressure prevents deeper review of every host. They are a decision aid, not a substitute for a complete investigation when one is required.
Because the method is selective, it can miss low-signal artefacts, slow-burn persistence, or activity that only becomes visible through broader timeline correlation. A triage result should therefore be treated as an informed filter, not as a final proof of innocence or compromise.
Where triage scans fit in an investigation workflow
Triage scans sit early in the investigative workflow, usually after an alert, user report, or analyst suspicion has identified candidate systems. Their job is to quickly sort hosts into “needs deeper work” and “lower priority for now” buckets so responders can allocate scarce time where it matters most.
In a mature workflow, triage findings feed escalation decisions, case prioritisation, and evidence preservation choices. A strong triage result may justify host isolation, memory capture, or full disk imaging, while a weak or ambiguous result may prompt broader monitoring rather than immediate escalation.
Risk and Threat Considerations
Triage scans can create false confidence if their limited scope is mistaken for a full investigation. They are also sensitive to timing, because volatile artefacts may disappear, and adversaries may use short-lived processes, memory-only payloads, or selective persistence to evade shallow review.
Failure mechanism: Narrow collection can miss the artefact that actually proves compromise, especially when malicious activity is designed to be transient, hidden in memory, or distributed across multiple systems rather than obvious on one host.
Impact: A missed indicator can delay containment, allow lateral movement to continue, and leave responders with an incomplete picture of the incident.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | Triage scans support early detection of suspicious host activity. |
| RS.AN-01 — Analysis | Triage scans are an initial analytical step used to judge whether deeper investigation is needed. | |
| Recommendation — Use DE.CM-01 to route triage findings into monitored anomaly and event workflows. Use RS.AN-01 to analyze triage outputs and decide whether to escalate to full investigation. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Analysis, Monitoring, and Reporting | Triage review relies on quick analysis of host artefacts and logs to spot suspicious activity. |
| SI-4 — System Monitoring | The method depends on targeted monitoring of suspicious systems to detect compromise indicators. | |
| Recommendation — Apply AU-6 to review selected artefacts for indicators that justify deeper forensic collection. Use SI-4 to monitor suspicious hosts and trigger deeper collection when triage suggests compromise. | ||
| MITRE ATT&CK | T1057 — Process Discovery | Triage scans commonly surface running processes and other live host artefacts tied to adversary activity. |
| Recommendation — Map live-process findings to ATT&CK and investigate whether discovery activity supports a broader intrusion path. | ||
Practitioner Guidance
Why practitioners should care: The main value of a triage scan is fast prioritisation, so the method should be used to decide where to invest deeper forensic effort, not to replace it. Treat the result as a routing signal that supports response decisions.
What to watch for: Be cautious when the scan touches only a narrow set of artefacts, when the host may have had time to self-clean, or when suspicious behaviour suggests memory-resident or short-lived execution. Those are the situations where a quick pass is most likely to understate the problem.
Practitioner takeaway: Use triage scans to accelerate investigation, but pair them with a clear escalation threshold so speed does not become a substitute for evidence.
