EDR Triage

EDR triage is the first-pass process for deciding what a detection means, how urgent it is, and where to investigate next. It combines alert classification, legitimacy checks, impact assessment, and remediation verification so analysts do not waste time on the wrong evidence set.

Expanded Definition

EDR triage is the structured decision-making step that sits between an endpoint alert and a full incident response workflow. It is not the same as investigation, containment, or eradication. Instead, it is the fast, evidence-led sorting of alerts into categories such as false positive, suspicious activity, confirmed compromise, or unresolved item requiring escalation. In practice, this means checking the endpoint telemetry, validating whether the event matches expected behaviour, and deciding what data must be preserved before any response action changes the host state.

For security teams, the value of triage comes from reducing noise without losing genuine threats. It also depends on the quality of endpoint data, analyst judgement, and clear handling rules. The concept aligns closely with detection and response control expectations in NIST SP 800-53 Rev 5 Security and Privacy Controls, especially where organisations need repeatable monitoring, analysis, and response procedures. Definitions vary across vendors on whether triage includes containment decisions or only prioritisation, so the scope should be documented locally.

The most common misapplication is treating every EDR alert as a full incident, which occurs when teams skip classification and jump directly to isolation or remediation without validating context.

Examples and Use Cases

Implementing EDR triage rigorously often introduces a speed-versus-certainty tradeoff, requiring organisations to balance rapid response against the risk of disrupting legitimate business activity.

• An analyst reviews a suspicious PowerShell execution alert and confirms it was launched by an approved software deployment script, so the item is closed as expected administrative activity.
• A ransomware-like process chain is observed on a workstation, and triage identifies parent-child process anomalies, prompting immediate escalation to containment and preservation of volatile evidence.
• A browser credential theft alert is correlated with impossible login behaviour and unusual token use, which moves the case from low priority to confirmed compromise.
• Repeated high-volume detections from a developer endpoint are found to be caused by a sanctioned penetration test, reducing the need for repeated manual review once the activity is documented.
• Alert enrichment from threat intelligence and endpoint timeline data shows a suspicious binary was introduced after a user downloaded an unsigned file, allowing the team to decide whether to isolate the host or gather more context first.

These use cases are most effective when paired with disciplined investigation standards such as event retention, change tracking, and response playbooks. Where triage is tied to endpoint telemetry from platforms guided by MITRE ATT&CK, the analyst can map observed behaviour to known tactics without overclaiming certainty. The term is also used in SOC workflows for prioritising queues, although the exact handoff point to incident response is still organisation-specific.

Why It Matters for Security Teams

EDR triage matters because poor first-pass decisions create two expensive failures: false confidence and response drag. If analysts misclassify an alert as harmless, an attacker may persist undetected. If they over-escalate routine activity, the SOC burns time on benign noise and becomes slower at recognising real compromise. In both cases, the business impact is the same: weak prioritisation increases dwell time, weakens response quality, and erodes trust in the monitoring stack.

For identity-heavy environments, triage also has an NHI dimension. A suspicious endpoint event may involve service accounts, token abuse, scripts running under privileged identities, or agentic tools that execute with delegated authority. That is where endpoint triage intersects with privileged access oversight and credential governance, especially when the host activity is really an identity problem wearing an endpoint disguise. Security teams often benefit from pairing EDR signals with CISA guidance on endpoint detection and response and broader monitoring expectations in ISO/IEC 27001. Organisations typically encounter the true cost of weak triage only after a breach review reveals that warning signs were present but never properly sorted, at which point EDR triage becomes operationally unavoidable to address.

Related resources from NHI Mgmt Group

• How can AI help with data triage without replacing analysts?
• Why do non-human identities create more triage problems than human users?
• Why do SAST and SCA need different triage rules?
• What breaks when organisations rely on EDR alone for browser security?