The Triage Workflow
What is it?
Triage is the fast first pass that decides how much analysis a sample needs and in what order: identify the file type, hash it and check what is already known, run quick static checks (strings, imports), and only then decide whether deep static or dynamic analysis is warranted.
Why it matters
Analysis time is scarce and samples are many. Triage aims the expensive deep analysis at the samples that need it, and resolves the easy ones (known-good, known-bad) in minutes.
Where you see it
The intake queue of every malware desk: each sample triaged before anyone commits hours to it.
What normal looks like
A triage note per sample: type, hash, known/unknown, quick static observations, and a recommended depth.
What suspicious looks like
Not applicable directly — triage is workflow, not a verdict.
How analysts investigate
By running the same short checklist on every sample and escalating to deep analysis only where triage found reason to.
Common beginner mistakes
- Jumping straight to detonation on every sample — deep dynamic analysis on a sample a hash lookup would have resolved in ten seconds wastes the scarce resource triage exists to protect.
Quick check
A submitted sample's hash matches a well-known, already-analyzed malware family in your intel. What does triage conclude?
A quick self-check — it doesn't affect your XP or progress.
Sign in to save your progress on the server.