Triage Decision: Capability, Severity and Response
What is it?
The triage decision converts behaviour and indicators into an answer the business can act on: what is this sample capable of, how severe is it, how far has it spread, and what should be done now. Capability is the classification (infostealer, ransomware, backdoor, loader); severity weighs capability against the asset it landed on; scope uses the chosen IOCs to count affected hosts; response is the containing action that fits.
Why it matters
Analysis that does not end in a decision is not triage. A responder, a manager and an on-call engineer all need the same crisp output: what it does, how bad, how wide, and the first action. Getting capability and severity right sends the right people; getting scope right stops you containing one host while nineteen keep beaconing; getting the response right cuts the threat without destroying the evidence you will need.
Where you see it
The decision draws on everything already gathered: the behaviour categories from Lesson 1, the ranked IOCs from Lesson 2, the asset's role from the inventory, and the estate-wide match results. It is recorded as a triage verdict — capability, severity, scope, and recommended action — the hand-off to incident response.
What normal looks like
A proportionate verdict matches action to capability and asset: a low-capability adware sample on a single kiosk is cleaned and monitored; a credential stealer on a domain admin's workstation is a high-severity incident escalated at once. The response is neither panic nor complacency but a fit to the facts.
What suspicious looks like
A broken triage is one that stops early or acts disproportionately: closing a 'clean AV' case with active C2 still running, or wiping a host before scoping and losing both the evidence and the count of other victims. The tell is a decision that does not follow from the four questions — capability, severity, scope, response.
How analysts investigate
Answer the four questions in order. Classify capability from the behaviour chain; set severity by combining capability with the value and exposure of the asset; scope by matching your durable IOCs across the estate; then choose the least destructive action that stops the threat and preserves evidence — usually isolate or contain, escalating by severity.
Common beginner mistakes
- Ending at 'it is malicious' without stating capability, severity, scope and a response.
- Rating severity on the malware alone, ignoring the value and exposure of the asset it hit.
- Wiping or re-imaging before scoping — destroying the evidence and the victim count.
What you will be able to do
- Classify a sample's capability from its behaviour chain.
- Set severity by combining capability with the asset's value and exposure.
- Scope with durable IOCs and choose an evidence-preserving response.
Triage is a decision, and the decision has four parts asked in order. Skip any and the output is not actionable — 'it's bad' does not tell a responder whether to page the on-call at 3 a.m. or clean it in the morning. The four questions turn your reading into that answer.
| Question | What you produce |
|---|---|
| 1. Capability? | A class: infostealer / ransomware / backdoor / loader |
| 2. Severity? | Capability × the asset's value and exposure |
| 3. Scope? | Count of hosts matching the durable IOCs |
| 4. Response? | Least destructive action that stops it and preserves evidence |
Worked example — same malware, two verdicts
CASE A asset: kiosk-12 (public lobby kiosk, no domain account)
CASE B asset: WS-adm-02 (a domain administrator's workstation)
both: capability = infostealer (reads credential stores, beacons out)The answer: no — capability is the same, severity is not. Severity is capability weighed against the asset. On the lobby kiosk with no domain account, an infostealer has little to steal: contain, clean, and monitor. On a domain administrator's workstation, the same stealer may harvest credentials to the entire domain: this is a high-severity incident — isolate immediately, escalate, and force a credential reset. Then, in both, scope with the durable IOCs (the mutex, the C2 domain) to find any other victims before you close. The malware set the floor; the asset set the ceiling.
Recap
- Triage ends in a decision with four parts: capability, severity, scope, response.
- Severity = capability weighed against the asset's value and exposure.
- Order is fixed: contain, scope with IOCs, then eradicate — never eradicate first.
Sign in to save your progress on the server.