Endpoint triage is the initial review of a computer or other device to identify suspicious activity and assess whether it may be compromised. Analysts commonly check running processes, executable locations, startup items or other persistence mechanisms, recent system activity, and unexpected network connections.
In practice, an unexplained CPU spike or an unfamiliar process such as a cryptocurrency miner can trigger triage. The goal is to gather and validate evidence—not to treat one unusual process as proof of a breach. Findings can guide containment and determine whether deeper forensic investigation is needed. Defenders should preserve relevant logs and use trusted system tools, since a quick inspection or automated assistant may identify leads but cannot establish an attacker’s identity or the full scope of an incident by itself.