Process and analysis
What is Triage?
The fast first pass that decides which of many items deserve real attention, before any of them get analysed properly.
Triage is the quick first assessment that decides which items deserve real attention: which alerts to investigate, which reports to read, which vulnerabilities to patch first. It comes before full analysis, not instead of it.
Good triage uses a few fast questions: is this relevant to us, is it real, how bad would it be, and how urgent is it. The goal is to spend scarce analyst time where it matters.