The triage mindset

Triage is the discipline of not concluding yet. When an alert lands, your first job is inventory: what does the evidence actually show, what time does it cover, and what is missing. Conclusions come after the timeline, never before it, because early theories filter what you bother to look at next.

Two columns: observed vs inferred

Keep two columns as you work. Observed: log lines, timestamps, hashes, addresses — things you can point at. Inferred: what you think they mean — marked as yours, revisable, and never quoted as fact. Every wrong incident call you will ever hear about started as an inference written down as an observation.

Example from a real-shaped alert:

Observed:  03:03:05 Accepted password for root from 203.0.113.9
Observed:  7 Failed password for root from 203.0.113.9 in prior 12 min
Inferred:  (mine) password was guessed, not leaked — pattern fits spraying-then-success
Missing:   what the session did after login; whether the key or password was used

The missing row is load-bearing: it becomes your next three checks instead of a guess.

Build the timeline

Then order everything earliest-first with gaps labeled as gaps. Most incidents are solved by ordering, not by brilliance — the story is usually visible once the events stand in line. A login at 03:03 after failures reads differently from the same login at noon after none, and only the timeline shows you which one you have.

Triage outputs

A finished triage states four things: the current best assessment with confidence (likely compromise, medium confidence), the discriminating next checks (the evidence that would confirm or kill the theory), the containment already safe to do (revoke the session, block the source — reversible first), and the escalation criteria (what observation triggers the incident commander). You will use exactly this shape in Bolt investigations and BugHunt triage queues.

Key takeaways

• Inventory before theory: observed, inferred (labeled), missing.
• Timelines solve more incidents than brilliance.
• Every triage ends with assessment + next checks + safe containment + escalation line.