triage-malware

To triage a malware hash, provide the file hash to initiate the workflow, which determines GTI classification, observed behavior, affected hosts, and recommended containment actions. It applies during malware alerts or investigations to quickly contextualize events and prioritize remediation.

Malware triage extracts behavioral indicators by applying GTI file report enrichment and analyzing observed behavior. This process identifies network IOCs, file modifications, and registry changes to quickly contextualize malicious events and guide remediation efforts.

SIEM context enrichment works by linking malware hash triage data to related cases and existing security alerts. This integration applies during malware investigations to identify affected hosts, correlate related case information, and produce structured outputs for prioritized remediation.

Yes, you can use the malware triage workflow to identify affected hosts and related cases. By providing a suspected malicious file hash, the workflow applies SIEM context enrichment and case linkage to generate structured containment recommendations and prioritize remediation.

The best way to prioritize remediation during a malware alert is to triage the suspected malicious file hash using GTI classification and behavioral indicators. This quickly contextualizes the event, identifies affected hosts, and generates actionable containment recommendations.

You need to provide a suspected malware hash to start the triage process. The workflow uses this hash to determine GTI classification, extract behavioral indicators like network IOCs, and recommend containment actions, requiring no additional dependencies.