Cyber Triage EDR is an incident investigation platform designed to complement existing EDR solutions. The product focuses on investigating security alerts by collecting and analyzing endpoint data from multiple sources. The platform operates on the principle that EDR tools are optimized for detection and generating low false-positive alerts, but are not optimized for comprehensive investigations. When EDR systems generate alerts, attackers have typically been in the network for days, requiring deeper investigation beyond the initial detection. Cyber Triage ingests data from EDR systems and other sources, then applies automated analysis to identify malicious and suspicious items. The platform flags suspicious activity that EDR systems may not highlight and provides additional data that EDR tools may not collect. As analysts flag items during investigation, the system recommends additional relevant items for review. The tool can be deployed in an agentless mode or can utilize existing EDR agents for data collection. It merges data from EDR collections with its own collection capabilities to provide a unified investigation view. The platform is designed to reduce investigation time by providing automated analysis and guided workflows that help security teams understand the full scope of incidents, including initial entry points, lateral movement, command and control software installation, and data exfiltration activities.