Triage Malicious Endpoint Activity