Linux htop Cheat Sheet: How SOC Analysts Triage a Suspicious Process

First question in any Linux incident response: what is actually running on this box?

htop will not replace EDR, but in seconds it shows what is consuming resources, who owns it, and what spawned it.

My triage flow:

🔍 Sort by CPU, then memory, to find the outlier 🌳 Press F5 for tree view. A database daemon has no business spawning a shell 👤 Check the owner. A service account running something interactive deserves a note 📸 Snapshot with ps, free, and uptime before touching anything

Then confirm with lsof and /proc. htop reads from /proc, so a rootkit can hide from it. Treat it as a first look, not a verdict.

The mistake most people make is killing the process first. That can destroy volatile evidence and tip off an attacker.

The full guide covers installs for Debian, Fedora, Arch, and Alpine, a shortcut cheat sheet, hardening tips, and a FAQ.

Read it here: https://www.xpert4cyber.com/2026/10/linux-htop-cheat-sheet-threat-hunting.html