In summary,
the goal of this module was to collect initial triage data. To do
that, we reviewed the required triage data.
We looked at, you know, for example, getting information from the memory,
getting system processes,
getting hard drive information. We then executed standard PowerShell commands,
we looked at native commands, and then we looked at CimInstance commands and
then why you would use either, or maybe a combination of both. We then added
in extra tools, and in this instance,
we used Sysinternals tools, where we were able to take the power of those
troubleshooting utilities to help us retrieve more information, and then we
combined them both together with PowerShell.
And then of course,
we did just focus on formatting the retrieved data into the different
types that we might want as part of a triage script that we might decide
to build. In our next module, we're going to take everything that we
looked at just now, and then we'll start creating a triage script to
collect system information.