So to get started in creating our script,
we need to understand what our tasks are going to be.
Our first task, as always, is to define any variables.
Now,
variables will be static information such as the path to
save to or some other property value,
or maybe it's something that we want as a dynamic variable,
which requires someone to pass information to it,
for example, if you're working with cloud services,
for example, you may need to pass credentials.
So we need to define the variables at the start of our script.
We then create any supporting functions.
These will be the PowerShell blocks of code that perform various actions.
So maybe one of these would be the generation of the HTML to make the report.
We then need to define the commands that we're going to use
for actually retrieving the data itself.
So, we obviously have all the supporting functions,
maybe one of those is generate HTML from this type of data,
the commands that we run, maybe it's running PowerShell,
maybe it's running one of the supporting tools,
but it converts all of that into the right output to pass to the function.
And then lastly, we need to create the output function,
so, what do we want it to look like, and how is that going to be generated?
So let's focus on task one first, we need to define our variables.
So as an example here, I've set my current location,
which would be a variable, and it's going to be set to Get‑Location.
So what that means is if we've copied the PowerShell script to a
different folder other than what we expected it to be,
then it's just going to retrieve the current location.
Then of course, if we're putting a logo into the graphic,
then we're going to have a logo path, and it will be
currentLocation plus append whatever else is needed.
Then we have the report name, which is going to be
Report.html, the report location,
which will be a subfolder in the current location, and then maybe the path to
the Sysinternals because that's what we're going to execute.
So, we can define these variables up front.
What we then need to do is to create our supporting functions.
So, I would take time to think about what those supporting
functions would be, and for this example,
creating the HTML document would be a supporting function
because I need to have something that says,
take this object of data and make it look like HTML, or, create a HTML
document that has a image at the top and maybe a title, and then maybe
there's a topic, you know, of all the contents,
a table there, a list of everything that we had to click into.
Maybe each section's broken into separate tables,
but we need something to generate that.
Then maybe we want to do some checks, and we touched on this earlier that
there may be times where you're using older or newer versions of Windows
and you might want to check the existence of a PowerShell command because
if the newer version exists,
then execute that, if the old version, you know, is there,
then maybe we want to use that instead, but put some logic into some kind
of function. Then also, we may want to retrieve system information using a
function, maybe the ComputerInfo PowerShell command doesn't work as well as
we need to, plus, it may only be available for newer versions, so we want
something more generic.
So instead of executing multiple CimInstance commands,
we may merge all of this together to create our own version of the ComputerInfo
PowerShell command. We then want to retrieve host entries, so, create a function
that knows how to go and get copies of the host entries from a Windows machine,
and then maybe we want to have something that's going to convert XML data into
HTML or CSV data into HTML,
etc. So, define the functions that we want to create so we can
then start to build our PowerShell script. Task three was about
defining commands for data retrieval.
So as an example, if I wish to retrieve memory information,
I'm going to create a variable called MemoryInfo,
which will be what I'm going to use to render the results
out of, and then I have a command, and you can see the
structure that we've used before.
So, Get‑CimInstance, the ClassName,
pipe it out to the properties that we need, and then we use
ConvertTo‑Html, so we can render that.
Now, of course,
combined with that would be if we're rendering
values from an in‑built system tool, for example.
So, auditpol is a Windows tool, so we'd create a variable, AuditPolicyInfo.
We run auditpol /get and the category, and because there's no
mechanism to do selects and converts necessarily,
we're just going to output that as a string.
So as we start to build,
we may see that many of our commands output in multiple different ways.
So an example of that would be retrieving the PowerShell history.
Now, we can use a PowerShell command to do that one, so
Get‑History, and we can convert to HTML automatically.
Another option would be, for example,
retrieving the time zone. We can use a utility, so
tzutil, and it just outputs the time zone.
So it's important to know that we're going to run these
commands as we've done previously,
they're going to come out in all different types of formats, but we
need to somehow convert them into a similar or format such as a
CSV, or a table, or HTML. Task four was to look at how we export
maybe all of those files that we get or the data that we retrieve
into CSV log files.
So as an example, we could create Export‑CsvLogs,
set some variables, which would be the OutPath,
the information that we want to get, and the FileName, and then
we can simply say, I've got my item here and then I want to add
that item to the content and create a file, and it will generate
a CSV file. So, if we're, for example, checking the TCP port information,
which we've done a few times, that we can just use this function to export
it out into a log file as an asset or an extra piece of information that
someone can review if they need to go back and look at the raw data, or
the report doesn't give you enough.
Of course, if we wanted to export as a HTML document,
then of course, we need to come up with some way that this is going to work.
So I've created a function, for example,
New‑HtmlDocument, and then there's this property option here called
ContentSets, and ContentSets is going to be a set of arrays.
So you can see there's an array of computer information,
there's an array of memory information, that's all added into this larger
object called ContentSets, I have a FilePath where it needs to go, and
then I have a CSS option to make it look nice.
So, we're going to come up with the functions and the code
required to build something like this.
A triage script at its root, minimal, is just going to be a bunch of files,
but obviously, to enhance it and make it more user‑friendly,
we can obviously output a report and then make it easier for the person
that's going to review to look through the report and then only have to
go and inspect thousands of lines of CSV, formatted text, or XML, or JSON
to find what they're looking for.