PowerShell Ripple Practice: Incident Triage

This capstone practice validates transfer, not memorization. You first isolate relevant logs, then run a focused process query to complete triage context.

Get-ChildItem | Where-Object {$_.Extension -eq '.log'} | Select-Object Name
Get-Process | Where-Object {$_.Name -eq 'pwsh'} | Select-Object Name, Memory

You should see a compact log list and a focused process row:

app.log
error.log
pwsh 220

Incidents require both artifact filtering and process context. This two-step pattern creates a fast baseline for escalation and remediation planning.

• Running process checks before confirming relevant files exist.
• Forgetting projection, which makes output harder to scan.
• Treating partial output as complete triage.

Add severity slicing:

Get-ChildItem | Where-Object {$_.Extension -eq '.log'} | Select-Object Name
Get-Process | Where-Object {$_.Memory -gt 100} | Sort-Object Memory -Descending | Select-Object Name, Memory

Repeat until you can execute both stages cleanly without prompt-driven guidance.