Trace conflicting evidence

Prepare the lab

Save as Triage.ps1 in PowerShell 7. All observations are simulated. Do not replace them with production probes until you have separately tested and approved the collector.

$ErrorActionPreference = 'Stop'
function Get-TriageResult {
    param([pscustomobject]$Evidence)
    $state = 'REVIEW'
    $next = 'Check the application response and affected scope'
    if ($Evidence.Application -eq 'OK') { $state = 'AVAILABLE'; $next = 'Investigate the reported workflow, not ping alone' }
    elseif ($Evidence.Dns -eq 'FAILED') { $next = 'Verify name and DNS source before testing the endpoint' }
    elseif ($Evidence.Application -eq 'UNKNOWN') { $state = 'INCOMPLETE'; $next = 'Collect application evidence' }
    [pscustomobject]@{Computer=$Evidence.Computer; Dns=$Evidence.Dns; Ping=$Evidence.Ping; Application=$Evidence.Application; State=$state; NextAction=$next}
}
$cases = @(
    [pscustomobject]@{Computer='LAB-A';Dns='OK';Ping='FAILED';Application='OK'},
    [pscustomobject]@{Computer='LAB-B';Dns='FAILED';Ping='UNKNOWN';Application='UNKNOWN'},
    [pscustomobject]@{Computer='LAB-C';Dns='OK';Ping='OK';Application='UNKNOWN'}
)
$report = @($cases | ForEach-Object { Get-TriageResult $_ })
$report | Format-List
if (($report.State -join ',') -ne 'AVAILABLE,REVIEW,INCOMPLETE') { throw 'Triage test failed' }

Work through the evidence

Define the support question

For LAB-A, the application answered but ping failed. State what you can establish: that application check was available at that time. You cannot establish that every workflow is healthy or that the device ignores all ICMP traffic.

Trace precedence

The first condition handles an application success before considering DNS. For a real collector, contradictory results must be investigated, including cached DNS or a different target. Priority in a classifier does not erase contradictory evidence.

Distinguish incomplete work

LAB-C has a ping response but no application result. INCOMPLETE communicates an untested layer. A completed network probe is not a completed application investigation.