Runbook

What it does: a named sequence of steps you run with one click — a repeatable checklist that actually gathers data instead of just telling you what to go do. Comes with starter runbooks (WAN down triage, App reachability triage, Gateway/uplink degradation, DNS sanity, Cert/TLS health, New device onboarding, Perimeter exposure check, Rogue device check) and you can build your own.

Step types: Ping, Traceroute, Path ping, Port scan, DNS lookup, ARP lookup, MAC/OUI lookup, Inventory lookup, Add to inventory, Drift check, Capture drift baseline, SSL check, HTTP check, WHOIS, IP info, SNMP poll, and Note. Every one of those except Note actually runs a tool and records a real result; Note is free-text guidance for something you need to do yourself (verify a physical port, get sign-off before containing a device, etc.) — each step's type shows a green AUTO or amber MANUAL tag so it's obvious at a glance which is which.

Auto-fill / chaining: leave a step's target blank and it uses whatever an earlier step in the SAME run already found — an ARP lookup's discovered IP/MAC feeds a following MAC/OUI lookup, Inventory lookup, or Drift check without retyping it. A result shows "(auto-filled)" next to the value it actually used, so what happened is always visible, never silent. (ARP lookup, IP info, DNS lookup, Capture drift baseline, and Note keep their own blank-target meaning instead — e.g. a blank ARP lookup lists the whole cache.)

Steps are editable in place: change a step's type or target directly in the list (no need to delete and re-add) — useful since starter runbooks ship with example targets (a placeholder gateway IP, a sample device IP) you're expected to replace with your own.

Where results go: every run writes full step-by-step detail to an Incident (titled "Runbook: <name>") — that's the one to open for a ticket reply — AND a one-line summary to the Activity log (did it run, when, how many steps passed). Click any result in the run to jump straight to that Incident; from there, "← Back to Runbook" returns you here. "Copy results" grabs a plain-text dump of the run for pasting straight into a reply, without leaving this screen.

Safe to run: the automated steps are all the same read-only tools used elsewhere in the app (see each tool's own article for specifics — Port scan and SSH/console-driven steps are the ones to be more careful with on systems you don't own). Note steps for containment/config-change actions are deliberately manual — SubnetSlinger never takes an enforcement action on its own.

Reading results: ✓/✕ per step tells you what passed; the auto-fill trail in each label shows exactly what value was used where, so you can trust — and if needed, correct — what the run actually checked.