Skip to content
NeuroDynamic Account Download free

The ITSpecta guide

Every tool and setting, explained in three layers. Read as much or as little as you need.

What it does in plain wordsWhy it works this wayTechnical detail for the curious

Getting started

Running ITSpecta

One file, on a workstation, a server or the management box you look after everything from.

What it does

  • Unzip and run. ITSpecta keeps everything in a data folder beside it, so a copy on a USB stick carries its own work.
  • Install, if you prefer. kitbag install adds a Start menu entry for you only. No admin rights.
  • Runs anywhere you work: your own workstation, a jump server, or a management box with access to the devices on your network. It calls each device by what it is: this workstation, this server, dc01.
  • Here or there: check and fix the device ITSpecta runs on, or use it to reach others: connect, run scripts, watch them and read their logs.
  • First time: Home shows a short Get started list: watch a connection, snip something, and you're away.

Why

Engineers move between machines all day. A kit that needs no installer, no admin rights and no internet works on the locked-down server and the spare laptop alike.

What it's for, and what it isn't

ITSpecta is a personal multitool for everyday jobs: quick checks, first looks, small fixes and writing them up, in fewer clicks. It doesn't replace your monitoring platform (it watches only while it's open), your password manager (it can use yours), your remote management tools or your ticketing system (it feeds them).

Technical detail
  • A single Go program with no external dependencies, for Windows 10 and 11 (x64 and ARM).
  • A Linux preview build exists: it opens in your browser and runs the network, monitoring, scan, SSH and script tools. Snips, built-in terminals, the shortcuts and local event-log analysis are Windows-only for now.
  • The interface is a local web page served only to this device (127.0.0.1) with a key that changes every launch.
  • Only one copy can use a data folder at a time, so two windows can't overwrite each other's work.
  • kitbag uninstall --dry-run lists exactly what an uninstall would remove; your data is always left.

Finding your way

Tools are grouped by job in the sidebar, and anything is a search away.

What it does

  • The sidebar groups tools by job: Watch, Connect, Diagnose, Document and Reference. Small numbers show what's running or needs a look. Collapse it to icons from the bottom-left button.
  • Search: press Ctrl+K and type a tool or an action. Type an IP or host name and you get actions for it: trace, look up, whois, scan.
  • The target chip at the top remembers the last host you used, and fills it in for the next tool. Clear it with ×.
  • Snip sits top right on every screen (or press Alt+A anywhere), and Alerts shows a count when something's new.
  • Alt+Q opens the NeuroDynamic menu from any app. See Shortcuts.
  • Every page says what it's for at the top, with How to use this page: three short steps. They're open the first time you visit a page, then tucked away. Settings > Look > Show page tips again brings them back.
  • Home shows what needs a look, This device (address, gateway, restart pending, disk space, with Copy for a ticket), and Pick up where you left off: the guide you're recording, an open incident, your last scan and Logs look.
  • Add to dashboard and Add to guide buttons appear on monitors, checks, logs and results across ITSpecta. See Dashboard and Collecting for a guide.
  • Every tool has its own address, so reloading keeps your place.

Why

Twenty tools would be a maze as tabs. Grouping by job and searching by intent means you go straight from "this IP looks odd" to the tool that answers it.

Technical detail
  • Alt+1 to Alt+9 jump to the first nine tools in the sidebar.
  • Tools you switch off (Settings > Sections) are left out of search too.
  • Search recognises IPv4, IPv6, CIDR ranges and host names.

Watch

Know before users do.

Dashboard

New

Everything you're watching, live, on one screen.

What it does

  • Widgets for path monitors, the target grid, service checks, alerts, certificates, scheduled and running scripts, a live terminal, logs and syslog, this device, drives, scan changes, the open incident and pinned notes.
  • Add to dashboard appears on monitors, checks, logs and other live tools. Press it to pin; press again to remove.
  • Edit layout: drag widgets, set the width (S, M, L, XL) or remove them. Problems glow red.
  • Several dashboards, such as Morning checks and Network operations, and a Wall display mode for a screen in the office.

Why

When several things are running, one glance should tell you whether anything needs you.

Technical detail
  • Widgets read the same live streams as their tools; the dashboard adds no extra checks or network traffic.
  • Layouts are saved per dashboard in your profile.

Monitors

Watch the path to a host hop by hop, many hosts at once, and whether services answer.

What it does

  • Paths: type a host and Start watching. Each hop gets its loss, best, median, 95th percentile, jitter and worst, and its own line on the graph.
  • Findings in plain English: "Loss starts at hop 6 and carries on to the destination" is real loss. "Hop 3 drops 40% but later hops don't" is a router ignoring pings; it shows as ○ ignored.
  • Probe with ping, or a TCP port such as 443 when pings are blocked.
  • The "..." on a hop: copy, watch that hop on its own, reverse DNS, whois and network owner, test a port, add to the incident notebook.
  • Target grid: paste hosts, a range or a subnet. Each gets a tile that's green, yellow (slow) or red (down for 3 checks). Click one to trace it.
  • Service checks: does the web page say "Welcome", does SMTP answer, does LDAP bind, does DNS give the right address?
  • Report and CSV save the evidence for someone who wasn't watching.
  • Check every: each monitor checks once a second by default, the best setting for catching short drops. Choose 2, 5, 10 or 30 seconds, or 1 or 5 minutes, for a lighter check on links you watch all day; short drops may be missed at longer intervals. The target grid checks every 10 seconds by default, and each service check has its own interval.
  • Groups and one-line view: put monitors in groups such as "Head office and branches". Press − on a monitor to shrink it to one line (name, a small graph, latency, loss and interval), or + to see every hop. Minimise all and Expand all sit above the list.
  • Add to dashboard on a monitor puts it on the Dashboard as a live widget.

Why

Most "the network is slow" calls end in an argument about whose fault it is. Separating real loss from routers that simply deprioritise pings gives you an answer you can send to a provider.

Technical detail
  • Ping uses Windows' own ICMP API, so it needs no admin rights.
  • Loss isn't shown in red until there are enough replies to judge it.
  • Healthy monitors collapse to one line; you decide which stay open.
  • The grid checks each host every 10 seconds, up to 500 hosts. Slow means above 150 ms unless you change it.
  • Up to 24 hours of history is kept for the graphs.

Cert watch

Know before a certificate expires, and whether its setup is sound.

What it does

  • Add a name and host:port, then Watch. Problems are listed first: expiring within 14 days, or unreachable.
  • Details shows the names it covers, the issuer, the dates and key, and checks: chain trusted, name matches, TLS versions, and outdated protocols still accepted.
  • Alert at 14 days adds an alert rule; Copy for a ticket copies a summary.

Why

An expired certificate takes a service down as surely as a power cut, and it's entirely predictable.

Technical detail
  • Checked when ITSpecta starts and every 6 hours.
  • It reports the validity window and the chain; it doesn't install or trust anything.
  • Certificates in this device's own store are in System > Certificates.

Logs

See what happened, and when, across several logs at once: pick where to look, pick when, and read one timeline.

What it does

  • 1 Where to look: this device or one from Connections, and which logs: System, Application, Security, Setup, a log file, the Linux journal, or devices sending syslog.
  • 2 When: Live, from now; A time in the past, with quick picks such as Last hour; or Same time, several days, for problems that come back at the same time.
  • 3 What happened: a one-line summary, the number of errors and warnings, what stands out in plain English, and a timeline. Click a bar to see that minute.
  • Click any event to read all of it, with what it means. From there: Ask AI, add it to the notebook, copy it for a ticket, or hide events like it.
  • Normal noise, the events Windows logs all the time, is hidden unless you ask for it.
  • Syslog: choose Devices sending syslog and point switches, firewalls and access points at this device on UDP 514.
  • Add to dashboard keeps a live count of errors and warnings on the Dashboard; Add to guide on an event puts it in a guide as evidence.

Why

Most problems show up in more than one log at once. Seeing a disk retry, a write failure and a backup error in the same minute tells the story without opening Event Viewer three times.

Technical detail
  • Up to 7 days per look, and up to 20,000 lines on the page. Export or add to the notebook to keep them.
  • Events are ordered by the source's own clock. Syslog devices that don't send a time zone are placed by when they arrived, and marked.
  • The Security log needs admin. Other devices are read over SSH (Linux) or WinRM (Windows).
  • Syslog accepts RFC 3164 and RFC 5424. If port 514 is taken, ITSpecta uses 5514 and says so; Windows Firewall asks once.
  • Search can be a regular expression (More filters). Export is CSV or text, and includes only what matches your filters.

Alerts

Hear about problems when they start, even when ITSpecta is in the background.

What it does

  • Recent: what happened and when, with an Open button to the tool. Resolved alerts are ticked.
  • Rules, switched on to start with: real loss on a monitor, a grid target going down, a service check failing, a certificate with 14 days left. "A scheduled script's result changes" is there, off.
  • How you're told: Windows notifications, a soft sound, an optional Teams or Slack message, and quiet hours.

Why

A monitor only helps if someone looks at it. Alerts fire once when trouble starts and again when it clears, so you're told without being nagged.

Technical detail
  • The Teams or Slack message is the only alert that leaves this device, and only if you add a webhook.
  • Quiet hours mute sounds and messages; alerts are still listed.
  • The last 500 alerts are kept.

Connect

Get to every server.

Connections

Your RDP, SSH and VNC servers in one place, opened in Windows' own clients.

What it does

  • New connection: type (Remote Desktop, SSH, VNC), name, host, port, user, folder, credential, tags and notes.
  • When it opens (Remote Desktop): full screen, a window of a chosen size, or all monitors.
  • Connect opens Remote Desktop or VNC; SSH opens a session in Terminals.
  • The "..." menu: ping, trace, add to the target grid, run a script on it, duplicate, delete.
  • Take your setup to another device: one encrypted file with your connections, scripts, guides and settings.

Why

A connection list that's also a target list means the servers you open every day are the same ones your scripts, scans and monitors use.

Technical detail
  • ITSpecta never writes passwords into the .rdp file. Windows asks once whether to trust a ITSpecta-made RDP file.
  • Credentials come from the vault, Windows Credential Manager, or you type them each time (Settings > Passwords).
  • On Linux, Remote Desktop uses xfreerdp.

Terminals

Local consoles, SSH sessions and serial consoles, side by side, all logged.

What it does

  • New: PowerShell, Command Prompt, Git Bash or WSL (whatever this device has), PowerShell as administrator, SSH to a saved connection, or a serial console on a COM port.
  • Tabs or side by side. Double-click a tab to rename it for the job it's doing.
  • Broadcast typing sends what you type to every ticked session: the same command on many servers.
  • Snippets types a saved command without pressing Enter.

Why

A console cable to a switch, an SSH session and a local PowerShell are usually three different programs. Here they share one window, and every session is saved to disk for the write-up.

Technical detail
  • Sessions keep running when you switch tools or reload.
  • Serial settings: 9600 or 115200 baud, data bits, parity, stop bits and flow control.
  • Session logs are kept in the data folder under sessions.

Scripts

Ready-made and your own scripts, run safely on this device or many servers at once.

What it does

  • Library in groups: Windows health, Active Directory, Linux, network devices, desktop fixes, and Yours.
  • Each script shows its safety level: Read-only, Changes things or Disruptive. Some carry a Needs admin label.
  • Run on: folders, tags or single servers from Connections, or hosts you type.
  • Results as a table with OK, warn and fail, and what changed since the last run.
  • Schedule read-only scripts, and get an alert when a result changes.
  • Runs and the Audit log record who ran what, where, and when.

Why

Checking eleven servers by hand takes an hour. Running a known script on all of them, with the list shown first and a record kept, takes a minute and is safe to hand to someone new.

Technical detail
  • Windows servers are reached over WinRM, Linux and network devices over SSH.
  • Before anything runs you see the exact servers. Scripts that change things show the command too; disruptive ones ask you to type the number of servers.
  • Built-in scripts can't be edited; Duplicate to edit makes your own copy.
  • Schedules run while ITSpecta is open.

Diagnose

Find what's wrong.

IP & port scan

Find what's on a network, what each host is, and which services answer.

What it does

  • Addresses: a subnet (192.168.0.0/24), a range (192.168.4.1-50), names, or a mix. Quick picks offer this device's own networks, your Connections and the target grid.
  • Find hosts by ping, knocking on common ports for hosts that ignore ping, names (reverse DNS and NetBIOS), and MAC address and maker on your own subnet.
  • Ports to check by job: Quick, Windows and AD, Network devices, Web and databases, Servers, Everything common, or pick groups yourself: remote access, file sharing, directory and sign-in, web, databases, mail, printing, virtualisation, VPN, monitoring, messaging.
  • Results appear as they're found: name, a guess at what it is (domain controller, printer, hypervisor), maker, reply time and open ports. Click a host to see what each service said.
  • Changes since the last scan: new hosts, gone hosts and ports that closed.
  • From any host: connect, add to Connections or the grid, trace, SNMP walk, run a script.

Why

Knowing what's on a network is the first step of most jobs. Picking ports by what you're looking for, rather than remembering numbers, and seeing what changed, turns a scan into an answer.

Technical detail
  • Ordinary connections only: a full TCP connect, Windows' ping, and plain UDP requests. No stealth scans or crafted packets, so intrusion detection and antivirus see normal traffic.
  • Gentle (the default) checks about 100 ports a second, one at a time per host. Normal and Fast are quicker; Fast may trip intrusion detection.
  • Ports are checked only on hosts that answered, which keeps big scans short.
  • UDP ports are checked only with a real, harmless request (DNS, NTP, NetBIOS, SQL Browser, IPMI; SNMP only with a community you saved). ITSpecta never guesses passwords or communities.
  • More than 1,024 addresses, or any internet address, asks you to confirm first. Every scan is in the audit log.
  • "Looks like" is a guess from open ports, greetings and the reply's TTL.

Device network

How a device is connected (this one or a remote one) and quick tests for the usual suspects.

What it does

  • Device: this device, or any saved device over WinRM, SSH or SNMP. The title says what it is: "This workstation's network", "dc01's network".
  • Overview: each active adapter's address, gateway, DNS servers, DHCP lease and maker; whether internet traffic goes through a VPN; proxy; clock offset; and your public IP if you ask.
  • Listening ports with the program behind each, marked "Open to the network" or "This device only".
  • Routes, Neighbours (with a sweep of the local subnet) and Wi-Fi (signal, channel, nearby networks).
  • Tests, run from this device: trace over TCP, largest packet (MTU), test a port, Wake-on-LAN, DHCP servers, packet capture, speed between two points.

Why

"Can it reach the server?" has a dozen causes: wrong DNS, a VPN taking the default route, a blocked port, a packet-size problem. They're all on one page here.

Technical detail
  • Over SNMP, interfaces, addresses, routes and ARP come from the device's MIBs; listening ports aren't available.
  • DHCP check and packet capture need admin rights; see Features that need admin.
  • "Find my public IP" asks one outside service, only when you click.

DNS

Ask several DNS servers at once, including the one this device really uses, and see who disagrees.

What it does

  • Compare servers: this device's own DNS first, your domain controllers, the main public resolvers, and any extra you name. A note explains disagreements: "This device's DNS gives an old address. Flush it or wait 14 minutes."
  • Mail records: MX, SPF, DMARC and DKIM, with advice.
  • Who's in charge: follows a name from the root down, so you can see whose servers answer.

Why

"It works for me" is usually two DNS servers giving different answers. Asking them side by side settles it.

Technical detail
  • Record types: A, AAAA, CNAME, MX, TXT, NS, SOA, PTR, CAA, SRV.
  • Internal names get "no answer" from public resolvers; that's expected and said plainly.

Troubleshoot

Find out what happened on a device, without reading raw logs.

What it does

  • Ticket snapshot: user, Windows version, uptime, pending reboot, disk, IP, gateway, DNS, domain trust and recent errors. Copy for the ticket gives a short text block. Works on remote devices too.
  • What happened at...: pick a device, day and time window, then Look. What stands out is shown first, in plain English, with harmless entries hidden and links to matching alerts.
  • Account lockouts: is the user locked out, when, which domain controller, and which computer caused it. Then unlock, or open your reset guide.
  • AD health: replication, FSMO roles, clock skew, SYSVOL.

Why

The answer is usually in the event log, buried under thousands of harmless entries. Showing only what stands out, explained, saves the hour of scrolling.

Technical detail
  • Error codes link to the decoder in Tools.
  • Finding the lockout source reads the domain's PDC emulator Security log (event 4740), which needs Event Log Readers rights.
  • Account lockouts is marked Preview until it's been tested on more domains.

System

What a device is, what changed, and its certificates and scheduled tasks.

What it does

  • Inventory: disk, memory, processor and uptime at a glance, then model, BIOS, disks and network adapters. Works on remote devices over SSH.
  • What changed: compared with an earlier snapshot: software added or updated, updates installed, and where disk space went.
  • Certificates in this device's stores, with expiry; Scheduled tasks with their last result explained.

Why

"What's different since it worked last week?" is the question behind most problems. A snapshot each time you look answers it.

Technical detail
  • A snapshot is saved each time inventory is collected, at most once an hour; 12 are kept per device.
  • A disk above 90% full is shown in red, and links to Find big files.

Disk usage

New

See what's filling a drive, and clear it.

What it does

  • Drives at the top, with how full each is.
  • Biggest folders first, with a bar for each one's share. Click to look inside; the path at the top takes you back.
  • What kind of files: a chart of space by type (disk images, video, programs, archives...). Biggest files lists the largest ones anywhere below.
  • Quick wins: Windows Update leftovers, the Recycle Bin, old temporary files and old downloads, with their sizes.
  • Compare any two scans: what's new, what grew, what shrank and what was removed, by how much. Filter by kind of change, size or name, and export the differences.
  • History keeps the last 10 scans of each drive or folder (you choose how many), saved as CSV files you can open in Excel.

Why

A full drive is one of the most common calls. This shows where the space went in seconds, without installing anything.

Technical detail
  • Reads sizes only. Folders Windows keeps from standard users show Needs admin. Click one and ITSpecta asks whether to enable admin just to measure it, with a warning that admin can see every user's files there. Say yes, then yes to Windows' own prompt; only that one measurement runs as admin.
  • Anything you delete goes to the Recycle Bin, after a confirmation showing its size, how many files it holds, and whether a program is using it. Big folders need a tick first. Windows Update cleanup uses Windows' own tool and needs admin.
  • Protected locations can't be deleted from ITSpecta: Windows, Program Files, ProgramData, user profiles, AppData, OneDrive, recovery and restore-point folders, the page and hibernation files. Their menu says Why can't I delete this? and suggests the safe way instead, such as uninstalling the program or Windows' own clean-up.
  • Works on any folder or share, such as \\fs01\home. Each scan is kept, so you can see what grew since last time.

Tools

Small everyday converters and checkers. Everything runs on this device, so it's safe to paste real values.

What it does

  • Error codes: paste a Windows, HTTP, SMTP, LDAP or Kerberos code and get what it means and what to do.
  • Look up: whois and network owner, port numbers.
  • Web and TLS: certificate and TLS check, plus certificate tasks (decode, split, match a key, convert, make a test certificate); HTTP requests with a timing breakdown.
  • Addressing: subnet calculator with split. IP & port scan has its own page.
  • Convert: Base64, hex, URL, JWT, hashes and checksums, time and cron, JSON, YAML and XML, text compare, UUIDs, connection strings.
  • Files: find big files; passwords and keys.

Why

The alternative is pasting a production token or a customer's certificate into a website. Here it never leaves the device.

Technical detail
  • Converters update as you type; network tools have a button.
  • Every result has Copy and Add to a guide.

SNMP walk

New

Read switches, routers, firewalls, printers and UPSs, without logging in. Read-only.

What it does

  • Choose the device, version (v2c, v3 or v1) and community or v3 user.
  • What to read: system, interfaces, IP addresses, routes, ARP, LLDP and CDP neighbours, hardware, storage and processes, printer supplies, UPS, the whole device, or one OID.
  • Readable view: tables you can use, such as interfaces with status, speed and errors (errors that rose since last time in red). Raw values shows every OID.
  • Export CSV, Add to Connections, Ask AI.

Why

Most network kit speaks SNMP even when you can't log in. Reading it turns "is that switch port erroring?" into a one-minute answer.

Technical detail
  • Uses UDP 161 from this device. Stops after 10,000 values or 60 seconds.
  • Communities and v3 passwords come from Settings > Passwords. ITSpecta never guesses communities and never sets values.

Document

Write it up as you go.

Snip & text

Capture anything on screen, read its text, mark it up, and use it anywhere.

What it does

  • Snip: press Alt+A in any window, or use Region, Window or Full screen, with an optional delay.
  • It opens straight in the editor, full size: the snip is already copied, saved and read, and the Found list shows the addresses, host names and error codes in it, each with a button: trace, test port, look up, decode. Back to where I was returns you to the page you were on.
  • Prefer to stay where you are? Settings > Snip & text > After a snip > Just copy it shows a small panel instead.
  • Fit shows the whole snip; Actual size shows it pixel for pixel. A wide snip moves the snip list to a strip and the text underneath, so nothing is cut off.
  • Mark it up: arrow, box, highlighter, numbered step, text and blur. Marks stay editable, even inside a guide.
  • Text: as on screen, plain lines, or as a table you can paste into Excel.
  • Your snips are kept and searchable by the text inside them.
  • Record steps: every snip becomes the next step of a guide.

Why

Most IT evidence starts as something on a screen. Reading it for you means no retyping addresses from a screenshot, and no screenshots lost in a Downloads folder.

Technical detail
  • Text is read on this device by Windows' own text recognition. Nothing is uploaded.
  • Large captures are read in overlapping tiles so small text stays readable; "Re-read at 2x" helps tiny text.
  • Blur hides content in everything you copy, save or export. The original stays only in ITSpecta's data folder.
  • Unused snips are kept 90 days; snips in a guide are always kept. Deleted snips go to a bin for 30 days.

How-to guides

Knowledge articles and operational documents, built from your snips as you work.

What it does

  • New guide from a template. Knowledge articles, ready for your knowledge base: Work instruction, Issue, Information document, FAQ. Operational documents: Runbook, Incident report, Change plan, Handover note. Plus your own.
  • Tasks hold numbered steps, screenshots, tips, warnings and commands. Press / to add anything; drag tasks in the outline to reorder.
  • Record steps: do the job once and each snip becomes a step, with its text filled in.
  • Style check as you write: pronouns, passive voice, acronyms not spelled out, punctuation, and personal data in text and screenshots. Most fixes are one click.
  • Placeholders such as {ticket number} become questions when someone uses your template.
  • Export to Word, PDF, Markdown or a web page, or Copy into ServiceNow.
  • Dictate a step with LexVoca, if you have it.
  • Add to guide from other tools: log events, script results, DNS checks, scans and snips go in as a step or as evidence. See Collecting for a guide.

Why

Documentation written after the job is late and half-remembered. Written while you do it, from your own screenshots, it's accurate and done when the job is.

Technical detail
  • The style check follows the Knowledge Management Style Guide 2.0 when it's selected in Settings.
  • Tasks become accordions in your knowledge base, collapsed when there are three or more.
  • Guides save themselves two seconds after you stop typing.
  • Guides from older versions are converted when you first open them; a backup is kept.

Copying into your knowledge base

Each field copied separately, formatted the way your knowledge base expects.

What it does

  1. In your knowledge base, start a new article with the same template as your guide.
  2. In ITSpecta, choose Copy into ServiceNow.
  3. Copy each field across: knowledge base, category, valid to, short description, then the text sections such as Introduction, Before you begin and Instructions.
  4. If it asks whether to keep the source formatting, choose No.
  5. Save the screenshots for upload, and insert each where [Screenshot N] appears.
  6. Back in ITSpecta, record the KB number so the guide shows it's published.

Why

Pasting a whole document into a knowledge base brings messy formatting with it. Copying clean headings, lists, bold and italics field by field lets the knowledge base apply its own styles, so reviewers have less to fix.

Technical detail
  • Copying is blocked while the style check finds personal data (a setting, on by default).
  • Preview as it will look shows the article in the style guide's fonts.
  • There's no Meta field: the style guide notes it was removed for AI Search.
  • If your knowledge base doesn't accept pasted accordions, switch Settings > Guides > Accordion markup to bold headings.

Scratchpad

New

Somewhere to dump notes and screenshots, fast.

What it does

  • Type, or paste text and screenshots with Ctrl+V. Drop pictures on it, or snip straight into it.
  • Addresses, error codes and ticket numbers in a card get buttons, as in Snip.
  • Pin what matters. Unpinned cards clear after 7 days if you choose.
  • Send any card to a guide, the incident notebook or the clipboard.

Why

Mid-call, you need to put things down before you know where they belong.

Technical detail
  • Stored on this device, in data\scratchpad. Nothing is uploaded.

Collecting for a guide

Bring evidence from every tool into a guide as you go.

What it does

  • Add to guide appears on log events, script results, DNS comparisons, scan changes, ticket snapshots, error explanations, monitors, snips and scratchpad cards.
  • Choose the guide, then where: a new step, into a step, or Evidence at the end. A preview shows what will be added.
  • While Record steps is on, the top bar says which guide you're recording into. Click it to switch or stop.
  • Not sure yet? Gather things in the Scratchpad, then send them across.

Why

The facts for a guide are spread across tools. This brings them with you instead of retyping them.

Technical detail
  • Each added item keeps where it came from and when.
  • Internal addresses and names can be blurred in the copy; the original stays.

Incident notebook

Everything during an outage in one timeline, then an incident report in one click.

What it does

  • New incident: a title, start time and ticket number.
  • Type notes as you go; times are added for you. While an incident is open, alerts, snips and anything you Add to notebook appear in the timeline automatically.
  • Status: investigating, fixed and watching, or closed.
  • Create incident report makes a guide with the timeline, your snips, and headings for cause and actions. Ask AI can draft those for you to check.

Why

The write-up is the part that gets skipped. If the timeline builds itself while you work, the report is mostly done before the outage is over.

Technical detail
  • Copy timeline for the ticket gives plain text with times.
  • Notebooks are kept in the data folder under notebook.

Bookmarks

Web consoles, hosts and shares you open often.

What it does

  • Add a URL, host or \\server\share, in a group.
  • Open web consoles in the browser you choose, hosts with ping or SSH, shares in Explorer.

Why

Firewall admin pages and management consoles live on odd ports at odd addresses. One list beats hunting through browser profiles.

Settings

Saved straight away. Settings belong to the device ITSpecta runs on.

LexVoca and ClaraVoca

New

Speak instead of type, and hear your guides read back.

What it does

  • Dictate anywhere: click a box, press Alt+Z, speak, press it again. Works in guide steps, notes, the scratchpad and search.
  • Alt+Q opens the NeuroDynamic family menu. ITSpecta's letters: K open ITSpecta, W watch a host, N note in the notebook.
  • Voice actions, coming with a LexVoca update: "ITSpecta note...", "Scratchpad...", "Snip", "Start recording steps", "Next step...", "Watch 192.168.0.40", "What happened at half ten?" and "Open disk usage". Switch them on in both apps. In ITSpecta use Settings > LexVoca and ClaraVoca; they start off. This receiving side needs a compatible LexVoca sending build.
  • Read aloud with ClaraVoca, in a guide, reads the title, steps and captions.

Why

Your hands are often busy with a keyboard that isn't ITSpecta's.

Technical detail
  • The apps talk through hidden NeuroDynamic windows on this PC. Nothing goes over the network.
  • Accepted voice actions are confirmed in ITSpecta with Undo. Newer changes can make an Undo unsafe, in which case it is refused. Actions and recognised phrases are kept in a local audit. Voice never runs a script that changes things, and never starts a scan by itself.
  • Current path monitoring supports IPv4. IPv6 watch requests are explicitly refused. Real speech and cross-app comfort still need a manual check.
  • ClaraVoca hand-off confirms at most that a request was taken, not that sound played.

Sections

Switch on the parts of ITSpecta you use. The rest gets out of the way.

What it does

  • One switch per section: Watch, Connect, Diagnose, Document, Reference. Inside each, tick or untick single tools.
  • A switched-off tool disappears from the sidebar, search, Home and its settings. The sidebar says how many are off, with a link back here.
  • Home, Help and Settings are always on.

Why

A service desk engineer and a network engineer need different kits. Showing only what you use keeps ITSpecta calm without taking anything away.

Technical detail
  • Nothing is deleted when you switch something off.
  • Background work for switched-off tools stops: with Document off, the snip shortcut is released.

Passwords and the vault

Where ITSpecta gets passwords and keys, how the vault keeps them safe, and what to do if you forget the passphrase.

Setting up the vault

  • ITSpecta asks the first time you need it: when you pick From the vault for a connection or script, or press Set up the vault in Settings > Passwords.
  • Choose one passphrase of 12 characters or more and type it twice. Four unrelated words are easy to remember and hard to guess.
  • Add a reminder if you like. It is public and shown on the unlock screen: anyone who can read this data folder can read it. Never put the passphrase in it; ITSpecta refuses a reminder containing it.
  • Tick that you understand it can't be recovered, then Set up the vault.

Using it

  • Store a password, SSH key or API key with a name, such as "DC admin". Connections and scripts point at that name.
  • Never shown again. Once stored, a password can't be displayed, copied or exported to the screen, by you or anyone. ITSpecta hands it straight to Remote Desktop, SSH or the script. To change it, Replace it.
  • Locks itself after 15 minutes idle (you can change this) and whenever ITSpecta closes. Unlock with the passphrase.
  • Forgot the passphrase? Nobody can open the vault, not even ITSpecta. Reset the vault in Settings > Passwords deletes the stored entries; store them again.
  • Not allowed an app vault? Choose Windows Credential Manager, or your own password system so ITSpecta asks each time and you paste from CyberArk, Secret Server, Keeper or similar.

Why

Admin passwords end up in .rdp files, scripts and notes. The vault keeps them in one encrypted place that's useless to anyone who copies it without the passphrase.

How well is it encrypted?
  • AES-256-GCM encrypts every entry. GCM also detects any change to the file, so a tampered vault won't open.
  • The key is made from your passphrase with Argon2id, using 64 MB of memory, 3 passes and 4 threads, and a random 16-byte salt. That makes each guess slow and memory-hungry, so brute-forcing a stolen file is expensive.
  • The passphrase is never stored. The key exists only in memory while the vault is unlocked, and is dropped when it locks.
  • Every save re-encrypts everything with a fresh random nonce. The file is data\vault.enc.
  • The interface has no way to read a secret back: it can list names, store, replace and delete. Secrets never go into logs, exports, the audit log or Ask AI.
  • Taking it to another PC: an exported profile includes vault entries only if you tick it, sealed with a passphrase you choose for the file.

Ask AI

Optional

Ask questions about logs, results and text ITSpecta has already collected. It reads; it never acts.

What it does

  • Ask AI appears in Logs, Monitors, Troubleshoot, Scripts, System, Snip, the notebook and the guide style check.
  • A panel opens with the data it will read, suggested questions ("What is the most likely cause?", "Summarise for a ticket"), and a box for your own.
  • Your NeuroDynamic account: Ask AI runs through it, and NeuroDynamic chooses the model. Sign in once in Settings > Ask AI. LexVoca and ClaraVoca on this PC use the same sign-in, and signing out in any of them signs you out of all three.
  • When AI is running low or paused, the panel says so in one line: "Running low", "Ask AI paused until 1 November", "Confirm your email to use AI" or "Service paused" (with a link to the status page). It never shows numbers. Every other ITSpecta tool keeps working, signed in or not.
  • Off until you switch it on. Switched off, every Ask AI button disappears.
  • Where you can ask: tick the tools that show the button.

Why

A second pair of eyes on a wall of log lines is useful, but only if it can't do anything you didn't ask and doesn't see what it shouldn't.

Technical detail
  • The AI has no tools. It can't run commands, change settings or look anything up.
  • Before anything is sent, IP addresses, host names, user names and emails are replaced with placeholders; the answer is mapped back on this device, so NeuroDynamic never sees them.
  • See exactly what is sent shows the data before you ask.
  • It runs only on NeuroDynamic's AI service, with your account. There's no option to use another provider or your own model.
  • AI isn't part of ITSpecta's licence: it uses your NeuroDynamic plan or the free allowance, and needs a confirmed email.
  • Conversations aren't saved in ITSpecta. Nothing stored: questions and data are never saved to our records or logs, and never used to train AI.

Shortcuts

Shared with LexVoca and ClaraVoca

One set of keys for all three NeuroDynamic apps: hold Alt and press one key.

What it does

  • Alt+A grabs an area of the screen, and Alt+Shift+A grabs the active window. These are ITSpecta's.
  • Alt+Q opens the family menu: actions from ITSpecta, LexVoca and ClaraVoca that have no key of their own, each with a letter. ITSpecta adds Open ITSpecta (K), Watch a host (W) and a note in the incident notebook (N).
  • The other keys belong to your other apps: Z talk and X change text (LexVoca), C check text (ClaraVoca). Add Shift for the bigger version of each.
  • Inside ITSpecta: Ctrl+K search, Ctrl+, settings, F1 help, Esc close, Alt+1-9 sidebar pages.
  • Settings > Shortcuts shows each key's status (working, or in use by another program), lets you change it, and lists the keys of your other NeuroDynamic apps.

Why

Three apps with their own shortcuts meant fourteen keys and several clashes. Five keys in one corner of the keyboard, the same in every app, is less to remember and nothing fights.

Technical detail
  • Use the left Alt key. On many keyboards right Alt is AltGr and types characters.
  • ITSpecta never uses Ctrl+Alt combinations: they type characters such as € on UK keyboards.
  • Alt+A is ITSpecta's while it runs with the Document section on. Close ITSpecta, or switch Document off, and ClaraVoca takes Alt+A instead.
  • In a terminal pane, Ctrl+K goes to the shell (it clears to the end of the line), so open search with the search button there.
  • On first run of a new version, ITSpecta offers the new shortcuts once and keeps any keys you chose yourself unless you accept.
  • See every NeuroDynamic shortcut on one page.

Look

Theme, density and motion.

What it does

  • Theme: dark, light, or match Windows. Terminals and graphs stay dark in both, for reading long output.
  • Density: comfortable, or compact tables.
  • Reduce motion (also follows Windows), and 24-hour times.

Why

Built to be calm and easy to read, with text and controls that meet contrast standards in both themes, and colour never the only signal.

Snip and guide settings

What happens after each snip, and how guides are checked and exported.

What it does

  • After each snip: copy the image, read the text, show the review panel, suggest blurring internal addresses.
  • Box colour for clicks: red, as the knowledge style guide asks, or ITSpecta's coral.
  • Keep snips 90 days unless in a guide, or forever; optionally also save a PNG to a folder.
  • Guides: the style guide to check against, default knowledge base, "valid to" period and owner, whether personal data blocks knowledge-base export, accordion markup, and a shared team template folder.

Data, backup and moving

Where your work lives, and how to take it with you.

What it does

  • Data folder: everything ITSpecta keeps, beside the program. Open folder shows it, with the size of each part.
  • Back up content to a zip: bookmarks, cert watchlist, scripts, guides and templates (snips if you tick it).
  • Portable profile (Connections > Take your setup to another device): one encrypted file with connections, scripts, guides, workspaces and settings, and credentials only if you choose. Check what's inside before importing.
Technical detail
  • The profile's passphrase can't be recovered. A wrong passphrase is refused, and nothing changes.
  • Import keeps entries already on this device unless you choose to replace them.

Good to know

Features that need admin

ITSpecta runs as you. A few things need administrator rights, and they're labelled.

What it does

  • Look for the Needs admin label: packet capture, the DHCP server check, a true TCP trace, PowerShell as administrator, and fix-it scripts such as resetting the print spooler.
  • Click it and ITSpecta asks "This needs admin. Enable it now?", says what the action will and won't do, and warns about anything that matters (for example, that measuring a locked folder as admin shows every user's files in it). Not now is the default.
  • Say Enable admin for this, then yes to Windows' own prompt. Only that one action runs as administrator, and admin ends when it finishes.
  • Tick Don't ask again for this until ITSpecta closes if you're doing several in a row. It's never remembered after you close ITSpecta.
  • Other ways to run it... offers:
    • Restart ITSpecta as administrator: for a session of admin work. Open consoles come back.
    • Use a different admin account: Windows asks for your separate admin account's details.

Why

Running a whole toolkit as administrator all day is a risk. Elevating one action, only when you ask, keeps the rest safe.

Technical detail
  • Only a fixed list of actions can run elevated, and each one is written to the audit log.
  • No admin rights at all? Everything else still works. Help > About lists what this device allows.
  • On Linux, run ITSpecta with sudo for these actions.

Privacy and safety

What stays on the device, what leaves it, and how ITSpecta stays safe on your network.

What stays on this device

  • Everything you save: connections, snips, guides, logs, notebooks, scans, settings.
  • Text recognition and all the converters.
  • The interface: it's served only to this device, behind a key that changes every launch.

What leaves it, and only when you ask

  • The checks you run go to the targets you give: pings, traces, scans, DNS, TLS, HTTP, SSH and SNMP.
  • "Find my public IP" asks one outside service, when you click.
  • A Teams or Slack alert, if you add a webhook.
  • Your question and the data on screen, to NeuroDynamic's AI service, if you switch Ask AI on, sign in and ask. Addresses and names are hidden first, you see what's sent, and nothing is stored: questions and data are never saved to NeuroDynamic's records or logs, and never used to train AI.

Safe on your network

Scans and checks use ordinary connections at a gentle pace. ITSpecta never guesses passwords or SNMP communities, scripts show their targets before they run, and changes are audited. There's no telemetry and no automatic update.

Troubleshooting

Quick fixes for the most common problems.

The snip shortcut does nothing

Another program may own Alt+A. Settings > Shortcuts shows whether Alt+A is working or in use by another program, and lets you change it. If the Document section is off, the shortcut is released.

A monitor shows loss but everything works

Look for ○ ignored: that router limits replies to pings and isn't dropping your traffic. If loss is only at the last hop, try probing with TCP 443.

The scan finds fewer hosts than expected

Firewalls often block ping. Keep "Also hosts that ignore ping" ticked, add the ports those hosts use, or choose "All addresses" (slower).

A script can't connect to a server

Windows servers need WinRM enabled (port 5985 or 5986); Linux needs SSH. Check the credential in Connections, then use Test a port in Device network.

Remote Desktop asks whether to trust the file

Windows asks once for ITSpecta-made RDP files. Tick "Don't ask me again" and it won't ask next time.

The knowledge base didn't keep the accordions

Set Settings > Guides > Accordion markup to bold headings, then apply its accordion button to each task.

Ask AI says it can't answer

Check Settings > Ask AI: it shows whether you're signed in to NeuroDynamic, whether your email needs confirming, and whether AI is paused until your allowance resets. Test there shows the exact problem; if the service is paused, the status page at neurodynamic.tech/status says when it's back.

"Another copy is using this data folder"

Only one ITSpecta can use a data folder at a time. Close the other window, or run a copy from a different folder.