Commands Reference
Slash commands provide structured prompts for common MSP tasks.
There are 183 commands across all plugins.
What are Commands?
Commands are slash commands that provide structured templates for common tasks.
They guide Claude to ask the right questions and use the correct API operations.
/create-ticket "Email sync issue for John at Acme Corp"
Claude will extract the relevant information and prompt for any missing details
like priority, category, or assigned technician.
Commands by Category
Ticket Commands
Commands for creating and searching service tickets.
| Command | Plugin | Description |
/create-ticket | Atera | Create a new service ticket in Atera |
/update-ticket | Atera | Update fields on an existing Atera ticket |
/create-ticket | Autotask PSA | Create a new service ticket in Autotask PSA |
/my-tickets | Autotask PSA | List tickets currently assigned to you with optional filtering |
/reassign-ticket | Autotask PSA | Reassign a ticket to a different resource or queue |
/search-tickets | Autotask PSA | Search for tickets in Autotask PSA by various criteria |
/update-ticket | Autotask PSA | Update fields on an existing Autotask ticket (status, priority, queue, due date) |
/close-ticket | ConnectWise PSA | Close a ConnectWise PSA ticket with resolution notes |
/create-ticket | ConnectWise PSA | Create a new service ticket in ConnectWise PSA |
/get-ticket | ConnectWise PSA | Retrieve detailed ticket information from ConnectWise PSA |
/search-tickets | ConnectWise PSA | Search for tickets in ConnectWise PSA by various criteria |
/update-ticket | ConnectWise PSA | Update fields on an existing ConnectWise PSA ticket |
/create-ticket | HaloPSA | Create a new service ticket in HaloPSA |
/search-tickets | HaloPSA | Search for tickets in HaloPSA by various criteria |
/show-ticket | HaloPSA | Display comprehensive ticket information including history, actions, and related entities |
/update-ticket | HaloPSA | Update fields on an existing HaloPSA ticket including status, priority, and assignment |
/create-ticket | NinjaOne (NinjaRMM) | Create a new ticket in NinjaOne |
/add-ticket-note | SuperOps.ai | Add a note (internal or public) to an existing SuperOps.ai ticket |
/create-ticket | SuperOps.ai | Create a new service ticket in SuperOps.ai |
/update-ticket | SuperOps.ai | Update fields on an existing SuperOps.ai ticket |
/add-ticket-comment | Syncro MSP | Add a comment to an existing Syncro ticket |
/create-ticket | Syncro MSP | Create a new service ticket in Syncro MSP |
/search-tickets | Syncro MSP | Search for tickets in Syncro MSP by various criteria |
/update-ticket | Syncro MSP | Update fields on an existing Syncro ticket |
Asset & Device Commands
Commands for looking up assets, devices, and running automation.
| Command | Plugin | Description |
/search-agents | Atera | Search for RMM agents in Atera by customer or machine name |
/lookup-asset | Autotask PSA | Search for Autotask configuration items/assets by name, serial number, or company |
/lookup-company | Autotask PSA | Search for Autotask companies by name, ID, or other attributes |
/lookup-contact | Autotask PSA | Search for Autotask contacts by name, email, phone, or company |
/agent-inventory | Blumira | List all devices and agents across the organization with status and health information |
/list-computers | ConnectWise Automate | List computers in ConnectWise Automate with optional filters |
/lookup-config | ConnectWise PSA | Search for configuration items (assets) in ConnectWise PSA |
/device-lookup | Datto RMM | Find a device in Datto RMM by hostname, IP address, or MAC address |
/site-devices | Datto RMM | List all devices at a site in Datto RMM |
/device-inventory | Domotz | List all devices at a Domotz-monitored site |
/device-lookup | Domotz | Find a Domotz device by name, IP address, or MAC address |
/site-overview | Domotz | Overview of a Domotz site's network health |
/search-assets | HaloPSA | Search for configuration items/assets by name, serial number, type, or client |
/lookup-asset | Hudu | Find an asset in Hudu by name, hostname, serial number, or IP address |
/agent-inventory | Huntress | List and filter Huntress agents across organizations |
/lookup-asset | IT Glue | Find a configuration item (asset) in IT Glue by name, hostname, serial number, or IP address |
/device-info | NinjaOne (NinjaRMM) | Get detailed information about a NinjaOne device |
/search-devices | NinjaOne (NinjaRMM) | Search for devices across NinjaOne organizations |
/asset-search | Runzero | Search for assets in RunZero by criteria |
/site-overview | Runzero | Overview of a RunZero site's assets, services, and health |
/asset-inventory | SentinelOne | Asset inventory summary by surface type across managed environments |
/get-asset | SuperOps.ai | Get detailed asset information including hardware, software, and alerts |
/list-assets | SuperOps.ai | List and filter assets in SuperOps.ai |
/search-assets | Syncro MSP | Search for customer assets in Syncro |
Automation Commands
Commands for running scripts, jobs, and automation tasks.
| Command | Plugin | Description |
/run-powershell | Atera | Execute a PowerShell script on an Atera agent |
/run-script | ConnectWise Automate | Execute a script on an endpoint in ConnectWise Automate |
/run-job | Datto RMM | Run a quick job on a device in Datto RMM |
/subscription-status | Pax8 | Check subscription status for a company in Pax8 |
/subscription-status | Sherweb | Check subscription details and quantities for a Sherweb customer |
/run-script | SuperOps.ai | Execute a script on a remote asset via SuperOps RMM |
Alert Commands
Commands for managing and resolving alerts.
| Command | Plugin | Description |
/list-alerts | Atera | List active RMM alerts from Atera |
/resolve-alert | Atera | Resolve an RMM alert in Atera |
/resolve-finding | Blumira | Resolve a Blumira finding with the appropriate resolution type and notes |
/resolve-alert | Datto RMM | Resolve an open alert in Datto RMM |
/alert-status | Domotz | Check current Domotz alerts across all agents |
/resolve-escalation | Huntress | Review and resolve a Huntress escalation |
/list-alerts | NinjaOne (NinjaRMM) | List active alerts across NinjaOne devices |
/alert-triage | SentinelOne | Triage new and unresolved SentinelOne alerts by severity |
/investigate-alert | SentinelOne | Deep investigation of a specific SentinelOne alert with timeline and context |
/acknowledge-alert | SuperOps.ai | Acknowledge an RMM alert to indicate investigation is underway |
/list-alerts | SuperOps.ai | List active RMM alerts across all clients or filtered by criteria |
/resolve-alert | SuperOps.ai | Resolve an RMM alert and optionally create a ticket |
/list-alerts | Syncro MSP | List active RMM alerts from Syncro |
/resolve-alert | Syncro MSP | Resolve an RMM alert in Syncro |
Documentation Commands
Commands for searching docs, passwords, and organizations.
| Command | Plugin | Description |
/finding-triage | Blumira | Triage open Blumira findings by severity, presenting a prioritized list for review |
/investigate-finding | Blumira | Deep investigation of a specific Blumira finding with details, context, and comment history |
/resolve-finding | Blumira | Resolve a Blumira finding with the appropriate resolution type and notes |
/find-company | Hudu | Find a company in Hudu by name |
/get-password | Hudu | Retrieve a password from Hudu (with security logging) |
/edit-doc-sections | IT Glue | Read, edit, and restructure sections of an IT Glue document |
/find-organization | IT Glue | Find an organization in IT Glue by name |
/get-password | IT Glue | Retrieve a password from IT Glue (with security logging) |
/search-docs | IT Glue | Search IT Glue documentation by keyword or phrase |
/create-document | PandaDoc | Create a new PandaDoc document from a template with recipients and content |
/document-status | PandaDoc | Check the status of a PandaDoc document and its recipients |
/send-document | PandaDoc | Send a PandaDoc document for e-signature |
Other Commands
Time entries, projects, accounts, and other operations.
| Command | Plugin | Description |
/account-audit | Abnormal Security | Audit for account takeover indicators and suspicious sign-ins in Abnormal Security |
/log-time | Atera | Log work hours on an Atera ticket |
/update-ticket | Atera | Update fields on an existing Atera ticket |
/time-entry | Autotask PSA | Log time against tickets or projects in Autotask PSA |
/update-ticket | Autotask PSA | Update fields on an existing Autotask ticket (status, priority, queue, due date) |
/status-page-update | BetterStack | Update a Better Stack status page with current status or maintenance |
/log-time | ConnectWise PSA | Log a time entry against a ConnectWise PSA ticket |
/update-ticket | ConnectWise PSA | Update fields on an existing ConnectWise PSA ticket |
/update-ticket | HaloPSA | Update fields on an existing HaloPSA ticket including status, priority, and assignment |
/account-summary | RocketCyber | Get a security posture summary for a RocketCyber customer account |
/update-opportunity | SalesBuildr | Update an opportunity's status, value, or other details |
/log-time | SuperOps.ai | Log a time entry against a SuperOps.ai ticket |
/update-ticket | SuperOps.ai | Update fields on an existing SuperOps.ai ticket |
/log-time | Syncro MSP | Log a time entry against a Syncro ticket |
/update-ticket | Syncro MSP | Update fields on an existing Syncro ticket |
All Commands by Plugin
| Command | Description |
/account-audit | Audit for account takeover indicators and suspicious sign-ins in Abnormal Security |
/case-review | Review and triage abuse mailbox cases in Abnormal Security |
/search-threats | Search for specific threat patterns in Abnormal Security by sender, recipient, attack type, or keywords |
/threat-triage | Triage recent email threats detected by Abnormal Security by severity and attack type |
/vendor-risk | Check vendor risk scores and compromised vendor activity in Abnormal Security VendorBase |
| Command | Description |
/create-monitor | Create a threshold-based monitor for an Atera agent |
/create-ticket | Create a new service ticket in Atera |
/get-kb-articles | Search the Atera knowledge base for articles |
/list-alerts | List active RMM alerts from Atera |
/log-time | Log work hours on an Atera ticket |
/resolve-alert | Resolve an RMM alert in Atera |
/run-powershell | Execute a PowerShell script on an Atera agent |
/search-agents | Search for RMM agents in Atera by customer or machine name |
/search-customers | Search for Atera customers by name or criteria |
/update-ticket | Update fields on an existing Atera ticket |
| Command | Description |
/add-note | Add a note or comment to an existing Autotask ticket |
/check-contract | View contract status, entitlements, and remaining hours for a company or specific contract |
/check-pricing | Check pricing details for an Autotask product or service from price lists |
/create-quote | Create a new Autotask quote with line items for products, services, and service bundles |
/create-ticket | Create a new service ticket in Autotask PSA |
/expenses | Use this skill when working with Autotask expense reports - creating reports, adding expense items, searching by status or submitter, and tracking reimbursable and billable expenses |
/lookup-asset | Search for Autotask configuration items/assets by name, serial number, or company |
/lookup-company | Search for Autotask companies by name, ID, or other attributes |
/lookup-contact | Search for Autotask contacts by name, email, phone, or company |
/my-tickets | List tickets currently assigned to you with optional filtering |
/reassign-ticket | Reassign a ticket to a different resource or queue |
/search-products | Search the Autotask product catalog for products, services, or inventory items |
/search-tickets | Search for tickets in Autotask PSA by various criteria |
/time-entry | Log time against tickets or projects in Autotask PSA |
/update-ticket | Update fields on an existing Autotask ticket (status, priority, queue, due date) |
| Command | Description |
/create-monitor | Create a new Better Stack uptime monitor |
/incident-triage | Triage current Better Stack incidents |
/monitor-status | Check all Better Stack monitor statuses and identify downtime |
/search-logs | Search logs via Better Stack Logtail |
/status-page-update | Update a Better Stack status page with current status or maintenance |
| Command | Description |
/agent-inventory | List all devices and agents across the organization with status and health information |
/finding-triage | Triage open Blumira findings by severity, presenting a prioritized list for review |
/investigate-finding | Deep investigation of a specific Blumira finding with details, context, and comment history |
/msp-overview | MSP dashboard showing all managed accounts with open finding counts and severity breakdown |
/resolve-finding | Resolve a Blumira finding with the appropriate resolution type and notes |
/security-posture | Overall security posture review including open findings by severity, agent coverage, and trends |
| Command | Description |
/check-threat | Get detailed threat analysis including IOCs and timeline from Checkpoint Harmony Email |
/manage-policy | View or toggle email security policies in Checkpoint Harmony Email |
/release-quarantine | Release quarantined email(s) back to recipients in Checkpoint Harmony Email |
/search-quarantine | Search quarantined emails in Checkpoint Harmony Email by various criteria |
/search-threats | Search detected threats in Checkpoint Harmony Email by type, severity, and date range |
| Command | Description |
/list-computers | List computers in ConnectWise Automate with optional filters |
/run-script | Execute a script on an endpoint in ConnectWise Automate |
| Command | Description |
/add-note | Add an internal or external note to a ConnectWise PSA ticket |
/check-agreement | View agreement status and entitlements for a company in ConnectWise PSA |
/close-ticket | Close a ConnectWise PSA ticket with resolution notes |
/create-ticket | Create a new service ticket in ConnectWise PSA |
/get-ticket | Retrieve detailed ticket information from ConnectWise PSA |
/log-time | Log a time entry against a ConnectWise PSA ticket |
/lookup-config | Search for configuration items (assets) in ConnectWise PSA |
/schedule-entry | Create a schedule entry/appointment in ConnectWise PSA |
/search-tickets | Search for tickets in ConnectWise PSA by various criteria |
/update-ticket | Update fields on an existing ConnectWise PSA ticket |
| Command | Description |
/device-lookup | Find a device in Datto RMM by hostname, IP address, or MAC address |
/resolve-alert | Resolve an open alert in Datto RMM |
/run-job | Run a quick job on a device in Datto RMM |
/site-devices | List all devices at a site in Datto RMM |
| Command | Description |
/alert-status | Check current Domotz alerts across all agents |
/device-inventory | List all devices at a Domotz-monitored site |
/device-lookup | Find a Domotz device by name, IP address, or MAC address |
/network-scan | Scan a network for devices via a Domotz agent |
/site-overview | Overview of a Domotz site's network health |
| Command | Description |
/add-action | Add an action (note, update, or response) to an existing HaloPSA ticket |
/contract-status | Check contract status, service entitlements, and billing information for a client |
/create-ticket | Create a new service ticket in HaloPSA |
/kb-search | Search the HaloPSA knowledge base for articles and solutions |
/search-assets | Search for configuration items/assets by name, serial number, type, or client |
/search-clients | Search for HaloPSA clients by name, domain, or other attributes |
/search-tickets | Search for tickets in HaloPSA by various criteria |
/show-ticket | Display comprehensive ticket information including history, actions, and related entities |
/sla-dashboard | View SLA status across tickets, including approaching breaches and at-risk tickets |
/update-ticket | Update fields on an existing HaloPSA ticket including status, priority, and assignment |
| Command | Description |
/find-company | Find a company in Hudu by name |
/get-password | Retrieve a password from Hudu (with security logging) |
/lookup-asset | Find an asset in Hudu by name, hostname, serial number, or IP address |
/search-articles | Search Hudu knowledge base articles by keyword or phrase |
| Command | Description |
/agent-inventory | List and filter Huntress agents across organizations |
/billing-report | Generate a Huntress billing summary for a period |
/incident-triage | Triage open Huntress incidents by severity |
/investigate-incident | Deep dive investigation into a specific Huntress incident with remediations |
/org-health | Organization health check covering agents, incidents, and escalations |
/resolve-escalation | Review and resolve a Huntress escalation |
| Command | Description |
/edit-doc-sections | Read, edit, and restructure sections of an IT Glue document |
/find-organization | Find an organization in IT Glue by name |
/get-password | Retrieve a password from IT Glue (with security logging) |
/lookup-asset | Find a configuration item (asset) in IT Glue by name, hostname, serial number, or IP address |
/search-docs | Search IT Glue documentation by keyword or phrase |
| Command | Description |
/campaign-summary | Get summary of recent phishing and training campaigns from KnowBe4 |
/group-report | Get security awareness metrics for a KnowBe4 group |
/phishing-results | View phishing campaign results and click rates from KnowBe4 |
/training-status | Check training completion status for users or groups in KnowBe4 |
/user-risk | Get risk score and risk history for a KnowBe4 user |
| Command | Description |
/liongard-environment-summary | Generate a detailed summary of a Liongard environment |
/liongard-health-check | Check Liongard connectivity and return system health summary |
| Command | Description |
/check-mfa-status | Audit MFA enrollment across all M365 users, highlighting accounts with no MFA |
/get-user | Look up a Microsoft 365 user by name or email, showing account status, licenses, MFA, and last sign-in |
/list-licenses | Show Microsoft 365 license inventory - available SKUs, consumed seats, and optimization opportunities |
/offboard-user | Run the complete M365 offboarding workflow for a departing user - revoke access, handle mailbox, transfer data |
| Command | Description |
/create-ticket | Create a new ticket in NinjaOne |
/device-info | Get detailed information about a NinjaOne device |
/list-alerts | List active alerts across NinjaOne devices |
/search-devices | Search for devices across NinjaOne organizations |
| Command | Description |
/create-incident | Create a new PagerDuty incident on a service |
/escalate-incident | Escalate a PagerDuty incident to the next level in the escalation policy |
/incident-triage | Triage current open PagerDuty incidents by urgency and priority |
/oncall-schedule | Show who is currently on call across schedules and escalation policies |
/service-health | Check PagerDuty service health status and recent incident activity |
| Command | Description |
/create-document | Create a new PandaDoc document from a template with recipients and content |
/document-status | Check the status of a PandaDoc document and its recipients |
/list-templates | List all available PandaDoc templates with details |
/proposal-pipeline | Summarize the PandaDoc proposal pipeline by status, value, and age |
/send-document | Send a PandaDoc document for e-signature |
| Command | Description |
/create-order | Place an order for a product subscription in Pax8 |
/license-summary | Aggregate license counts and costs across all Pax8 client companies |
/search-products | Search the Pax8 product catalog by name or vendor |
/subscription-status | Check subscription status for a company in Pax8 |
| Command | Description |
/check-threats | View recent TAP threat events including blocked messages, delivered threats, and click activity |
/decode-url | Decode a Proofpoint URL Defense rewritten URL back to the original URL |
/investigate-threat | Deep-dive threat investigation with forensics, campaign context, and remediation options |
/release-quarantine | Release one or more quarantined messages to their intended recipients |
/search-quarantine | Search quarantined messages in Proofpoint by sender, recipient, subject, or reason |
/vap-report | Get the Very Attacked People (VAP) report showing the most targeted users |
| Command | Description |
/create-invoice | Create an invoice for a client's managed services in QuickBooks Online |
/expense-summary | Summarize expenses by client, vendor, or date range in QuickBooks Online |
/get-balance | View outstanding balances across all MSP clients in QuickBooks Online |
/search-customers | Find a customer in QuickBooks Online by name or other criteria |
| Command | Description |
/account-summary | Get a security posture summary for a RocketCyber customer account |
/search-incidents | Search RocketCyber security incidents by account, status, severity, verdict, and date range |
| Command | Description |
/action-items | List outstanding action items from Rootly postmortems and incidents |
/create-incident | Create a new incident in Rootly with title, severity, and affected services |
/incident-triage | Triage active Rootly incidents by severity and status |
/postmortem-summary | Generate a postmortem summary for a resolved Rootly incident |
/service-status | Check service health and dependency status across the Rootly service catalog |
| Command | Description |
/asset-search | Search for assets in RunZero by criteria |
/scan-network | Initiate a network discovery scan in RunZero |
/service-inventory | List discovered services across RunZero assets |
/site-overview | Overview of a RunZero site's assets, services, and health |
/vuln-report | Generate a vulnerability summary report from RunZero data |
| Command | Description |
/create-contact | Create a new contact in Salesbuildr |
/create-opportunity | Create a new opportunity in Salesbuildr |
/create-quote | Create a new quote with line items in Salesbuildr |
/get-quote | Get detailed information for a specific Salesbuildr quote |
/search-companies | Search for companies in Salesbuildr |
/search-contacts | Search for contacts in Salesbuildr, optionally filtered by company |
/search-opportunities | Search for opportunities in the Salesbuildr sales pipeline |
/search-products | Search the Salesbuildr product catalog |
/search-quotes | Search for quotes in Salesbuildr |
/update-opportunity | Update an opportunity's status, value, or other details |
| Command | Description |
/alert-triage | Triage new and unresolved SentinelOne alerts by severity |
/asset-inventory | Asset inventory summary by surface type across managed environments |
/hunt-threat | Threat hunting via Purple AI and PowerQuery execution |
/investigate-alert | Deep investigation of a specific SentinelOne alert with timeline and context |
/posture-review | Cloud security posture review with compliance gap analysis |
/vuln-report | Generate a vulnerability summary report with severity breakdown and top CVEs |
| Command | Description |
/billing-summary | View payable charges for a Sherweb billing period with pricing breakdown |
/change-quantity | Change subscription seat/license quantity for a Sherweb customer |
/list-customers | List all customers under the Sherweb service provider account |
/subscription-status | Check subscription details and quantities for a Sherweb customer |
| Command | Description |
/acknowledge-alert | Acknowledge an RMM alert to indicate investigation is underway |
/add-ticket-note | Add a note (internal or public) to an existing SuperOps.ai ticket |
/create-ticket | Create a new service ticket in SuperOps.ai |
/get-asset | Get detailed asset information including hardware, software, and alerts |
/list-alerts | List active RMM alerts across all clients or filtered by criteria |
/list-assets | List and filter assets in SuperOps.ai |
/log-time | Log a time entry against a SuperOps.ai ticket |
/resolve-alert | Resolve an RMM alert and optionally create a ticket |
/run-script | Execute a script on a remote asset via SuperOps RMM |
/update-ticket | Update fields on an existing SuperOps.ai ticket |
| Command | Description |
/add-ticket-comment | Add a comment to an existing Syncro ticket |
/create-appointment | Create a calendar appointment in Syncro |
/create-ticket | Create a new service ticket in Syncro MSP |
/get-customer | Get detailed customer information from Syncro |
/list-alerts | List active RMM alerts from Syncro |
/log-time | Log a time entry against a Syncro ticket |
/resolve-alert | Resolve an RMM alert in Syncro |
/search-assets | Search for customer assets in Syncro |
/search-tickets | Search for tickets in Syncro MSP by various criteria |
/update-ticket | Update fields on an existing Syncro ticket |
Command Examples
Creating Tickets
# Simple ticket creation
/create-ticket "Printer not working for Jane at Contoso"
# With more context
/create-ticket "VPN connectivity issues for remote workers at Acme Corp.
Multiple users reporting disconnections during video calls.
Started after the network upgrade yesterday."
Searching Tickets
# Search by keyword
/search-tickets "email sync"
# Search with filters
/search-tickets "open tickets for Acme Corp this week"
# Search by status
/search-tickets "high priority unassigned tickets"
Device Operations
# Look up a device
/device-lookup "ACME-DC01"
/lookup-asset "192.168.1.100"
# List devices at a site
/site-devices "Acme Corporation"
# Run automation
/run-job "ACME-DC01" "Clear Temp Files"
/run-script "CONTOSO-WS01" "Disk Cleanup" --params "days=30"
Documentation Operations
# Search documentation
/search-docs "backup procedure" --organization "Acme Corp"
# Find an organization
/find-organization "Acme"
# Get a password (IT Glue)
/get-password "Domain Admin" --organization "Acme Corp"
Tips for Effective Commands
Provide Context
The more context you provide, the better Claude can help:
# Less effective
/create-ticket "printer issue"
# More effective
/create-ticket "HP LaserJet 4000 at front desk not printing.
Customer: Acme Corp
Contact: Jane Smith
Error: Paper jam light flashing but no jam visible"
Use Natural Language
Commands understand natural language, so you can describe what you need:
/search-tickets "show me all tickets from last week that are still open
and haven't been touched in 24 hours"
Chain Operations
You can describe multi-step workflows and Claude will execute them:
Search for the server ACME-DC01 in IT Glue, then check its alerts in Datto RMM,
and create a ticket in Autotask if there are any critical alerts.