AI Troubleshooting for Industrial Networks User Guide

Workflows by role

Updated: August 31, 2026

Want to summarize with AI?

See how Admins and OT users use the same alert process with different capabilities for investigation, network context, actions, and handoff.

Admins and OT users use an alert-first process. Both roles can use Topology and Inventory to understand an alert. OT users can view network and inventory information, while only Admins can change topology or manage device and proxy records.

Topology provides network context for an affected device. In Topology, pan across the map, scan connected devices and paths, zoom in or out, and use available search or viewing controls to understand where the device sits in the network.

Inventory provides device and proxy records for troubleshooting. Select the Devices or Proxies tab, then search, filter, sort, or paginate the table to find a record.

Inventory is read-only for OT users: they cannot add, edit, or remove records, and passwords are not displayed. Ask an Admin to correct inventory information when needed.

OT user tasks

The OT user tasks support alert-first triage. Use them to understand what happened, review the evidence collected by the application, take the approved field action, and either resolve the alert or hand it off with useful context.

Admin tasks

Admin role required: The tasks in this section are available to users with the Admin role. Admins can use the shared alert-first process and the Admin tasks described here for broader troubleshooting and administration.

Note

Admin role required: The tasks in this section are available to users with the Admin role. Admins can use the shared alert-first process and the Admin tasks described here for broader troubleshooting and administration.

Admin process overview

Summary

Use the following process when you need to investigate an alert, continue an investigation, or maintain application data:

Workflow

These are the stages of admin process overview.

Start with the shared alert investigation process when an alert exists.
Use Ask a targeted question to start or continue an investigation that is not tied to an alert.
Use Investigate a device in Topology to review device paths and use supported device prompts.
Use Maintain Inventory and custom fields to correct records, discovery results, or identifying fields.
Use Manage application settings and users to review data sources, agent status, user access, and audit logs.

Ask targeted questions with prompt suggestions

The Threads features provides prompt suggestions to help you initiate an alert or device examination. The prompts also allow you to choose a wide range of identifier values from drop-down lists, improving accuracy and the time taken to create a full, specific query.

Supported prompt categories can include:


Prompt category	Example questions
Topology	Which devices are connected to this switch? Where is this endpoint located?
Switch operations	What version is this switch running? What is the interface status?
Endpoint operations	Is this endpoint reachable? What is the parent-link status?
Inventory	List all IE-3500 switches. What devices are in Zone 3?
Configuration	What VLANs are configured? What is the PoE budget?

The response you receive typically also displays the device and device parts that the query is related to. The selected device remains visible as context for the conversation. You can remove the device context when it no longer applies to the question.

Figure 1. AI response showing the selected device as context

Procedure

From the Cisco AI Troubleshooting for Industrial Networks menu, choose Threads.
Identify or create a thread to to work on.
- Use the search field to find a thread by its title or visible content, and select a thread to view its contents.
- Select New Thread to begin an investigation that is not tied to an existing alert. Start with the device name, location, and symptom.
Admins can use the chat composer to investigate an alert, or a device. As you type, an autocomplete menu ranks supported prompt templates.
1. Select a suggested query to open its complete sentence with highlighted slots.
2. To enter a value for a device, zone, device model, port, or IP address, click the highlighted slot and select values from the dropdown lists. Depending on the prompt, a custom inventory field or grouping value can provide the value used by your team.
Figure 2. Prompt autocomplete list with supported queries
(Optional) If the desired question does not match a supported prompt, rewrite it using the equipment name, zone, switch, port, and symptom so the application can identify the intended context.
After you choose values for all the required slots in the prompt, submit the prompt.

What to do next

Use the Rename thread option when a clearer name will help the next shift find the conversation.

Investigate a device in Topology

Use Topology as a searchable network map to move from a production symptom to the relevant switch, port, endpoint, location, or path. Search for the affected endpoint, switch, zone, or visible device name, then select the result to focus the map.

Note

When a network issue affects devices, the topology highlights the impacted devices.

Procedure

Use the search field to focus the map on a device and review its connected path.

Figure 3. Topology view showing connected devices and paths
Select Discuss this device to open the autocomplete prompt experience with the selected device supplied to a compatible device slot.
Use available display options to choose which inventory fields appear on device labels or to group devices by a site field such as zone or another custom field.
When the displayed layout needs to be arranged for the site, use Edit topology.

You select one or multiple devices and drag them into the desired positions.

Other controls available to you at this step include Undo, Redo, Display options, Clean up, Reset to default layout, and Cancel.

Note

Do not use the edit capability to represent a connection that has not been verified in the physical network, or in the discovery data.
After you finish editing the topology, click Save.

Maintain Inventory and custom fields

The Inventory pages help you to maintain the device records used by topology and troubleshooting.

The Devices tab supports inventory search, custom-field filters, pagination, and admin controls for adding or editing device records.
The Proxies tab lists the proxy records used to access devices.

Before you begin

Sign in as an Admin. OT users can view Inventory, but only Admins can add, edit, or remove records, manage custom fields, and run discovery.

Procedure

From the Cisco AI Troubleshooting for Industrial Networks menu, choose Inventory.
To add a custom field to the Inventory table, click Custom field.
1. Enter a clear field name such as Zone, Manufacturer, or Device role.
2. Then, save the field.
3. For the devices in the list, enter the values for the newly created custom field.
To add one or more devices to the inventory or to refresh the topology pages to align with any network changes, choose Add Devices.
- Add a known device when that option is available.
- Click Run discovery again to run an LLDP search from a switch.
- Upload a .csv file of the devices you want to add.
1. Review the proposed changes and apply the changes only when they match the expected site state.

Manage application settings and users

Only admins can access the Settings menu to review application input sources, the agent status, and user accesses. Follow site change-control procedures before changing any configuration.

Data sources

Review the information that is entering the application in the Data sources area.


Area	What to review
Network discovery	Discovery status, seed device, discovery protocol, and last scan time.
Syslogs and alerting	Whether syslogs are being received, event counts, generated alerts, and monitored event types.
Discovery controls	Reconfigure and other controls used to change discovery settings.
Syslog controls	Enable automatic log collection and analysis and Save syslog settings,

Select Reconfigure or save syslog settings only when the change is authorized. If expected events are not received, confirm the switch or syslog server is forwarding them to the configured destination.

Agent

Review agent status, cloud tether key status, key rotation controls, and agent software version information in the Agent area. The page also provides information on the last update check, allows you to check for a new software update, and can provide an offline package upload control.

Audit logs

Review recorded user and application events using Audit Logs.


Control or column	Use it to
User Access Logs	Review sign-in and access activity.
Application Logs	Review recorded application events.
Refresh	Load the latest available events.
Time, Event, User, Resource, Outcome, Message	Understand what happened and whether an event succeeded.

Manage users

Use this task to add, edit, or remove application users.

Before you begin

Procedure

From the Cisco AI Troubleshooting for Industrial Networks menu, choose Settings > Users
Select Add to create a user, or select an existing user to edit the account.
Enter or review Username and Display Name.
Select Admin or OT User in Assigned Role.
Review Status and Last Accessed, then select Save. Select Cancel to discard unsaved changes.
Select Delete only when the site access-control process permits removal.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.