Critical Firewall rule widened to 0.0.0.0/0
rule 20006 · site Westvale Council · by ops@msp · at 14:32:07
Built for MSPs on UniFi
Configuration control for MSPs running UniFi networks.
We catch every change, alert you in real time, and let you restore any previous state — nothing silent, nothing permanent, audit-ready by default.
Design partner programme — Australian MSPs, priority onboarding.
How it works
Three steps to never miss a change.
Cloud-direct for self-hosted controllers. Lightweight agent for Dream Machines behind NAT — installs in under a minute. RunState plugs into the UniFi you already run.
01 — Connect
Link your controller in under a minute
Cloud-direct for self-hosted controllers. Lightweight agent for Dream Machines behind NAT. Your credentials are AES-256 encrypted at rest and never leave your environment.
02 — Detect
Every change, picked up in real time
RunState polls your UniFi controller on a configurable schedule and produces plain-English diffs — rule by rule, SSID by SSID, network by network. Severity-routed delivery to Slack today, with email and Teams support in 2026 H2. Noise filtered by default.
03 — Restore
Roll back in two clicks
Any previous state, any object, any site. Preview before you commit. Auto-snapshot before every restore. Full audit trail by timestamp and hash — ready for your next compliance request.
Config Alert
The change you missed — caught before it matters.
RunState watches your UniFi controllers around the clock and translates raw config diffs into alerts your team will actually read. Severity-routed. Audit-stamped. Restorable in two clicks.
- Real-time detection across firewall rules, wireless networks, VLANs, port profiles, and routing
- Human-readable diffs: exact field name, previous value, new value, timestamp
- Severity model: Critical / Warning / Info — only the signals worth acting on
- Delivery to Slack today, with email, Teams, and PagerDuty in 2026 H2 — per site, per severity threshold
- Change history searchable by object name, site, and time window
Live alerts
Every change, in plain English.
RunState turns raw UniFi configuration diffs into alerts your team will actually read. Severity-routed. Audit-stamped. Restorable in two clicks.
Warning SSID password rotated
wlan Office-5G · site Greenvale Clinic · by mark@msp · at 09:14:22
Restored Firewall rule reverted
rule 20006 · site Westvale Council · by alex@msp · at 14:34:11
Config Recover
Every previous state, one restore away.
Complete configuration snapshots at every change and on a schedule. Restore any object, any endpoint, or an entire site — with a preview before you commit and an auto-snapshot before you apply.
- Full snapshot history: event-triggered on every change, scheduled daily baseline
- Granular restore: full configuration section today, with single-object and complete-site restore in 2026 H2
- Preview before restore — see exactly what will change before it happens
- Auto-snapshot before every restore — you can always undo the undo
- SHA-256 integrity hash on every snapshot — tamper-evident by design
- Cross-controller restore for multi-site incidents — 2026 H2
Compliance
Built for the frameworks your clients answer to.
RunState captures tamper-evident change history aligned to the compliance frameworks Australian MSPs increasingly need to evidence. Every snapshot is immutable. Every change carries a SHA-256 hash. Every action is tied to a timestamp.
Available today
- Immutable per-change snapshot history
- SHA-256 integrity hash on every snapshot
- Site-level audit history accessible via dashboard
- Retention period stored per client site
Coming 2026 H2
- Evidence pack export — downloadable archive of change history for a date range
- Per-site retention period UI — adjustable through dashboard
- Cross-controller restore for multi-site incidents
Frameworks RunState is designed to support
Essential Eight Maturity Level 3
Aligned to the ACSC Essential Eight maturity model. Supports application control evidence and system monitoring artefacts through tamper-evident change history.
APRA CPS 234
Information security incident records and configuration change history for APRA-regulated entities — designed for the audit needs of financial services clients.
SOCI Act
Critical infrastructure change management audit trail aligned to the Security of Critical Infrastructure Act 2018.
ISO 27001
Operational security control records aligned to ISO/IEC 27001:2022. Supports change management and configuration baseline requirements.
PCI-DSS v4.0
Change-detection mechanism (Requirement 11.5.1) and Network Security Control configuration history (Requirement 1.2) for retail merchants and the MSPs that support them. Aligned to PCI-DSS v4.0. RunState supports the merchant compliance program; it is not a substitute for it.
Data residency
All data stored in Microsoft Azure Australia East. Suitable for Australian government, healthcare, and financial services clients.
Pricing
Per controller. No surprises.
RunState is priced per UniFi controller — the unit your team already manages. Buy Config Alert, Config Recover, or both.
Config Alert
$[PRICE] AUD / controller / month
Real-time change detection and alerting. Every change caught, every alert readable, every site audit-stamped.
- Real-time detection across all config endpoints
- Slack today; email, Teams, PagerDuty in 2026 H2
- Plain-English semantic diffs
- Compliance evidence (Essential Eight, APRA, SOCI, ISO 27001, PCI-DSS)
- Change history retention (default 90 days, configurable)
Config Recover
$[PRICE] AUD / controller / month
Versioned config history and restore. Any previous state, two clicks away.
- Full snapshot at every change + daily scheduled baseline
- Endpoint restore today; object + full-site in 2026 H2
- Preview before apply, auto-snapshot before restore
- Immutable blob storage (Azure Australia East)
- Retention period (default 90 days, configurable)
Best value
RunState Bundle
$[PRICE] AUD / controller / month
The complete platform. Detection, alerting, versioned history, and restore in one.
- Everything in Config Alert
- Everything in Config Recover
- Unified audit trail across alert and restore events
Billed monthly. No lock-in. Volume pricing for MSPs managing 20+ controllers — contact us.
"We had a junior tech accidentally widen a firewall rule on a council site last Tuesday. RunState pinged the Slack channel within 60 seconds with the exact diff, the restore was two clicks, and the audit trail was ready when the client's compliance officer asked the next morning. That's what we pay for."
MSP Head of Service Delivery · Melbourne
Ready to see it on your network?
Request access during our design partner programme. Australian MSPs running UniFi — priority onboarding, direct line to the product team.
Request access