Darktrace is an Intrusion Detection Device (IDS) that leverages machine learning to detect emerging threats, including insider threats, low-and-slow attacks, and automated viruses.

Step 1: Enable console access

Expel requires a Darktrace user account to review Alerts and Models within the console.

Note

Expel secures all login information our SOC analysts need about your devices in a MFA password product. Access to this login information is protected using our internal MFA processes. To learn more about the IP addresses all Expel traffic comes from, go here.

  1. From the menu located at the top left, select Add New User.

  2. Username: Expel.

  3. Password: set a temporary password — this is changed on initial login.

  4. Account Permissions: select all available permissions, except User Admin or Group Admin. These can be left cleared.

Step 2: Generate API credentials

Note

Expel secures all login information our SOC analysts need about your devices in a MFA password product. Access to this login information is protected using our internal MFA processes. To learn more about the IP addresses all Expel traffic comes from, go here.

  1. Log into the Darktrace console.

  2. Navigate to Admin > System Config.

  3. Near the bottom of the page, under API Token, click New.

  4. The Darktrace system generates a Token and a Private Token. The Private Token can only be seen 1 time after the token pair is initially generated. Make note of the tokens for onboarding in Workbench. The system can only have 1 token pair, so if one already exists and you don't have a record of this, you must generate another token pair.

Caution

If a replacement Token pair is generated, other clients using the API must be reconfigured with the new credentials.

Step 3: Configure the technology in Workbench

  1. In a new browser tab, login to https://workbench.expel.io.

  2. On the console page, click Settings and click Security Devices.

  3. At the top of the page, click Add Security Device.

  4. Search for and select your technology.

    Screen Shot 2021-03-05 at 10.31.45 AM.png
  5. Select an Assembler from the list. Select the assembler you set up in Getting connected to Expel Workbench.

    Screen Shot 2021-07-16 at 5.29.17 PM.png
    • Type Name and Location.

    • For Server address, type the server address of the vendor’s server, which must include the port. For example: https://127.0.0.1:443 or myvendordevice.acme.com:443.

    • For Public key, type the API token used to authenticate to the device from Step 2.

    • For Private key, type the private token used to authenticate to the device from Step 2.

  6. You can provide console access now or set it up later. Use the instructions below to set it up later.

Tip

This article was accurate at the time of writing, but changes happen. If you find the instructions are outdated, leave a description in the comment field below and let us know!