1. Expel Help Center
  2. Getting Started with Expel
  3. Detections

Suspicious Countries

A suspicious country is a country that your organization never expects to record logins or activity from. These countries are listed in Workbench and can be edited by you at any time.

If there is an incoming event with activity originating from a country included on this list, we will use our detections to automatically raise an Expel Alert in Workbench for analyst review. 

Default Countries

The following countries (indicated in Workbench by their two-letter ISO 3166 codes) are automatically included in your list of suspicious countries:

  • Nigeria
  • Kenya
  • Tanzania
  • Pakistan
  • North Korea

For most Expel customers, there are no employees or contractors geolocated in (or working out of) these countries and any business presence is limited. Therefore, any authentication from these countries is always treated as suspicious.

View or Edit the Suspicious Countries

If you need additional help with any of your suspicious countries settings, contact Support.

Note

You can also access a read-only view of this list by going to Detections > Detection Strategy and selecting the Suspicious Authentication tab. Look for the Suspicious authentication source countries box.

  1. ​Log in to Workbench.
  2. Navigate to Organizations > My Organization.
  3. Scroll down and select the Configuration tab.
  4. Scroll down to detect.alert.authentication.suspicious_countries and look for the two-letter ISO 3166 codes indicating the suspicious countries.

  1. You can add or remove countries here if needed, and select Save.

Related Settings

You may also wish to configure some related settings while in the Configuration tab:

  • Detect.alert.authentication.expected_countries - this is a list of countries from which you expect authentication.
  • Detect.alert.authentication.outside_expected_countries_duet - this checkbox is useful if your team would always like to be notified of any login activity outside of the Expected Countries list. 
    • Enabling this setting will result in a Verify Action being sent to your team whenever this type of login activity occurs.
  • Detect.alert.authentication.ofac_countries - this is a list of OFAC countries from which you do not expect authentication.

Related articles