How to Talk to Us

• How to Talk to Us

About Workbench

• Introduction to Workbench

Expel Terminology

• "Time to" Definitions
• Expel Terminology

Workbench Setup

• Initial Setup
  • Get Connected to Expel Workbench
  • Your Profile
  • Configure an IP Allow List
• Activation and User Management
  • Add and Manage Users in Workbench
  • User Role Rights in Expel Workbench
• Connect Your Single Sign-On (SSO) Tools
  • Configure Your SSO Provider with Workbench
  • Configuring your Azure SSO Provider with Workbench
  • Configuring your Okta SSO provider with Workbench
  • Configuring your OneLogin SSO provider with Workbench

Workbench Reference

• Investigation, Alert, and Incident Selections

Categorization by Security Product Fidelity

• Endpoint Products Fidelity and Impact
• Network Products Fidelity and Impact
• SIEM Products Fidelity and Impact
• Cloud Products Fidelity and Impact

Incidents and Critical Incidents

• Expel Alert Severity Descriptions

Activity

• About Activity
• Investigations
• Investigations Tab Overview
• Working with Investigations
• Create an On-Demand Investigation
• How to Reopen an Investigation

Alerts

• Alerts Overview
• How Expel Alerts Work
• Alerts Dashboard

Dashboards

• Situation Report Dashboard
• Alert Analysis Dashboard
• Active Devices
• Idle Devices
• Device Totals
• Phishing Dashboard
See all 9 articles

Detections

• About Identity Classification
• About Detection Strategy
• Detections Tool
• Filtering Detections
• Finding a List of Suspicious Countries

Notifications

• About Notifications
  • About Notifications
  • Default Workbench Notifications
  • Notification Definitions Guide
• Notifications Setup

Settings

• Set Up an Email Digest
• Configure Organization Settings
• Organizations
• Manage Org Context
• Suppression Rules
• Lookout Rules
See all 7 articles

How to Use Event Search in Workbench

• How to Use Event Search in Workbench

Managing Incident or Investigative Action Notifications

• How to Find Open Remediation or Investigative Actions
• How to Comment on an Incident or Investigation
• How to Close an Incident or Investigation

Usage Metrics

• Expel Licensing and Usage Overview
• How to Access Usage Metrics Data