TL;DR
- This is a monthly recap of everything our product team shipped in the last 30 days
- Questions? Reach out to your Expel contact, or if you don’t have one, connect with us here
- October brings two new Microsoft Entra ID threat hunts and a more accurate Alert Analysis dashboard
Live this month
Alert Analysis dashboard (AAD) metrics updates
What it covers: We changed how the Alert Analysis dashboard calculates and reports metrics. Three things are different:
- A standardized metrics foundation: The AAD now pulls some information from a new, standardized source, so Expel Alert counts use one consistent definition. Users may still find inconsistencies as we continue to work on this, and are encouraged to reach out to customer success with questions.
- Date ranges up to 15 months: That lines up with Workbench’s standard data retention period. If your org has extended retention, your alert and investigation data is still kept for your configured period. The AAD charts cover the most recent 15 months.
- Events Ingested for webhook-connected integrations: Some integrations, like Zscaler, send data to Expel over a webhook. The AAD used to show no Events Ingested for them; now it does.
Why you should care: Your counts are more accurate, you can look back further, and integrations that used to show nothing now show activity.
The counts for Events Ingested depends on how the integration is connected to Expel:
- API-connected integrations: Expel pulls data from the vendor, and the AAD counts each event.
- Webhook-connected integrations: The vendor sends events in batches, and one batch can hold hundreds of events. The AAD counts each batch, not each event inside it.
That means Events Ingested for a webhook-connected integration can be much lower on the AAD than on the Security Devices page, but that doesn’t mean data is missing. Every event in every batch is unpacked and analyzed by our detections, and the Security Devices page reports those individual events. For individual event volume, open the integration on the Security Devices page and check Raw Events (last 30 days). For longer periods, like a full quarter, your customer success manager can pull the totals.
New threat hunts
These two hunts are live on the hunt catalog page in Workbench for signed-in customers with threat hunting.
1. Microsoft Entra ID North Korean IT worker fraud artifacts login hunt
What it covers: North Korea has placed fraudulent IT workers inside companies around the world. Past incidents show the same infrastructure again and again. This hunt reviews Entra ID login data tied to known VPNs and proxies, plus endpoint traffic artifacts like KVM and VDI tunnel traffic. It groups those signals around specific login applications to surface patterns, making it easier to detect.
2. Microsoft Entra ID suspicious multiple VPN usage
What it covers: Corporate VPN use is normal, and some orgs allow personal VPNs, too. But one user on more than two VPNs in a short window is unusual. This hunt reviews enriched Entra ID authentications for users showing multiple VPNs over a given timeframe.
Why you should care: Both hunts focus on identity, where attackers and fraudulent insiders blend in with normal sign-ins. Three or more VPNs for one user can point to automated post-exploit activity, and IT worker fraud often hides behind the same kind of infrastructure. Our threat hunters get a starting point for sorting the expected from the suspicious.
