New to Expel? Now you get a proper welcome!

Remember what it was like to find your way in a new city before your smartphone was a GPS? Well… we’re not quite in GPS territory yet but we’ve added a new feature that delivers a stylish “Welcome” email when you create a new user account. It comes complete with instructions that guide users through the process of setting up their account.

expel welcome email sample

Plus, now if anyone on your team forgets their password or needs to reset their two-factor token they can simply make their wan on over to the Users page, click the arrow menu to the right of their name, and select “Reset Invite Token.” This’ll generate a new email and allow them to set up new credentials.  

Also new

  • We’ve added more detailed health messaging for security devices so it’s easier to troubleshoot connection issues.
  • If you’re a history buff you’ll be happy to know we updated the time range filters on the Activity tabs to include “All,” so you can see your entire history of security incidents, investigations, and actions.
  • Have you ever wanted to associate an alert with a closed investigation? Now you have the option to leave the investigation closed or to reopen it. This option is available from both the Investigate button on the alert detail and in the Involved Hosts tab.


  • Changed the alert type filter on the Alerts screen so that the default filter is “All alert types” instead of “All,” which wasn’t terribly informative.
  • Fixed a problem that was causing the Add Security Device modal to sometimes display without all the vendor icons or display them in random order. We love surprises, but not when we’re trying to onboard new tech.
  • Fixed a problem that prevented some users from creating new user accounts.
  • Fixed a display issue with the User Profile page that occurred when a user selected My Profile from the user name menu in the top right.
  • For a brief time, there was a humorous bug that caused everyone in the assignment list to be displayed as “Me” when an alert or action was assigned to the current user. We had a good laugh about it, hoo-boy! Then we fixed it.
  • Fixed a problem that prevented users with a plus sign in their email address from completing signup. You probably didn’t run into this problem unless you were testing the new user creation capability like we were, and needed a whole lot of dummy email addresses.
  • The Involved Hosts tab on the Alert Detail screen was missing some pretty important text that explained what the two sections in the tab are all about. For those of you who were wondering, the top section shows the number of hosts involved in the alert, and the bottom section shows how many other recent investigations involve that same host.
  • Fixed a display issue in the Investigation Timeline that caused the column heads to shift up and down whenever the table was re-sorted.
  • Fixed the Assigned to me filter on the Investigative Actions tab so that it shows — you guessed, it — actions assigned to me.
  • Reinstated the Findings tab for hunting investigations. Now, when an analyst creates a new investigation with a type of hunting, the Findings tab will automatically display.