Red, white and vroom!

It’s that time of year – fireworks, sparklers, and road trips. Whether or not you took some time off to enjoy the holiday, there is no place quite like home. We’ve updated Workbench so you can now select your homepage – so every time you login, you arrive where you love most. We’ve also made some enhancements to the Investigative Action page. Now you can consume the investigation details by your preference of date created or updated timestamp. Not interested in all the details, we have an update to make it even easier to skim the results. Read more to learn about the latest release.


Choose your homepage

To celebrate Independence Day, we’re providing some freedom when it comes to your Workbench homepage. You now can select what page you’d like to set as your homepage. Simply navigate to Settings > My Profile and click the Edit User button. You can choose the Situation Report or any of the Alerts or Activity pages.

But that’s not all:

  • You can make almost any page your homepage by navigating to the user menu in the top right.
  • If you have filters selected on that page, Workbench will save those to your homepage, too.
  • Clicking the Expel logo in the top left will always return you to your homepage.


More help understanding the investigation

We’ve made three enhancements to the Investigative Actions page that will help you understand what happened and when it happened.

  1. In the new Summary area, analysts can provide a recap of the outcome so you don’t need to scroll through all the investigative actions.
  2. If you like reading all the details, we’ve added a sort filter that lets you order the actions by created or updated timestamp. If you were a big fan of that Group by type checkbox, you’ll find that at the bottom of the list.
  3. To see those timestamps, click on the new history button in the bottom left of each investigative action.

Other enhancements

  • If an investigative action job fails, the tile will now show more detail about the failure with suggested next steps to resolve the problem.
  • To click or not to click. We received feedback that the assignment icons weren’t obviously clickable. To fix the problem, we added a hover state. Now you can now see which Expel analyst is assigned to an alert, investigation, or action.
  • We added an icon on the Alert Grid page that will return you to the Alert List view.
  • Additional customer context (when available) is now visible in both the Alert Grid and the Alert List views.
  • In the Alert detail you’ll now see separate timestamps for Vendor alert time (the time your vendor device detected the alert) and Expel alert time (the time the alert was ingested into our system).
  • You can now change the name of a closed investigation.

Other fixes (and other odds and ends)

  • Improved the logic that determines what’s shown on the Activity > Actions board to ensure open actions are included.
  • Fixed a problem in the custom date range selector for Activity metrics that caused the wrong end date to be used.
  • We fixed an issue on the Investigative Actions page where the Group by type checkbox was incorrectly grouping new action types.
  • Fixed a bug that was preventing our analysts from uploading PCAPs to investigations in some rare cases.
  • Tag, you’re it. We fixed an issue that was preventing users from assigning and reassigning alerts.
  • Fixed an issue that caused the assignee filter on the Alerts List view to malfunction.