The best documentation goes to the Assembler

The shining star this release goes to our assembler on-boarding documentation. We’ve added the on-boarding documents into Workbench, so if you need to download an assembler, the step-by-step documentation is right where you need it. Tada!


Assembler on-boarding documents are now accessible in Workbench. These guides walk through the download, registration, deployment, activation, and authorization steps for the Assembler to make for an even smoother self on-boarding experience.

We’ve added an informational popover to the Alert Analysis dashboard to provide more context on the data you’re viewing.

We’ve updated our email display name, so it’s clear to see it’s from us. Instead of “socs” you’ll now see “Expel SOC” as the sender of email notifications.

Other Enhancements

  • We’ve improved the format of our email notifications. Any malicious links that we reference are no longer clickable.
  • If you signed up to receive email notifications for “Actions completed,” you may have received an email when investigative actions were closed as well. We updated this so you’ll only receive a notification when the action is completed.

Other fixes (and a few odds and ends)

  • The “Disrupt Attackers” and “Enable Defenders” labels were missing from resilience recommendations, but we’re happy to say they’re back.
  • We made some updates which messed with the ability to move columns on the Alert Grid, so we fixed that issue.