Script: Export Expel Alerts with Evidence Fields¶

See the example script Export Expel Alert Evidence. This script will write a CSV containing timestamp of alert, expel alert name, vendor name, and associated evidence fields.

Script: Poll for new Incidents¶

See the example script Poll For New Incidents. This script will poll Expel Workbench for any incidents created in the past five minutes.

Script: Sync to JIRA¶

See the example script Jira Sync. This script will sync the following to JIRA from Expel Workbench:

Investigative Actions details and outcome as sub tasks
Investigation description, lead alert
Investigative comments
Incident findings
Investigation status closed/opened

Script: Poll unhealthy devices¶

See the example script Poll For Unhealthy Devices. This script will poll Expel Workbench for any devices marked unhealthy in the past five minutes.

Script: Poll for investigation / incident changes¶

See the example script Poll For Investigaiton / Incident updates. This script will poll Expel Workbench for any updates to investigations or incidents in the past five minutes.

Script: Pretty Print Lead Expel Alert Evidence¶

See the example script Pretty Print Lead Expel Alert Evidence. This script will pretty print the Expel Alert details along with all correlated vendor evidences.