> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/a-c-integrations/arista-ndr-via-webhook-setup-for-workbench.md).

# Arista NDR (via Webhook) Setup for Workbench

## Prerequisites

1. You must have admin access in Workbench to set up this integration.
2. You must have user and role creation privileges in Arista NDR.

## Step 1: Add a New User Account in Arista NDR

1. Log in to Arista NDR.
2. Select the **Settings** (gear) icon in the top right.
3. Select **Users** from the dropdown.<br>

   <div align="left"><figure><img src="/files/aieC2TIbP22i6Auq3PaH" alt="Select Users in the Settings dropdown." width="117"><figcaption></figcaption></figure></div>
4. On the Manage Users & Roles page, select **Add New User**.
5. Configure the New User as follows:
   * **Username** - enter "expel\_analyst".
   * **Display Name** - enter "Expel Analyst".
   * **Email** - enter "soc+\<Your\_Organization\_Name>@expel.io".
     * For example, if your organization were Acme Corp, the format would be "<soc+acme_corp@expel.io>".
   * **Initial Password** - specify a password for the new account.
   * **Confirm Password** - confirm the new account password.
6. Still in the New User window, select the **Roles & Capabilities** tab.<br>

   <div align="left"><figure><img src="/files/leOfiHcyV3PrQbw9D2Uh" alt="Tier 3 Analyst is selected in the dropdown in the Roles &#x26; Capabilities tab." width="375"><figcaption></figcaption></figure></div>
7. Clear the default role and use the dropdown to assign the **Tier 3 Analyst** role.
8. Select **Save**.

## Step 2: Add Arista NDR as a Security Device and Obtain Webhook Credentials in Workbench

Now that you have the necessary credentials, you can configure the integration in Workbench.

{% hint style="warning" %}
For On-Prem, you need to add each Nucleus individually based on the below instructions.
{% endhint %}

1. [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F).
2. In the side menu, navigate to **Organization Settings > Security Devices**.
3. Select **Add Security Device**.
4. In the search box, type “Arista” and then select the **Arista NDR (via Webhook)** integration.<br>

   <div align="left"><figure><img src="/files/cWVCJ3VvHp9tvymB4iGV" alt="Arista NDR Add a Device screen in Workbench." width="327"><figcaption></figcaption></figure></div>
5. A configuration pane displays. Complete the fields as follows:
   * **Where is your device?** - select **Cloud** or **On-Prem** (on-premises) installation.
     * **For On-Prem**, choose the assembler that will be forwarding the logs.
   * **Name** - enter a name that might help you more easily identify this integration, such as “CompanyName Arista NDR”; this name will display in Workbench under the Name column, and is a text string that you can filter on.
   * **Location** - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.
   * For now, **skip the Webhook fields**.
   * **Console URL** - enter the URL used to log in to Arista NDR.
   * **Arista NDR API login username** - enter the username created in [Step 1](#step-1-add-a-new-user-account-in-arista-ndr).
   * **Arista NDR API login password** - enter the password created in [Step 1](#step-1-add-a-new-user-account-in-arista-ndr).
6. Select **Save**.
7. On the console access screen, select **Set up now (recommended)** from the dropdown and provide your Arista console URL and the user credentials from [Step 1](#step-1-add-a-new-user-account-in-arista-ndr).
8. Select **Save**.
9. On the Security Devices page, select the dropdown arrow for the Arista NDR device you just onboarded and select **Edit**.<br>

   <div align="left"><figure><img src="/files/um4h7s8pHGFOuIOongQS" alt="Select Edit in the device dropdown." width="186"><figcaption></figcaption></figure></div>
10. In the Connection Settings section, webhook credentials have been automatically generated and  populated. **Copy and save the URL and credentials** for use in the next step.<br>

    <div align="left"><figure><img src="/files/5CJCkoymLhrOyktWq4cE" alt="Webhook credentials will be populated in the Connection Settings section of the Security Device." width="375"><figcaption></figcaption></figure></div>

## Step 3: Configure Forwarding Alerts from Arista NDR to Expel

Now that you have the webhook credentials, you can configure alert forwarding to Expel's Workbench by adding a new Skill in Arista NDR.

{% hint style="warning" %}
If your device is on-prem, you will need to configure the skill on each Nucleus for each Security Device integration.
{% endhint %}

1. In Arista NDR, use the sidebar to navigate to **Manage Detections > Skills**.
2. Select **+ Create**.
3. On the **Add Skill** page, configure the fields as follows:
   * **Expression** - enter the code snippet provided below, substituting `<TOKEN>` and `<PATH>` according to your webhook credentials.\
     \
     For `<PATH>`, capture the URI from the generated **webhook URL**: \
     `https://push-ingest.opsv2.expel.io/`**`<PATH>`**\
     \
     For `<TOKEN>`, you will need to generate a base64 encoded TOKEN from the webhook username and password. See below for instructions:

{% tabs fullWidth="false" %}
{% tab title="Windows" %}
In Powershell, run the following command:\
`[Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes("username:password"))`
{% endtab %}

{% tab title="Unix-Like Systems" %}
In Terminal, run the following command:\
`echo -n "username:password" | base64`
{% endtab %}
{% endtabs %}

**Use the two values in the code below:**

{% hint style="info" %}
Be sure to include “Basic “ in front of the token as well as the leading forward slash in front of the PATH. (Do not include the < >).
{% endhint %}

```
integrations.json.https 
  true  
  { headers: [{fst: "Authorization", snd: "Basic <TOKEN>" }] // Content-Type: application/json is added by default 
  , host: "push-ingest.opsv2.expel.io"
  , path: "/<PATH>" 
  , port: 443 
  }
```

Resulting code example:

<div align="left"><figure><img src="/files/VBFoATzZa02hV3spsoRH" alt="Expression shows the code with the token included in line 3 and the path in line 5."><figcaption></figcaption></figure></div>

* **Name** - enter "Send alerts to Expel".
* **Reference Identifier** - enter a unique identifier of your choice.

4. Select **Save**.
5. If possible, trigger an alert in Arista or ensure an alert is received in Workbench to verify the configuration was successful.

To check if alerts are coming through in Workbench, navigate to **Dashboards > Alert Analysis**. Scroll to the device you want to check, and select the **Expel Alerts** tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we [tune your device](/workbench-reference/alerts/how-expel-alerts-work.md#device-tuning).

To check on the status of the device in Workbench, navigate to **Organization Settings > Security Devices**. Select the downward arrow for your device in the first column and choose **View details**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/a-c-integrations/arista-ndr-via-webhook-setup-for-workbench.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.