> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/about-integrations/expel-integrations.md). # Expel Integrations We connect to these integrations in one of the following ways: * **Direct (via API)** * **Direct (via a collector)** * **Direct (via a syslog)** * **Via a SIEM connection** **(**[**learn more**](/connect-your-technology/about-integrations/about-siem-integrations-and-connections.md#h_01k1eeqqcmef9jbdzkgcnaq7vx)**)** In cases where the integration is only available via a SIEM connection, all supported SIEMs are listed in the chart. For more information about each integration's detection strategy (including supported versions, platforms, event log sources, detection rules, etc.) refer to the [detection strategy guides](/detection-strategy-guides/a-c.md). ## Security Device Integrations **To access an integration's setup guide, select the integration name.** Integrations with an asterisk (\*) are [investigative-only](#investigative-only). | Supported Integration | Supported Connection(s) | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------- | | [1Password](/connect-your-technology/l-p-integrations/1password-setup-for-workbench.md) | Direct (via API) | | [Abnormal AI](/connect-your-technology/a-c-integrations/abnormal-ai-setup-for-workbench.md) | Direct (via API) | | [Akamai Guardicore Segmentation (formerly Guardicore Centra)](/connect-your-technology/a-c-integrations/akamai-guardicore-segmentation-formerly-guardicore-centra-setup-for-workbench.md) | Direct (via API) | | [Amazon Elastic Kubernetes Service](/connect-your-technology/a-c-integrations/amazon-aws/amazon-elastic-kubernetes-service-setup-for-workbench.md) | Direct (via API) | | [Arista NDR (via Webhook)](/connect-your-technology/a-c-integrations/arista-ndr-via-webhook-setup-for-workbench.md) | Direct (via API) | | [Aurora Endpoint Security (formerly Cylance PROTECT AV)](/connect-your-technology/a-c-integrations/aurora-endpoint-security-formerly-cylance-protect-av-setup-for-workbench.md) | Direct (via API) | | [AWS CloudTrail](/connect-your-technology/a-c-integrations/amazon-aws/aws-cloudtrail.md) | Direct (via API) | | [AWS GuardDuty](/connect-your-technology/a-c-integrations/amazon-aws/aws-guardduty-setup-for-workbench.md) | Direct (via API) | | [Box](/connect-your-technology/a-c-integrations/box-setup-for-workbench.md) | Direct (via API) | | [Broadcom Carbon Black Cloud (formerly CB ThreatHunter and CB Defense)](/connect-your-technology/a-c-integrations/broadcom/broadcom-carbon-black-cloud-formerly-cb-threathunter-and-cb-defense-setup-for-workbench.md) | Direct (via API) | | [Broadcom Carbon Black EDR (formerly CB Response)](/connect-your-technology/a-c-integrations/broadcom/broadcom-carbon-black-edr-formerly-cb-response-setup-for-workbench.md) | Direct (via API) | | [Broadcom Symantec Endpoint Protection (via SIEM)](/connect-your-technology/a-c-integrations/broadcom/broadcom-symantec-endpoint-protection-via-siem-setup-for-workbench.md) |

Exabeam Fusion New-Scale SIEM

Splunk

Sumo Logic

| | [Check Point AV, Anti-Bot, and IPS (via SIEM)](/connect-your-technology/a-c-integrations/check-point/check-point-av-anti-bot-and-ips-via-siem-setup-for-workbench.md) | Sumo Logic | | [Check Point Quantum Network Security](/connect-your-technology/a-c-integrations/check-point/check-point-quantum-network-security-setup-for-workbench.md) | Direct (via API) | | [Cisco ASA (via SIEM)](/connect-your-technology/a-c-integrations/cisco/cisco-asa-via-siem-setup-for-workbench.md) |

Exabeam Fusion New-Scale SIEM

Splunk

Sumo Logic

| | [Cisco ASA (via Syslog)](/connect-your-technology/a-c-integrations/cisco/cisco-asa-via-syslog-setup-for-workbench.md) | Direct (via API) | | [Cisco Duo](/connect-your-technology/a-c-integrations/cisco/cisco-duo-setup-for-workbench.md) | Direct (via API) | | [Cisco Firepower (via SIEM)](/connect-your-technology/a-c-integrations/cisco/cisco-firepower-via-siem-setup-for-workbench.md) |

Exabeam Fusion New-Scale SIEM

Microsoft Sentinel

Splunk

Sumo Logic

| | [Cisco Meraki](/connect-your-technology/a-c-integrations/cisco/cisco-meraki-setup-for-workbench.md) | Direct (via API) | | [Cisco Meraki (via SIEM)](/connect-your-technology/a-c-integrations/cisco/cisco-meraki-via-siem-setup-for-workbench.md) |

Splunk

Sumo Logic

| | [Cisco Secure Endpoint (formerly AMP)](/connect-your-technology/a-c-integrations/cisco/cisco-secure-endpoint-formerly-amp-setup-for-workbench.md) | Direct (via API) | | [Cisco Umbrella](/connect-your-technology/a-c-integrations/cisco/cisco-umbrella-setup-for-workbench.md) | Direct (via API) | | [Cloudflare WAF](/connect-your-technology/a-c-integrations/cloudflare/cloudflare-waf-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Cloudflare ZTNA](/connect-your-technology/a-c-integrations/cloudflare/cloudflare-zero-trust-network-access-via-webhook-setup-for-workbench.md) | Direct (via API) | | [Corelight Open NDR (via Collector)](/connect-your-technology/a-c-integrations/corelight-open-ndr-via-collector-setup-for-workbench.md) | Direct (via the Splunk Collector) | | [Cribl](/connect-your-technology/a-c-integrations/cribl-setup-for-workbench.md) | Direct (via API) | | [CrowdStrike Falcon Identity Protection](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-falcon-insight-xdr-setup-for-workbench.md) | Direct (via API) | | [CrowdStrike Falcon Insight XDR](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-falcon-insight-xdr-setup-for-workbench.md) | Direct (via API) | | [CrowdStrike Falcon Next-Gen SIEM](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-falcon-next-gen-siem-setup-for-workbench.md) | Direct (via API) | | [CrowdStrike Logscale](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-logscale-setup-for-workbench.md) | Direct (via API) | | [Cyberark Identity](/connect-your-technology/a-c-integrations/cyberark/cyberark-identity-setup-for-workbench.md) | Direct (via API) | | [Cyberark Privileged Access Management (PAM) (via SIEM)](/connect-your-technology/a-c-integrations/cyberark/cyberark-privileged-access-management-pam-via-siem-setup-for-workbench.md) | Splunk | | [Cybereason Endpoint Detection and Response (EDR)](/connect-your-technology/a-c-integrations/cybereason-endpoint-detection-and-response-edr-setup-for-workbench.md) | Direct (via API) | | [Darktrace](/connect-your-technology/d-j-integrations/darktrace-setup-for-workbench.md) | Direct (via API) | | [Datadog Observability & Analytics Platform](/connect-your-technology/d-j-integrations/datadog-observability-and-analytics-platform-setup-for-workbench.md) | Direct (via API) | | [Devo](/connect-your-technology/d-j-integrations/devo-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Dropbox](/connect-your-technology/d-j-integrations/dropbox-setup-for-workbench.md) | Direct (via API) | | [Elastic Security (SIEM)](/connect-your-technology/d-j-integrations/elastic-security-siem-setup-for-workbench.md) | Direct (via API) | | [Exabeam Fusion New-Scale SIEM Collector](/connect-your-technology/d-j-integrations/exabeam/exabeam-fusion-new-scale-siem-collector-setup-for-workbench.md) | Direct (via API) | | [Exabeam Fusion XDR](/connect-your-technology/d-j-integrations/exabeam/exabeam-fusion-xdr-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Exabeam Threat Center](/connect-your-technology/d-j-integrations/exabeam/exabeam-threat-center-setup-for-workbench.md) | Direct (via API) | | [ExtraHop Reveal(x) 360](/connect-your-technology/d-j-integrations/extrahop/extrahop-reveal-x-360-setup-for-workbench.md) | Direct (via API) | | [ExtraHop Reveal(x) Enterprise](/connect-your-technology/d-j-integrations/extrahop/extrahop-reveal-x-enterprise-setup-for-workbench.md) | Direct (via API) | | [Fastly Next-Gen WAF (formerly Signal Sciences WAF)](/connect-your-technology/d-j-integrations/fastly-next-gen-waf-formerly-signal-sciences-waf-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Forcepoint Web Filter (via SIEM)](/connect-your-technology/d-j-integrations/forcepoint-web-filter-via-siem-setup-for-workbench.md) | Exabeam Fusion New-Scale SIEM | | [Fortinet FortiAnalyzer](/connect-your-technology/d-j-integrations/fortinet/fortinet-fortianalyzer-setup-for-workbench.md) | Direct (via API) | | [Fortinet FortiCNAPP (formerly Lacework)](/connect-your-technology/d-j-integrations/fortinet/fortinet-forticnapp-formerly-lacework-setup-for-workbench.md) | Direct (via API) | | [Fortinet FortiGate (via SIEM)](/connect-your-technology/d-j-integrations/fortinet/fortinet-fortigate-via-siem-setup-for-workbench.md) |

Microsoft Sentinel

Securonix

Splunk

Sumo Logic

| | [GitHub](/connect-your-technology/d-j-integrations/github.md) | Direct (via API) | | [GitLab](/connect-your-technology/d-j-integrations/gitlab-setup-for-workbench.md) | Direct (via API) | | [Google Cloud Platform](/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench.md) | Direct (via API) | | [Google Kubernetes Engine](/connect-your-technology/d-j-integrations/google/google-kubernetes-engine-setup-for-workbench.md) | Direct (via API) | | [Google Security Operations (SecOps)](/connect-your-technology/d-j-integrations/google/google-security-operations-secops-setup-for-workbench.md) | Direct (via API) | | [Google Workspace (formerly G Suite)](/connect-your-technology/d-j-integrations/google/google-workspace-formerly-g-suite-setup-for-workbench.md) | Direct (via API) | | [Google Workspace Alert Center](/connect-your-technology/d-j-integrations/google/google-workspace-alert-center-setup-for-workbench.md) | Direct (via API) | | [JumpCloud](/connect-your-technology/d-j-integrations/jumpcloud-setup-for-workbench.md) | Direct (via API) | | [LastPass](/connect-your-technology/l-p-integrations/lastpass-setup-for-workbench.md) | Direct (via API) | | [Logz.io](/connect-your-technology/l-p-integrations/logz.io-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Microsoft 365](/connect-your-technology/l-p-integrations/microsoft/microsoft-365-setup-for-workbench.md) | Direct (via API) | | [Microsoft Azure](/connect-your-technology/l-p-integrations/microsoft/microsoft-azure-setup-for-workbench.md) | Direct (via API) | | [Microsoft Azure Kubernetes Service](/connect-your-technology/l-p-integrations/microsoft/microsoft-azure-kubernetes-service-setup-for-workbench.md) | Direct (via API) | | [Microsoft Azure Log Analytics](/connect-your-technology/l-p-integrations/microsoft/microsoft-azure-log-analytics-setup-for-workbench.md) | Direct (via API) | | Microsoft Azure Log Analytics Collector | Direct (via a collector) | | Microsoft Azure Monitor (formerly Azure Activity logs)\*[^1] | Direct (via API) | | [Microsoft Defender for Cloud Apps](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-cloud-apps-setup-for-workbench.md) | Direct (via API) | | [Microsoft Defender for Endpoint](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-endpoint-setup-for-workbench.md) | Direct (via API) | | [Microsoft Defender for Identity](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-identity-setup-for-workbench.md) | Direct (via API) | | [Microsoft Defender XDR](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-xdr-setup-for-workbench.md) | Direct (via API) | | [Microsoft Entra ID Protection](/connect-your-technology/l-p-integrations/microsoft/microsoft-entra-id-protection-setup-for-workbench.md) | Direct (via API) | | [Microsoft Entra ID via Event Hub](/connect-your-technology/l-p-integrations/microsoft/microsoft-entra-id-via-event-hub-setup-for-workbench.md) | Direct (via API) | | [Microsoft Intune](/connect-your-technology/l-p-integrations/microsoft/microsoft-intune-setup-for-workbench.md) | Direct (via API) | | [Microsoft Sentinel](/connect-your-technology/l-p-integrations/microsoft/microsoft-sentinel-setup-for-workbench.md) | Direct (via API) | | [Mimecast](/connect-your-technology/l-p-integrations/mimecast-advanced-email-security-setup-for-workbench.md) | Direct (via API) | | [Netskope CASB and Next Gen SWG](/connect-your-technology/l-p-integrations/netskope-casb-and-next-gen-swg-setup-for-workbench.md) | Direct (via API) | | [Okta Auth0](/connect-your-technology/l-p-integrations/okta-auth0-setup-for-workbench.md) | Direct (via API) | | [Okta Workforce Identity](/connect-your-technology/l-p-integrations/okta-workforce-identity-setup-for-workbench.md) | Direct (via API) | | [OneLogin](/connect-your-technology/l-p-integrations/onelogin-setup-for-workbench.md) | Direct (via API) | | [Oracle Cloud Infrastructure](/connect-your-technology/l-p-integrations/oracle-cloud-infrastructure.md) | Direct (via API) | | [Orca Security](/connect-your-technology/l-p-integrations/orca-security-setup-for-workbench.md) | Direct (via API) | | [Palo Alto Networks Cortex XDR Pro](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-cortex-xdr-pro-setup-for-workbench.md) | Direct (via API) | | [Palo Alto Networks Cortex XSIAM](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-cortex-xsiam-setup-for-workbench.md) | Direct (via API) | | [Palo Alto Networks Next Gen Firewall](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-next-gen-firewall-setup-for-workbench.md) | Direct (via API) | | [Palo Alto Networks Prisma Cloud Compute (formerly Twistlock)](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-prisma-cloud-compute-formerly-twistlock-setup-for-workbench.md) | Direct (via API) | | [Palo Alto Networks SaaS Security (formerly Prisma SaaS)](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-saas-security-formerly-prisma-saas-setup-for-workbench.md) | Direct (via API) | | [Palo Alto Networks Strata](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-strata-setup-for-workbench.md) | Direct (via API) | | [Panther Cloud SIEM](/connect-your-technology/l-p-integrations/panther-cloud-siem-setup-for-workbench.md) | Direct (via API) | | [PingOne Platform (via Collector)](/connect-your-technology/l-p-integrations/pingone-platform-via-collector-setup-for-workbench.md) | Direct (via the Splunk Collector or Exabeam Fusion New-Scale SIEM Collector) | | [Proofpoint Insider Threat Management (via SIEM)](/connect-your-technology/l-p-integrations/proofpoint/proofpoint-insider-threat-management-via-siem-setup-for-workbench.md) | Sumo Logic | | [Proofpoint TAP for MDR](/connect-your-technology/l-p-integrations/proofpoint/proofpoint-tap-for-mdr-setup-for-workbench.md) | Direct (via API) | | [QRadar](/connect-your-technology/q-z-integrations/qradar-setup-for-workbench.md) | Direct (via API) | | [Qualys VMDR](/more-features/expel-vulnerability-prioritization/qualys-vmdr-setup-for-workbench.md) | Direct (via API) | | [Rapid7 InsightVM](/more-features/expel-vulnerability-prioritization/rapid7-insightvm-setup-for-workbench.md) | Direct (via API) | | [Salesforce](/connect-your-technology/q-z-integrations/salesforce-setup-for-workbench.md) | Direct (via API) | | [Securonix Next-Gen SIEM](/connect-your-technology/q-z-integrations/securonix-next-gen-siem-setup-for-workbench.md)\*[^1] | Direct (via API) | | [SentinelOne Singularity Data Lake](/connect-your-technology/q-z-integrations/sentinelone/sentinelone-singularity-data-lake-setup-for-workbench.md)\*[^1] | Direct (via API) | | [SentinelOne Singularity Endpoint](/connect-your-technology/q-z-integrations/sentinelone/sentinelone-singularity-endpoint-setup-for-workbench.md) | Direct (via API) | | [SentinelOne Singularity Hologram (formerly Attivo) (via SIEM)](/connect-your-technology/q-z-integrations/sentinelone/sentinelone-singularity-hologram-formerly-attivo-via-siem-setup-for-workbench.md) |

Splunk

Sumo Logic

| | [ServiceNow](/workbench-setup/notifications/platform-setup/servicenow-setup-for-organization-notifications.md) | Direct (via API) | | [Slack](/connect-your-technology/q-z-integrations/slack-setup-for-workbench.md) | Direct (via API) | | [Snowflake](/connect-your-technology/q-z-integrations/snowflake-setup-for-workbench.md) | Direct (via API) | | [Splunk](/connect-your-technology/q-z-integrations/splunk/splunk-setup-for-workbench.md) | Direct (via API) | | [Splunk Collector](/connect-your-technology/q-z-integrations/splunk/splunk-collector-setup-for-workbench.md) | Direct (via API) | | [Splunk Core Alerts (via Collector)](/connect-your-technology/q-z-integrations/splunk/splunk-core-alerts-via-collector-setup-for-workbench.md) | Direct (via the Splunk Collector) | | [Sublime Security](/connect-your-technology/q-z-integrations/sublime-security-setup-for-workbench.md) | Direct (via API) | | [Sumo Logic Cloud Infrastructure Security](/connect-your-technology/q-z-integrations/sumo-logic/sumo-logic-cloud-infrastructure-security-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Sumo Logic Cloud SIEM Enterprise](/connect-your-technology/q-z-integrations/sumo-logic/sumo-logic-cloud-siem-enterprise-setup-for-workbench.md) | Direct (via API) | | Sumo Logic Collector | Direct (via API) | | [Tanium XEM Core](/connect-your-technology/q-z-integrations/tanium.md) | Direct (via API) | | [Tenable Vulnerability Management](/more-features/expel-vulnerability-prioritization/tenable-vulnerability-management-setup-for-workbench.md) | Direct (via API) | | [Thales Imperva Cloud Web Application Firewall (formerly Imperva Cloud)](/connect-your-technology/q-z-integrations/thales-imperva/thales-imperva-cloud-web-application-firewall-formerly-imperva-cloud-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Thales Imperva Web Application Firewall (formerly Imperva SecureSphere)](/connect-your-technology/q-z-integrations/thales-imperva/thales-imperva-web-application-firewall-formerly-imperva-securesphere-setup-for-workbench.md)\*[^1] | Direct (via API) | | [Trellix Endpoint Security (HX) (formerly FireEye HX)](/connect-your-technology/q-z-integrations/trellix-endpoint-security-hx-formerly-fireeye-hx-setup-for-workbench.md) | Direct (via API) | | [Varonis DatAlert](/connect-your-technology/q-z-integrations/varonis-datalert-setup-for-workbench.md) | Direct (via API) | | Varonis SaaS | Direct (via API) | | [Vectra AI (NDR)](/connect-your-technology/q-z-integrations/vectra-ai-ndr-setup-for-workbench.md) | Direct (via API) | | [Verizon Network Detection and Response (formerly ProtectWise)](/connect-your-technology/q-z-integrations/varonis-datalert-setup-for-workbench.md) | Direct (via API) | | [Wiz](/connect-your-technology/q-z-integrations/wiz-setup-for-workbench.md) | Direct (via API) | | [Workday](/connect-your-technology/q-z-integrations/workday-setup-for-workbench.md) | Direct (via API) | | [Zscaler Internet Access (ZIA) (via SIEM)](/connect-your-technology/q-z-integrations/zscaler/zscaler-internet-access-zia-via-siem-setup-for-workbench.md) |

Microsoft Sentinel

Splunk

Sumo Logic

| | [Zscaler Internet Access (ZIA) (via Webhook)](/connect-your-technology/q-z-integrations/zscaler/zscaler-internet-access-via-webhook-setup-for-workbench.md) | Direct (via API) | #### Investigative-only Expel does not ingest data or run detections against these integrations. These integrations are connected to Workbench so that SOC analysts can pivot to that console to support an investigation or incident. Hunting support isn't currently available for these integrations. Expel recommends onboarding them purely to strengthen investigative capability. ## Other Integrations You can also integrate with certain supported systems or notification methods in Workbench via your Organization Settings.
MethodUsage
Microsoft TeamsTo receive messages from Expel, including notifications
OpsgenieTo be notified of incidents in Workbench at a specific Opsgenie destination
PagerDutyTo be notified of important events at a specific PagerDuty destination
Single Sign-OnTo log into Workbench using your SSO provider
SlackTo receive messages from Expel, including notifications
Ticketing SystemsTo receive a plain text email of your organization's assigned actions in a ticketing destination
WebhooksTo be notified of important events at a specific webhook destination
WizTo sync Expel Alerts with the originating Wiz issues
[^1]: Investigative-only. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/connect-your-technology/about-integrations/expel-integrations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.