Ctrlk
Go to Workbench
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Fastly Next-Gen WAF (Formerly Signal Sciences WAF) Setup for Workbench

Step 1: Enable Console Access

Expel requires console access to allow analysts to perform investigation and triage. Without this additional level of information, alerts cannot be verified by our analysts, and an investigation cannot be initiated. For more information, see Why Expel Asks for Console Access.

  1. In Fastly, navigate to Corp Manage and click Corp Users.

  2. Click Add User.

  3. Configure the user as follows:

    • Email - enter "soc+<Your_Organization_Name>@expel.io".

      • For example, if your organization were Acme Corp, the format would be "soc+acme_corp@expel.io".

    • Role - select User.

  4. Click Invite User.

  5. Expel will receive the email invitation and complete console access configuration in Workbench on your behalf.

Step 2: Enable API Access for Expel

To integrate the technology with Workbench, you need to create secure credentials to the API.

  1. Go to My Profile and select API Access Tokens.

  2. Click Add API access token.

  3. Type "Expel API" as the name, and click Create API access token.

  4. Copy and save the Token value for use in a later step.

  5. Click Continue to finish creating the access token.

Step 3: Add Fastly Next-Gen WAF as a Security Device in Workbench

Now that you have the correct access configured and noted the credentials, you can integrate your tech with Workbench.

  1. In a new browser tab, log in to https://workbench.expel.io/settings/security-devices?setupIntegration=signal_sciences.

  2. A configuration pane displays. Complete the fields as follows:

    • Name - enter a name that might help you more easily identify this integration, such as “CompanyName Fastly Next-Gen WAF”; this name will display in Workbench under the Name column, and is a text string that you can filter on.

    • Location - enter the location of your integration, for example “cloud.” This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.

    • Username - enter the user created in Step 1.

    • API key - enter the access token generated in Step 2.

    • Server address - enter the host name of the Next-Gen WAF dashboard.

      Fastly Next-Gen WAF Add a Security Device screen in Workbench.

  3. Click Save.

  4. On the console access screen, select Set up later. Expel will complete configuration with the user you created in Step 1.

  5. Click Save.

Your device should be created successfully within a few seconds. A few reminders:

  • After your connection is healthy, it will take some time for your device to begin polling and receiving data.

  • To check on the status, select the downward arrow for your device in the first column and choose View details.

  • Polling will happen first; data will be received after that. You must refresh the page to see updates.

  • If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, contact our support team for help.

  • To check if alerts are coming through, navigate to Dashboards > Alert Analysis. Scroll to the device you want to check, and select the Expel Alerts tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.

Last updated

Was this helpful?