> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup.md).

# Workbench Setup

- [Get Started](https://docs.expel.io/workbench-setup/get-started.md): Welcome to Expel! The Customer Success team will reach out to you to assist, but the items below are what we plan to complete with you within 30 days of onboarding.
- [Activate Your Workbench Account](https://docs.expel.io/workbench-setup/get-started/activate-your-workbench-account.md): This topic covers how to set up your account and begin using Workbench.
- [Add and Manage Users](https://docs.expel.io/workbench-setup/get-started/add-and-manage-users.md): This topic covers how to manage users in Expel Workbench, as well as how to resolve first-time login issues.
- [User Role Rights](https://docs.expel.io/workbench-setup/get-started/add-and-manage-users/user-role-rights.md): Learn how Expel features relate to Workbench user roles.
- [Manage Your Profile and User Account Settings](https://docs.expel.io/workbench-setup/get-started/manage-your-profile-and-user-account-settings.md): This section of Workbench allows you to manage aspects of your account.
- [Configure Your SSO Provider with Workbench](https://docs.expel.io/workbench-setup/get-started/configure-your-sso-provider-with-workbench.md): Enable Workbench users in your organization to log in via SSO.
- [Set Up Notifications](https://docs.expel.io/workbench-setup/get-started/set-up-notifications.md): You can use more than one type of notification to receive messages about your environment.
- [Add and Manage Org Context](https://docs.expel.io/workbench-setup/get-started/add-and-manage-org-context.md): Org Context refers to stored reference information about your environment that you are able to manage.
- [Connect Your Technologies](https://docs.expel.io/workbench-setup/get-started/connect-your-technologies.md): Start integrating your tech with Expel Workbench.
- [Enable Auto Remediations](https://docs.expel.io/workbench-setup/get-started/enable-auto-remediations.md)
- [Learn More About Workbench](https://docs.expel.io/workbench-setup/get-started/learn-more-about-workbench.md)
- [Notifications](https://docs.expel.io/workbench-setup/notifications.md)
- [About Notifications](https://docs.expel.io/workbench-setup/notifications/about-notifications.md)
- [Platform Setup](https://docs.expel.io/workbench-setup/notifications/platform-setup.md): You must set up your platform integration before you can begin receiving organization notifications.
- [Ticketing System Setup for Organization Notifications](https://docs.expel.io/workbench-setup/notifications/platform-setup/ticketing-system-setup-for-organization-notifications.md)
- [OpsGenie Setup for Organization Notifications](https://docs.expel.io/workbench-setup/notifications/platform-setup/opsgenie-setup-for-organization-notifications.md)
- [PagerDuty Setup for Organization Notifications](https://docs.expel.io/workbench-setup/notifications/platform-setup/pagerduty-setup-for-organization-notifications.md)
- [ServiceNow Setup for Organization Notifications](https://docs.expel.io/workbench-setup/notifications/platform-setup/servicenow-setup-for-organization-notifications.md)
- [Manage Email Notifications](https://docs.expel.io/workbench-setup/notifications/manage-email-notifications.md)
- [Manage Organization Notifications](https://docs.expel.io/workbench-setup/notifications/manage-organization-notifications.md)
- [Manage Threaded Notifications in Slack or Teams](https://docs.expel.io/workbench-setup/notifications/manage-threaded-notifications-in-slack-or-teams.md)
- [Auto Remediations](https://docs.expel.io/workbench-setup/auto-remediations.md)
- [About Auto Remediations](https://docs.expel.io/workbench-setup/auto-remediations/about-auto-remediations.md): This topic provides general information about auto remediations and which ones are available.
- [Enable an Auto Remediation in Workbench](https://docs.expel.io/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md): Expel offers a variety of auto remediations for specific devices.
- [Auto Remediation Manual Fallback](https://docs.expel.io/workbench-setup/auto-remediations/auto-remediation-manual-fallback.md): The manual fallback feature allows Expel to perform hands-on remediation if an automated action fails.
- [Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes.md)
- [Carbon Black Cloud: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/carbon-black-cloud-block-bad-hashes.md): This guide helps you set up your Carbon Black Cloud device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench.
- [CrowdStrike: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/crowdstrike-block-bad-hashes.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench.
- [Microsoft Defender for Endpoint: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/microsoft-defender-for-endpoint-block-bad-hashes.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench.
- [Palo Alto Networks Cortex XDR: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/palo-alto-cortex-xdr-block-bad-hashes.md): This guide helps you set up your Palo Alto Networks (PAN) Cortex XDR device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench.
- [SentinelOne: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/sentinelone-block-bad-hashes.md): This guide helps you set up your SentinelOne device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench.
- [Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts.md)
- [Broadcom Carbon Black Cloud: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/broadcom-carbon-black-cloud-contain-hosts.md): This guide helps you set up your Broadcom Carbon Black Cloud device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [Broadcom Carbon Black EDR: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/broadcom-carbon-black-edr-contain-hosts.md): This guide helps you set up your Broadcom Carbon Black EDR device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [CrowdStrike: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/crowdstrike-contain-hosts.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [Cybereason: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/cybereason-contain-hosts.md): This guide helps you set up your Cybereason device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [Microsoft Defender for Endpoint: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/microsoft-defender-for-endpoint-contain-hosts.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [Palo Alto Networks Cortex XDR: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/palo-alto-networks-cortex-xdr-contain-hosts.md): This guide helps you set up your Palo Alto Networks (PAN) Cortex XDR Pro device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [SentinelOne: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/sentinelone-contain-hosts.md): This guide helps you set up your SentinelOne device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench.
- [Deactivate Access Keys](https://docs.expel.io/workbench-setup/auto-remediations/deactivate-access-keys.md)
- [AWS CloudTrail: Deactivate Access Keys](https://docs.expel.io/workbench-setup/auto-remediations/deactivate-access-keys/aws-cloudtrail-deactivate-access-keys.md): This guide helps you set up your AWS CloudTrail device and grant necessary permissions so that you can enable the Deactivate Access Keys auto remediation in Workbench.
- [AWS GuardDuty: Deactivate Access Keys](https://docs.expel.io/workbench-setup/auto-remediations/deactivate-access-keys/aws-guardduty-deactivate-access-keys.md): This guide helps you set up your AWS GuardDuty device and grant necessary permissions so that you can enable the Deactivate Access Keys auto remediation in Workbench.
- [Delete Malicious Files](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files.md)
- [CrowdStrike: Delete Malicious Files](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files/crowdstrike-delete-malicious-files.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Delete Malicious Files auto remediation in Workbench.
- [Microsoft Defender for Endpoint: Delete Malicious Files](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files/microsoft-defender-for-endpoint-delete-malicious-files.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Delete Malicious Files auto remediation in Workbench.
- [Delete Registry Key](https://docs.expel.io/workbench-setup/auto-remediations/delete-registry-key.md)
- [CrowdStrike: Delete Registry Key](https://docs.expel.io/workbench-setup/auto-remediations/delete-registry-key/crowdstrike-delete-registry-key.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Delete Registry Key auto remediation in Workbench.
- [Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts.md)
- [Azure Cloud Direct: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/azure-cloud-direct-disable-accounts.md): This guide helps you set up your Azure Cloud Direct device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.
- [Duo Cloud: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/duo-cloud-disable-accounts.md): This guide helps you set up your Duo Cloud device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.
- [GitHub: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/github-disable-accounts.md): This guide helps you set up your GitHub device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.
- [Google Workspace: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/google-workspace-disable-accounts.md): This guide helps you set up your Google Workspace device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.
- [Microsoft 365: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-365-disable-accounts.md): This guide helps you set up your Microsoft 365 device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.
- [Microsoft Defender for Endpoint: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the On-Prem/Hybrid Disable Accounts auto remediation in Workbench.
- [Microsoft Entra ID via Event Hub: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-entra-id-via-event-hub-disable-accounts.md)
- [Okta: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/okta-disable-accounts.md): This guide helps you set up your Okta device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench.
- [Kill Processes](https://docs.expel.io/workbench-setup/auto-remediations/kill-processes.md)
- [Crowdstrike: Kill Processes](https://docs.expel.io/workbench-setup/auto-remediations/kill-processes/crowdstrike-kill-processes.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Kill Processes auto remediation in Workbench.
- [Microsoft Defender for Endpoint: Kill Processes](https://docs.expel.io/workbench-setup/auto-remediations/kill-processes/microsoft-defender-for-endpoint-kill-processes.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Kill Processes auto remediation in Workbench.
- [Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email.md)
- [Google Workspace (Formerly G Suite): Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/google-workspace-formerly-g-suite-remove-malicious-email.md): This guide helps you set up your Google Workspace device and grant necessary permissions so that you can enable the Remove Malicious Email auto remediation in Workbench.
- [Microsoft 365: Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/microsoft-365-remove-malicious-email.md): This guide helps you set up your Microsoft 365 device and grant necessary permissions so that you can enable the Remove Malicious Email auto remediation in Workbench.
- [Microsoft Entra ID via Event Hub: Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/microsoft-entra-id-via-event-hub-remove-malicious-email.md)
- [Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials.md)
- [Microsoft 365: Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-365-reset-credentials.md): This guide helps you set up your Microsoft 365 device and grant necessary permissions so that you can enable the Reset Credentials auto remediation in Workbench.
- [Microsoft Entra ID via Event Hub: Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-entra-id-via-event-hub-reset-credentials.md)
- [Okta: Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/okta-reset-credentials.md): This guide helps you set up your Okta device and grant necessary permissions so that you can enable the Reset Credentials auto remediation in Workbench.
- [API Key Self-Service](https://docs.expel.io/workbench-setup/api-key-self-service.md): Workbench allows you to create and manage your API keys via service accounts.
- [Configure an IP Allow List](https://docs.expel.io/workbench-setup/configure-an-ip-allow-list.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/workbench-setup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.