> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations.md). # Auto Remediations - [About Auto Remediations](https://docs.expel.io/workbench-setup/auto-remediations/about-auto-remediations.md): This topic provides general information about auto remediations and which ones are available. - [Enable an Auto Remediation in Workbench](https://docs.expel.io/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md): Expel offers a variety of auto remediations for specific devices. - [Auto Remediation Manual Fallback](https://docs.expel.io/workbench-setup/auto-remediations/auto-remediation-manual-fallback.md): The manual fallback feature allows Expel to perform hands-on remediation if an automated action fails. - [Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes.md) - [Carbon Black Cloud: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/carbon-black-cloud-block-bad-hashes.md): This guide helps you set up your Carbon Black Cloud device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench. - [CrowdStrike: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/crowdstrike-block-bad-hashes.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench. - [Microsoft Defender for Endpoint: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/microsoft-defender-for-endpoint-block-bad-hashes.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench. - [Palo Alto Networks Cortex XDR: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/palo-alto-cortex-xdr-block-bad-hashes.md): This guide helps you set up your Palo Alto Networks (PAN) Cortex XDR device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench. - [SentinelOne: Block Bad Hashes](https://docs.expel.io/workbench-setup/auto-remediations/block-bad-hashes/sentinelone-block-bad-hashes.md): This guide helps you set up your SentinelOne device and grant necessary permissions so that you can enable the Block Bad Hashes auto remediation in Workbench. - [Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts.md) - [Broadcom Carbon Black Cloud: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/broadcom-carbon-black-cloud-contain-hosts.md): This guide helps you set up your Broadcom Carbon Black Cloud device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [Broadcom Carbon Black EDR: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/broadcom-carbon-black-edr-contain-hosts.md): This guide helps you set up your Broadcom Carbon Black EDR device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [CrowdStrike: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/crowdstrike-contain-hosts.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [Cybereason: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/cybereason-contain-hosts.md): This guide helps you set up your Cybereason device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [Microsoft Defender for Endpoint: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/microsoft-defender-for-endpoint-contain-hosts.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [Palo Alto Networks Cortex XDR: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/palo-alto-networks-cortex-xdr-contain-hosts.md): This guide helps you set up your Palo Alto Networks (PAN) Cortex XDR Pro device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [SentinelOne: Contain Hosts](https://docs.expel.io/workbench-setup/auto-remediations/contain-hosts/sentinelone-contain-hosts.md): This guide helps you set up your SentinelOne device and grant necessary permissions so that you can enable the Contain Hosts auto remediation in Workbench. - [Deactivate Access Keys](https://docs.expel.io/workbench-setup/auto-remediations/deactivate-access-keys.md) - [AWS CloudTrail: Deactivate Access Keys](https://docs.expel.io/workbench-setup/auto-remediations/deactivate-access-keys/aws-cloudtrail-deactivate-access-keys.md): This guide helps you set up your AWS CloudTrail device and grant necessary permissions so that you can enable the Deactivate Access Keys auto remediation in Workbench. - [AWS GuardDuty: Deactivate Access Keys](https://docs.expel.io/workbench-setup/auto-remediations/deactivate-access-keys/aws-guardduty-deactivate-access-keys.md): This guide helps you set up your AWS GuardDuty device and grant necessary permissions so that you can enable the Deactivate Access Keys auto remediation in Workbench. - [Delete Malicious Files](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files.md) - [CrowdStrike: Delete Malicious Files](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files/crowdstrike-delete-malicious-files.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Delete Malicious Files auto remediation in Workbench. - [Microsoft Defender for Endpoint: Delete Malicious Files](https://docs.expel.io/workbench-setup/auto-remediations/delete-malicious-files/microsoft-defender-for-endpoint-delete-malicious-files.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Delete Malicious Files auto remediation in Workbench. - [Delete Registry Key](https://docs.expel.io/workbench-setup/auto-remediations/delete-registry-key.md) - [CrowdStrike: Delete Registry Key](https://docs.expel.io/workbench-setup/auto-remediations/delete-registry-key/crowdstrike-delete-registry-key.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Delete Registry Key auto remediation in Workbench. - [Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts.md) - [Azure Cloud Direct: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/azure-cloud-direct-disable-accounts.md): This guide helps you set up your Azure Cloud Direct device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench. - [Duo Cloud: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/duo-cloud-disable-accounts.md): This guide helps you set up your Duo Cloud device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench. - [GitHub: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/github-disable-accounts.md): This guide helps you set up your GitHub device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench. - [Google Workspace: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/google-workspace-disable-accounts.md): This guide helps you set up your Google Workspace device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench. - [Microsoft 365: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-365-disable-accounts.md): This guide helps you set up your Microsoft 365 device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench. - [Microsoft Defender for Endpoint: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/microsoft-defender-for-endpoint-disable-accounts.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the On-Prem/Hybrid Disable Accounts auto remediation in Workbench. - [Okta: Disable Accounts](https://docs.expel.io/workbench-setup/auto-remediations/disable-accounts/okta-disable-accounts.md): This guide helps you set up your Okta device and grant necessary permissions so that you can enable the Disable Accounts auto remediation in Workbench. - [Kill Processes](https://docs.expel.io/workbench-setup/auto-remediations/kill-processes.md) - [Crowdstrike: Kill Processes](https://docs.expel.io/workbench-setup/auto-remediations/kill-processes/crowdstrike-kill-processes.md): This guide helps you set up your CrowdStrike device and grant necessary permissions so that you can enable the Kill Processes auto remediation in Workbench. - [Microsoft Defender for Endpoint: Kill Processes](https://docs.expel.io/workbench-setup/auto-remediations/kill-processes/microsoft-defender-for-endpoint-kill-processes.md): This guide helps you set up your Microsoft Defender for Endpoint device and grant necessary permissions so that you can enable the Kill Processes auto remediation in Workbench. - [Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email.md) - [Google Workspace (Formerly G Suite): Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/google-workspace-formerly-g-suite-remove-malicious-email.md): This guide helps you set up your Google Workspace device and grant necessary permissions so that you can enable the Remove Malicious Email auto remediation in Workbench. - [Microsoft 365: Remove Malicious Email](https://docs.expel.io/workbench-setup/auto-remediations/remove-malicious-email/microsoft-365-remove-malicious-email.md): This guide helps you set up your Microsoft 365 device and grant necessary permissions so that you can enable the Remove Malicious Email auto remediation in Workbench. - [Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials.md) - [Microsoft 365: Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/microsoft-365-reset-credentials.md): This guide helps you set up your Microsoft 365 device and grant necessary permissions so that you can enable the Reset Credentials auto remediation in Workbench. - [Okta: Reset Credentials](https://docs.expel.io/workbench-setup/auto-remediations/reset-credentials/okta-reset-credentials.md): This guide helps you set up your Okta device and grant necessary permissions so that you can enable the Reset Credentials auto remediation in Workbench. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/workbench-setup/auto-remediations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.