> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/workbench-setup/auto-remediations/auto-remediation-manual-fallback.md).
# Auto Remediation Manual Fallback
*This guide supports an optional feature as part of the larger setup process in* [*Enable an Auto Remediation in Workbench*](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md)*.*
If you opt to enable manual fallback, in the event that an automated action fails and Expel has console access, our SOC will attempt to manually perform hands-on remediation on your behalf.
{% hint style="info" %}
The manual fallback option is available to customers who have purchased Expel's Pro Support or MDR Premium Pro tier and have enabled a supported auto remediation. If you do not have access to certain auto remediation components and would like to, [contact Support](/support/how-to-reach-us.md). **Manual fallback is supported for one security device per auto remediation.**
{% endhint %}
This option is available for the following auto remediations:
* [Cortex XDR: Contain Hosts](/workbench-setup/auto-remediations/contain-hosts/palo-alto-networks-cortex-xdr-contain-hosts.md)
* [Crowdstrike: Contain Hosts](/workbench-setup/auto-remediations/contain-hosts/crowdstrike-contain-hosts.md)
* [Microsoft Defender for Endpoint: Contain Hosts](/workbench-setup/auto-remediations/contain-hosts/microsoft-defender-for-endpoint-contain-hosts.md)
To enable manual fallback:
1. Select the device on which you would like to configure manual fallback.
2. In the **Recommended actions** field, provide specific instructions for any unique workflows or setup that SOC analysts may need to perform remediation actions in your environment. This text will be sent to the SOC analyst when manual fallback is required to help them successfully perform the response in your console.
{% hint style="info" %}
If you have "Auto-Remediation Failed" [notifications](/workbench-setup/notifications/about-notifications.md) enabled on a device configured for manual fallback, the notifications will include contextual text indicating if a manual fallback is underway for that specific failed remediation.
{% endhint %}
### Required Permissions
Depending on the technology, Expel may require more than console access to support manual fallback. **Please review the requirements below to ensure Expel has access to perform remediation when needed.**
\
**Cortex XDR: Contain Hosts**
The [Palo Alto Networks Cortex XDR Pro setup guide](/connect-your-technology/l-p-integrations/palo-alto-networks/palo-alto-networks-cortex-xdr-pro-setup-for-workbench.md) provides the necessary permissions within the console access section (Privileged Security Admin role). Ensure your configuration includes this role.
\
**CrowdStrike: Contain Hosts**
Expel requires additional permissions than what are included in the [CrowdStrike Falcon Insight XDR setup guide](/connect-your-technology/a-c-integrations/crowdstrike/crowdstrike-falcon-insight-xdr-setup-for-workbench.md). To enable manual fallback, you must log into your CrowdStrike Falcon console and update the API Client so that the API scopes for Hosts and Real Time Response are set to **Read/Write access**. This scope allows Expel to view hosts and perform critical actions like Network Containment and Remove from Containment.
\
**Microsoft Defender for Endpoint: Contain Hosts**
If you chose [Option 1: Basic AAD Permissions](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-endpoint-setup-for-workbench.md#option-1-basic-aad-permissions) during setup, ensure you have granted **full access**, which we require to complete manual fallback.
If you chose [Option 2: RBAC Permissions](/connect-your-technology/l-p-integrations/microsoft/microsoft-defender-for-endpoint-setup-for-workbench.md#option-2-rbac-permissions) during setup, ensure that you have granted the following permissions depending on your technology:
| **Microsoft Defender for Endpoint** |
Security operations \ Security data \ Response (manage)
Security operations \ Advanced live response (manage)
|
After you have completed the above, refer back to [Step 2.7 of Enable an Auto Remediation in Workbench](/workbench-setup/auto-remediations/enable-an-auto-remediation-in-workbench.md#h_01jfd2nw8cra7eb7phk8tywrtj) to finish configuring the auto remediation.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.expel.io/workbench-setup/auto-remediations/auto-remediation-manual-fallback.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.