About Notifications

Expel security monitoring tracks many moving parts at the same time. Many events, like a security device going offline or an Investigation being opened, trigger a notification from Workbench. You may also receive a notification if there is a manual action of some kind that you need to take in support of an Investigative Action.

Notification Types

Your organization can use more than one type of notification to receive messages about your environment, if you choose. You can also leverage email, or integrations with Slack​​® or Microsoft Teams™, to communicate directly with us.

There are two types of notifications that can be set up in Workbench.

Type	Usage
Email notification	Configured at the user level and sent to an individual email address. Includes a link to take action in Workbench. All users in an organization will receive the default email notifications, but each user can edit them as they wish. Organization Admin users can also edit email notifications for other users.
Organization notification	Configured at the organization level. Only Organization Admin users can add, edit, or delete organization notifications. Sent to a platform like Slack​​ or Microsoft Teams, or to other integrations like a ticketing system or webhook destination. Requires someone in the organization to first set up an integration with a supported platform before receiving any organization notifications, including the default organization notifications.

Default Notifications

Certain notifications are enabled by default for organizations and users. You may set up additional notifications for your organization or for your email, and you may also edit the default notifications at any time.

Default Email Notifications

Default email notifications are activated for a user as soon as they are set up in Workbench.

An email notification is always generated when the following events occur in Workbench, unless changed by a user or an admin at your organization:

• Incident is created

• Incident is closed (Wiz users only)

• Investigation is created

• Investigation is assigned to my org

• Investigation is closed

• Investigative Action is assigned to me

• Investigative Action is assigned to my org

• Notify Action is assigned to my org

• Verify Action is assigned to me

• Verify Action is assigned to my org

• Remediation Action is assigned to me

• Remediation Action is assigned to my org

• Remediation Action is automated

• An assembler has a health status change

Default Organization Notifications

Someone at your organization must first set up an integration with one of the supported platforms in order to begin receiving the default organization notifications.

An organization notification is always generated when the following events occur in Workbench, unless changed by an admin at your organization:

• Incident is created

• Incident is assigned to an organization

• Incident is reopened

• Investigation is assigned to an organization

• Remediation Action is assigned to an organization*

• Verify Action is assigned to an organization

• Investigative Action is assigned to an organization

• Notify Action is assigned to an organization

• Assembler has a health status change

• Security device has a health status change

• Announcement is created

• Emerging threat is created

• Support ticket is created

• Support ticket is re-opened

• Support ticket is closed

• Support ticket comment created

* Exception: For ticketing systems only, when an Investigation occurs due to a Phishing alert, organization notifications for Remediation Actions are not sent to those systems by default. You can contact Support to turn this notification on if you wish.

Supported Platforms

All of the following integrations are configured at the organization level and support your organization notifications.

You can also use Teams or Slack to communicate with us directly.

• Microsoft Teams*

• OpsGenie

• PagerDuty

• ServiceNow

• Slack*

• Ticketing Systems

• Webhooks

*Our Support team can help you set up Teams and Slack.

How to Set Up Notifications

All notifications are set up in Workbench in Settings > Organization Settings.

Email notifications are set up in a user's Profile page, and organization notifications are set up in the My Organizations section.

An Organization Admin user is required to set up organization notifications.

• To set up email notifications:

  • Simply select a notification event that will be sent to the user email.

• To set up organization notifications:

  • First use the Integrations tab to set up an integration with a supported platform.

  • Then use the Notifications tab to create the individual notifications that are routed to that platform.

For detailed setup instructions, including how to change your notifications, see:

• Manage Email Notifications for Workbench

• Manage Organization Notifications for Workbench