--- title: Expel Workbench slug: connectors/expel-workbench docTags: createdAt: 2026-06-09T16:30:16.176Z --- Expel Workbench is a security operations platform that centralizes alert management, investigations, and remediation actions. Expel Workbench is a security operations platform that provides comprehensive visibility and actionable insights into security incidents. This connector allows Swimlane Turbine users to seamlessly integrate with Expel Workbench, enabling automated retrieval and management of alerts, investigations, and remediation actions. By leveraging this integration, users can enhance their incident response capabilities, streamline security operations, and ensure timely remediation of threats. ## Prerequisites Before you can use the Expel Workbench connector for Turbine, you'll need access to the Expel API. This requires the following: - an API token authentication using the following parameters: - URL: The endpoint URL for accessing Expel Workbench API. - API Key: A valid API key to authenticate requests to Expel Workbench. ## Obtaining an API Key API keys are obtained through your Expel Engagement Manager. Please contact Expel. ## Capabilities This Expel Workbench integration provides the following capabilities: - Get Expel Alerts - Get Investigations - Get Investigation Actions - Get Investigation Alerts - Get Investigation Findings - Get Investigation Remediations - Get Security Devices - Get Vendor Alerts - Update Alerts - Update Investigation - Update Investigative Actions ## Notes To use query parameters, refer to the documentation to identify the specific fields available for a particular action. ## Documentation [API Documentation](https://workbench.expel.io/api/v2/docs/) ## Additional Documentation - [Expel Workbench Connector Documentation](https://docs.swimlane.com/connectors/expel-workbench) - [Expel Workbench API Documentation](https://docs.expel.io/) - [Expel Workbench Authentication Guide](https://docs.swimlane.com/authentication-guides/expel-workbench) # Configurations ## Expel Workbench API Key Authentication Authenticates using API Token. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------- | -------- | ------------ | | url | A URL to the target host. | string | Required | | token | The API key. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Get Expel Alerts Retrieve a list of alert records from Expel Workbench, providing an overview of security notifications. ### Endpoint - **URL:** `api/v2/expel_alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"parameters":{"filter":[{"field":"string","relationship_field":"string","operator":"string","value":"string"}],"include":"string","sorting":"string","page":[{"field":"string","value":123}],"flag":[{"field":"string","value":"string"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.alert_type` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.expel_name` | string | Response data | | `data.attributes.expel_severity` | string | Response data | | `data.attributes.expel_version` | string | Response data | | `data.attributes.expel_alias_name` | string | Response data | | `data.attributes.expel_signature_id` | string | Response data | | `data.attributes.expel_message` | string | Response data | | `data.attributes.ref_event_id` | object | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string","page":{"offset":123,"limit":123,"total":123}},"links":{"self":"string"},"data":[{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{},"links":{},"relationships":{}}],"included":[{"file_name":"Example Name","file":"string"}]}` ## Get Investigation Actions Retrieve a list of actions linked to an investigation in Expel Workbench by providing the Investigation ID. ### Endpoint - **URL:** `api/v2/investigations/{{investigation_id}}/investigative_actions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.investigation_id` | string | Required | Investigation ID. | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"path_parameters":{"investigation_id":"29af0672-7dbe-46e4-96ce-69a2c3ac2b9b"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.status` | string | Response data | | `data.attributes.title` | string | Response data | | `data.attributes.instructions` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.attributes.status_updated_at` | string | Response data | | `data.attributes.reason` | string | Response data | | `data.attributes.results` | string | Response data | | `data.attributes.close_reason` | object | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string","page":{"offset":123,"limit":123,"total":123}},"links":{"self":"string"},"data":[{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{},"links":{},"relationships":{}}],"included":[{"file_name":"Example Name","file":"string"}]}` ## Get Investigation Alerts Retrieve alerts linked to a given investigation in Expel Workbench by providing the Investigation ID. ### Endpoint - **URL:** `api/v2/investigations/{{investigation_id}}/expel_alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.investigation_id` | string | Required | Investigation ID. | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"path_parameters":{"investigation_id":"29af0672-7dbe-46e4-96ce-69a2c3ac2b9b"}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `included` | array | Output field: included | | `included.file_name` | string | Name of the resource | | `included.file` | string | Output field: included.file | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/vnd.api+json","Transfer-Encoding":"chunked","Connection":"keep-alive","Date":"Thu, 02 May 2024 05:49:00 GMT","Vary":"Accept-Encoding","x-expelinc-req-id":"3624cae4-bb19-45f3-9155-68cbf5473522","Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, PATCH, DELETE, OPTIONS","Access-Control-Allow-Headers":"","Cache-Control":"private, must-revalidate, max-age=0","Expires":"Thu, 01 Jan 1970 00:00:00","Server":"ngi...` ## Get Investigation Findings Retrieve findings linked to a specific investigation in Expel Workbench by providing the Investigation ID. ### Endpoint - **URL:** `api/v2/investigations/{{investigation_id}}/findings` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.investigation_id` | string | Required | Investigation ID. | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"path_parameters":{"investigation_id":"29af0672-7dbe-46e4-96ce-69a2c3ac2b9b"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.title` | string | Response data | | `data.attributes.finding` | object | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.attributes.deleted_at` | object | Response data | | `data.attributes.rank` | number | Response data | | `data.attributes.finding_type` | object | Response data | | `data.attributes.finding_data` | object | Response data | | `data.links` | object | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string","page":{"offset":123,"limit":123,"total":123}},"links":{"self":"string"},"data":[{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{},"links":{},"relationships":{}}],"included":[{"file_name":"Example Name","file":"string"}]}` ## Get Investigation Remediations Retrieve remediation records for a given Investigation ID in Expel Workbench. This action requires the investigation\_id as a path parameter. ### Endpoint - **URL:** `api/v2/investigations/{{investigation_id}}/remediation_actions` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.investigation_id` | string | Required | Investigation ID. | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"path_parameters":{"investigation_id":"29af0672-7dbe-46e4-96ce-69a2c3ac2b9b"}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.status` | string | Response data | | `data.attributes.action` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.attributes.status_updated_at` | string | Response data | | `data.attributes.deleted_at` | object | Response data | | `data.attributes.template_name` | string | Response data | | `data.attributes.version` | string | Response data | | `data.attributes.action_type` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/vnd.api+json","Transfer-Encoding":"chunked","Connection":"keep-alive","Date":"Wed, 01 May 2024 11:02:19 GMT","Vary":"Accept-Encoding","x-expelinc-req-id":"608e7985-0a1d-410a-9ac4-5df1b9bd0a62","Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, PATCH, DELETE, OPTIONS","Access-Control-Allow-Headers":"","Cache-Control":"private, must-revalidate, max-age=0","Expires":"Thu, 01 Jan 1970 00:00:00","Server":"ngi...` ## Get Investigations Retrieve a list of investigation records from Expel Workbench to review security incidents and their statuses. ### Endpoint - **URL:** `api/v2/investigations` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead expel alert relationship containing an expel alert. The Expel Alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"parameters":{"filter":[{"field":"string","relationship_field":"string","operator":"string","value":"string"}],"include":"string","sorting":"string","page":[{"field":"string","value":123}],"flag":[{"field":"string","value":"string"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.analyst_severity` | object | Response data | | `data.attributes.title` | string | Response data | | `data.attributes.decision` | string | Response data | | `data.attributes.is_incident` | boolean | Response data | | `data.attributes.threat_type` | object | Response data | | `data.attributes.attack_vector` | object | Response data | | `data.attributes.detection_type` | object | Response data | | `data.attributes.attack_timing` | object | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string","page":{"offset":123,"limit":123,"total":123}},"links":{"self":"string"},"data":[{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{},"links":{},"relationships":{}}],"included":[{"file_name":"Example Name","file":"string"}]}` ## Get Security Devices Retrieve a detailed list of security devices, including type and status, from Expel Workbench. ### Endpoint - **URL:** `api/v2/security_devices` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"parameters":{"filter":[{"field":"name","relationship_field":"","operator":"^","value":"M"},{"field":"device_type","relationship_field":"","operator":":","value":"CLOUD"}],"include":"investigative_actions,organization","sorting":"name,-created_at","page":[{"field":"limit","value":1}],"flag":[{"field":"scope","value":"is_assigned_to_a_user"},{"field":"consistency_mode","value":"eventual"}]}}` ### Output | **Parameter** | **Type** | **Description** | | ----------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.name` | string | Response data | | `data.attributes.location` | string | Response data | | `data.attributes.status` | string | Response data | | `data.attributes.device_type` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.updated_at` | string | Response data | | `data.attributes.status_updated_at` | string | Response data | | `data.attributes.device_spec` | object | Response data | | `data.attributes.plugin_slug` | string | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string","page":{"offset":123,"limit":123,"total":123}},"links":{"self":"string"},"data":[{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{},"links":{},"relationships":{}}],"included":[{"file_name":"Example Name","file":"string"}]}` ## Get Vendor Alerts Retrieve a comprehensive list of vendor alerts from Expel Workbench to overview security notifications. ### Endpoint - **URL:** `api/v2/vendor_alerts` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"parameters":{"filter":[{"field":"string","relationship_field":"string","operator":"string","value":"string"}],"include":"string","sorting":"string","page":[{"field":"string","value":123}],"flag":[{"field":"string","value":"string"}]}}` ### Output | **Parameter** | **Type** | **Description** | | -------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `meta.page` | object | Output field: meta.page | | `meta.page.offset` | number | Output field: meta.page.offset | | `meta.page.limit` | number | Output field: meta.page.limit | | `meta.page.total` | number | Output field: meta.page.total | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | array | Response data | | `data.file_name` | string | Response data | | `data.file` | string | Response data | | `included` | array | Output field: included | | `included.file_name` | string | Name of the resource | | `included.file` | string | Output field: included.file | ### Output Example `{"status_code":200,"response_headers":{"Content-Type":"application/vnd.api+json","Transfer-Encoding":"chunked","Connection":"keep-alive","Date":"Wed, 01 May 2024 23:18:59 GMT","Vary":"Accept-Encoding","x-expelinc-req-id":"131d107e-d777-43da-a5f1-db7e9965c020","Access-Control-Allow-Origin":"*","Access-Control-Allow-Methods":"GET, POST, PATCH, DELETE, OPTIONS","Access-Control-Allow-Headers":"","Cache-Control":"private, must-revalidate, max-age=0","Expires":"Thu, 01 Jan 1970 00:00:00","Server":"ngi...` ## Update Alerts Update specific fields and relationships for an alert in Expel Workbench using the provided Expel Alert ID. ### Endpoint - **URL:** `api/v2/expel_alerts/{{expel_alert_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ---------------------------------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------- | | `path_parameters.expel_alert_id` | string | Required | Expel Alert ID. | | `data` | object | Optional | Response data | | `data.attributes` | object | Optional | Response data | | `data.attributes.expel_severity` | string | Optional | Expel alert severity. | | `data.attributes.alert_type` | string | Optional | Expel alert type. Allows null value also. | | `data.attributes.close_comment` | string | Optional | Expel alert close comment. Allows empty string or null. | | `data.attributes.close_reason` | string | Optional | Expel alert close reason. | | `data.attributes.cust_disp_alerts_in_critical_incidents_count` | number | Optional | Allows null value. | | `data.attributes.cust_disp_alerts_in_incidents_count` | number | Optional | Allows null value. | | `data.attributes.cust_disp_alerts_in_investigations_count` | number | Optional | Allows null value. | | `data.attributes.cust_disp_closed_alerts_count` | number | Optional | Allows null value. | | `data.attributes.cust_disp_disposed_alerts_count` | number | Optional | Allows null value. | | `data.attributes.disposition_alerts_in_incidents_count` | number | Optional | Allows null value. | | `data.attributes.disposition_alerts_in_investigations_count` | number | Optional | Allows null value. | | `data.attributes.disposition_closed_alerts_count` | number | Optional | Allows null value. | | `data.attributes.disposition_disposed_alerts_count` | number | Optional | Allows null value. | | `data.attributes.disposition_alerts_in_critical_incidents_count` | number | Optional | Allows null value. | | `data.attributes.expel_alias_name` | string | Optional | Expel alert alias. Allows empty string or null. Length of the string must be less than or equal to 128 characters. | | `data.attributes.expel_message` | string | Optional | Expel alert message. Allows empty string or null. | | `data.attributes.expel_name` | string | Optional | Expel alert name. Allows empty string or null. | | `data.attributes.expel_signature_id` | string | Optional | Expel alert signature. Allows empty string or null. Length of the string must be less than or equal to 128 characters. | | `data.attributes.expel_version` | string | Optional | Expel alert version. Allows empty string or null. Length of the string must be less than or equal to 40 characters. | | `data.attributes.git_rule_url` | string | Optional | URL to rule definition for alert. Allows empty string or null. | | `data.attributes.rapid_triage_priority` | string | Optional | Expel alert rapid triage priority. | | `data.attributes.ref_event_id` | string | Optional | Referring event id. Allows null value. | ### Input Example `{"path_parameters":{"expel_alert_id":"44cdc7ea-b5a3-496d-b373-6f440ae0afd4"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------------ | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | object | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.alert_type` | string | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.expel_name` | string | Response data | | `data.attributes.expel_severity` | string | Response data | | `data.attributes.expel_version` | string | Response data | | `data.attributes.expel_alias_name` | string | Response data | | `data.attributes.expel_signature_id` | string | Response data | | `data.attributes.expel_message` | string | Response data | | `data.attributes.ref_event_id` | string | Response data | | `data.attributes.status` | string | Response data | | `data.attributes.close_reason` | string | Response data | | `data.attributes.close_comment` | string | Response data | | `data.attributes.vendor_alert_count` | number | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string"},"links":{"self":"string"},"data":{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{"alert_type":"string","created_at":"string","expel_name":"Example Name","expel_severity":"string","expel_version":"string","expel_alias_name":"Example Name","expel_signature_id":"string","expel_message":"string","ref_event_id":"string","status":"active","close_reason":"string","close_comment":"string","vendor_alert_count":123,"activ...` ## Update Investigation Update fields and relationships for an existing investigation in Expel Workbench using the provided Investigation ID. ### Endpoint - **URL:** `api/v2/investigations/{{investigation_id}}` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------------------------- | -------- | ------------ | -------------------------------------------------------------------------------------------------------------------- | | `path_parameters.investigation_id` | string | Required | Parameters for the Update Investigation action | | `data` | object | Optional | Response data | | `data.attributes` | object | Optional | Response data | | `data.attributes.analyst_severity` | string | Optional | Analyst Severity. Allows null value. | | `data.attributes.title` | string | Optional | Allows empty string or null value. Length of the string must be less than or equal to 128 characters. | | `data.attributes.attack_timing` | string | Optional | Attack Timing. Allows null value. | | `data.attributes.attack_vector` | string | Optional | Attack Vector. Allows null value. | | `data.attributes.close_comment` | string | Optional | Close Comment. Allows empty string or null value. | | `data.attributes.critical_comment` | string | Optional | Critical Comment. Allows empty string or null value. | | `data.attributes.decision` | string | Optional | Decision. Allows null value. | | `data.attributes.detection_type` | string | Optional | Detection Type. Allows null value. | | `data.attributes.initial_attack_vector` | string | Optional | Initial attack vector. Allows empty string or null value. | | `data.attributes.is_downgrade` | boolean | Optional | Is Downgrade. | | `data.attributes.is_incident` | boolean | Optional | Is Incident. | | `data.attributes.is_surge` | boolean | Optional | Is Surge. | | `data.attributes.last_published_value` | string | Optional | Last Published Value. Allows empty string or null value. | | `data.attributes.malware_family` | string | Optional | Malware family. Allows empty string or null value. | | `data.attributes.next_steps` | string | Optional | Recommended next steps for starting this investigation or handling this incident. Allows empty string or null value. | | `data.attributes.open_reason` | string | Optional | Open Reason. Allows null value. | | `data.attributes.open_summary` | string | Optional | Reason the investigation/incident was opened. Allows empty string or null value. | | `data.attributes.source_reason` | string | Optional | Source Reason. Allows null value. | | `data.attributes.threat_type` | string | Optional | Threat Type. Allows null value. | ### Input Example `{"path_parameters":{"investigation_id":"29af0672-7dbe-46e4-96ce-69a2c3ac2b9b"}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `jsonapi` | object | Output field: jsonapi | | `jsonapi.version` | string | Output field: jsonapi.version | | `meta` | object | Output field: meta | | `meta.reqId` | string | Unique identifier | | `links` | object | Output field: links | | `links.self` | string | Output field: links.self | | `data` | object | Response data | | `data.type` | string | Response data | | `data.id` | string | Response data | | `data.attributes` | object | Response data | | `data.attributes.created_at` | string | Response data | | `data.attributes.analyst_severity` | object | Response data | | `data.attributes.title` | string | Response data | | `data.attributes.decision` | object | Response data | | `data.attributes.is_incident` | boolean | Response data | | `data.attributes.threat_type` | object | Response data | | `data.attributes.attack_vector` | object | Response data | | `data.attributes.detection_type` | object | Response data | | `data.attributes.attack_timing` | object | Response data | | `data.attributes.attack_lifecycle` | object | Response data | | `data.attributes.close_comment` | object | Response data | | `data.attributes.updated_at` | string | Response data | | `data.attributes.critical_comment` | object | Response data | ### Output Example `{"jsonapi":{"version":"string"},"meta":{"reqId":"string"},"links":{"self":"string"},"data":{"type":"string","id":"12345678-1234-1234-1234-123456789abc","attributes":{"created_at":"string","analyst_severity":{},"title":"string","decision":{},"is_incident":true,"threat_type":{},"attack_vector":{},"detection_type":{},"attack_timing":{},"attack_lifecycle":{},"close_comment":{},"updated_at":"string","critical_comment":{},"lead_description":{},"source_reason":"string"},"links":{"self":"string"},"relat...` ## Update Investigative Actions Update document fields and relationships in Expel Workbench using the investigation ID, with optional related resources in the response. ### Endpoint - **URL:** `/api/v2/investigations/{{investigation_id}}/investigative_actions` - **Method:** `PATCH` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | -------------------------------------- | -------- | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `path_parameters.investigation_id` | string | Required | Investigation ID. | | `parameters.activity_authorised` | boolean | Optional | Verify Investigative action is authorized. | | `parameters.activity_verified_by` | string | Optional | Verify Investigative action is authorized. | | `parameters.results` | string | Optional | The result of the investigative action. | | `parameters.filter` | array | Optional | Each model has attributes as detailed in the resources documentation. Most attributes on most resources are filterable. | | `parameters.filter.field` | string | Required | The field you want to filter. | | `parameters.filter.relationship_field` | string | Optional | Each object may contain relationships. The relationships exist in response.data\[].relationships. You can filter based on relationship attributes.I.e. The investigation model contains the lead\_expel\_alert relationship containing an expel\_alert. The expel\_alert model has the attribute created\_at. You can filter attributes of a relationship from the investigations API endpoint. | | `parameters.filter.operator` | string | Optional | A single character operator. | | `parameters.filter.value` | string | Required | The operand value. | | `parameters.include` | string | Optional | Allows you to specify which relationship records you want included in the response. This is useful when you are querying for a record, and want to resolve specific relationship data without making multiple calls. | | `parameters.sorting` | string | Optional | Allows you to sort by a particular attribute of a resource. Each field may be prefixed by a + or - to signify ascending or descending sorts respectively. | | `parameters.page` | array | Optional | Pagination in the Workbench API uses an limit/offset system. | | `parameters.page.field` | string | Required | Field can take offset/limit, the limit is defaulted to 50 if not supplied.The limit may be set to zero. This is useful if your api client needs a count of records without needing to retrieve the actual content of those records.The record offset is defaulted to 0 if not supplied. | | `parameters.page.value` | number | Required | Limit/Offset value. | | `parameters.flag` | array | Optional | In addition to filter query parameter, as specified by the jsonapi spec, API supports a custom API query parameter of flags that allows callers to pass variables to the backend. | | `parameters.flag.field` | string | Required | The Flag field take variables which are defined on a resource by resource basis, and will alter the behavior of a given API call also take scope enables callers to specify scopes for resources backed by Sequelize. When adding a scope that should be accessible from the API, after adding the scope to the scopes object in the resource model definition, add the scope's name to the api\_scopes array to allow it to be accessible via API. | | `parameters.flag.value` | string | Required | It will take variable values or scope's name. | ### Input Example `{"path_parameters":{"investigation_id":"29af0672-7dbe-46e4-96ce-69a2c3ac2b9b"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | ### Output Example `{"status_code":200,"response_headers":{"content-length":"140","content-type":"application/json","Date":"Thu, 13 Dec 2024 20:37:23 GMT"},"reason":"OK","json_body":{}}` # Response Headers | **Header** | **Description** | **Example** | | ---------------------------- | ---------------------------------------------------------- | ----------------------------------------------------------------------------------- | | Access-Control-Allow-Headers | HTTP response header: Access-Control-Allow-Headers | | | Access-Control-Allow-Methods | HTTP response header: Access-Control-Allow-Methods | GET, POST, PATCH, DELETE, OPTIONS | | Access-Control-Allow-Origin | HTTP response header: Access-Control-Allow-Origin | \* | | Cache-Control | Directives for caching mechanisms | private, must-revalidate, max-age=0 | | Connection | HTTP response header: Connection | keep-alive | | Content-Encoding | HTTP response header: Content-Encoding | gzip | | content-length | The length of the response body in bytes | 140 | | Content-Type | The media type of the resource | application/vnd.api+json | | Date | The date and time at which the message was originated | Wed, 01 May 2024 11:02:19 GMT | | Expires | The date/time after which the response is considered stale | Thu, 01 Jan 1970 00:00:00 | | Server | Information about the software used by the origin server | nginx | | Set-Cookie | HTTP response header: Set-Cookie | INGRESSCOOKIE=637caf9c-954d-4139-bb36-0888c3f35317; Path=/; Same-Site=Lax; HttpOnly | | Strict-Transport-Security | HTTP response header: Strict-Transport-Security | max-age=31536000; includeSubDomains | | Transfer-Encoding | HTTP response header: Transfer-Encoding | chunked | | Vary | HTTP response header: Vary | Accept-Encoding | | x-expelinc-req-id | HTTP response header: x-expelinc-req-id | 28db8312-caad-4516-b8cb-2d147c62f197 | | X-Request-ID | A unique identifier for the request | b43c851b-12a5-4568-a4b8-85edc057c46e |