But what grab my attention is the quick detection and response to security threats Expel provides. It’s saved a bunch of time in monitoring threats and even in incident response. This has also integrated nicely with our existing SIEM tools, so we haven’t had to make major changes to how we currently run. Furthermore their team insights and recommendations have allowed us to be a bit more proactive about security management.

Without a doubt, I like Expel because it provides quite detailed actionable insights in order to make fast decisions. It is integrated with our other systems well enough so we have all our security related information in one place. I like how it’s able to deliver automatic threat detection, fast updates. In addition, being easy to use, the platform enables less experienced team members to handle it without requiring much training.

The Expel team has a solid set of skills that span a reasonable breadth of what you would expect to find in a Security Operations organization and delivered via a technology platform that is both flexible and powerful. While implementation isn't necessarily simple, it is fairly straight-forward and what you would expect when looking at a service that needs to ingest things like various security platform logs. The documentation can be a mixed bag - some of the articles are fantastic and provide great details about the topics, while others feel outdated as a result of changes outside of Expel's control (e.g. when Google makes changes to how logging works, there is a lag to when Expel's documentation is updated to reflect those changes). Overall, Expel has done a great job of keeping up with our environment in terms of triaging and dispositioning alerts that come into the service. They have been responsive to additional context and information provided by our team as well. One of the key areas of strength for Expel historically has been their responsiveness to support requests from our team. In the past, these requests were quickly acknowledged and the appropriate support resources are deployed to help. More recently, this experience has been less consistent and less straightforward, in part due to changes in how support gets engaged. That said, Expel has observed and identified the unexpected downsides to some of the recent changes, and they have made a point of working directly with customers to improve it. That is a promising approach that will, hopefully, lead to a more seamless and easier support experience.