Cribl incident

OAuth secret expressions fail to resolve during authentication after 4.20.0 upgrade

Minor Resolved View vendor source →

Cribl experienced a minor incident on September 16, 2026, lasting 2d 4h. The incident has been resolved; the full update timeline is below.

Started
Sep 16, 2026, 02:52 PM UTC
Resolved
Sep 18, 2026, 07:41 PM UTC
Duration
2d 4h
Detected by Pingoru
Sep 16, 2026, 02:52 PM UTC

Update timeline

  1. investigating Sep 16, 2026, 02:52 PM UTC

    We are currently investigating this issue.

  2. investigating Sep 16, 2026, 03:33 PM UTC

    Investigating: We are continuing to investigate an issue that may prevent OAuth secret expressions on Microsoft Sentinel destinations from resolving during authentication following the 4.20.0 upgrade.

  3. investigating Sep 16, 2026, 04:34 PM UTC

    Update: We are continuing our investigation regarding this issue.

  4. identified Sep 16, 2026, 05:44 PM UTC

    The issue has been identified and a fix is being implemented.

  5. monitoring Sep 16, 2026, 05:57 PM UTC

    We have published a known issue with a workaround for this issue. See https://docs.cribl.io/results/?searchOption=known-issues&tickets=CRIBL-45304

  6. monitoring Sep 16, 2026, 06:23 PM UTC

    Mitigated: We have identified the issue affecting OAuth secret expressions following the 4.20.0 upgrade and published a Known Issue with a workaround. Customers experiencing authentication failures can follow the documented workaround. Known Issue can be found here: https://docs.cribl.io/results/?searchOption=known-issues&tickets=CRIBL-45304

  7. resolved Sep 18, 2026, 07:41 PM UTC

    This incident has been resolved.