Expel Outage History

Started Sep 22, 2026, 03:26 PM UTC· resolved Sep 22, 2026, 09:03 PM UTC

1. investigating Sep 22, 2026, 03:26 PM UTC

   At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 12:30PM ET.

2. investigating Sep 22, 2026, 04:21 PM UTC

   At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 1:30PM ET.

3. investigating Sep 22, 2026, 05:28 PM UTC

   At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 2:30PM ET.

4. investigating Sep 22, 2026, 06:24 PM UTC

   At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 3:30PM ET.

5. monitoring Sep 22, 2026, 07:13 PM UTC

   We have implemented a fix and believe the incident to be resolved. We are monitoring the health of the infrastructure and will resolve this if there are no outstanding issues. Please let us know if you are experiencing any problems.

6. resolved Sep 22, 2026, 09:03 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Aug 30, 2026, 09:43 AM UTC· resolved Aug 30, 2026, 07:53 PM UTC

1. identified Aug 30, 2026, 09:43 AM UTC

   Emails from Workbench are delayed since 12am UTC. We have identified the root cause and are working on a remediation. Phishing outcome responses, User Email notifications, and Org-Level Email Ticketing notifications are delayed since 12am UTC. SOC operations and alert ingestion are not affected. We will provide another update by 12:30pm UTC

2. identified Aug 30, 2026, 11:10 AM UTC

   We have identified the cause are continuing to work on remediation. We have also confirmed that due to this issue, when someone submits a suspected phishing email, the email will not reach Workbench for review. Next update at 1pm UTC.

3. identified Aug 30, 2026, 12:58 PM UTC

   We are continuing to work on remediation. MDR services are unaffected. Alert ingestion, detection, and investigation are operating normally. Slack, Microsoft Teams, PagerDuty, Opsgenie, and Service Now notifications are still being delivered. Email delivery from Workbench remains unavailable. No action is required at this time; we will confirm resubmission steps for phishing submissions once service is restored. Next update: Monday, 31 August at 13:00 UTC (9:00 AM ET)

4. monitoring Aug 30, 2026, 06:14 PM UTC

   Email delivery from Workbench is now working and emails in the queue are being replayed. An update will be posted once the replay is complete.

5. resolved Aug 30, 2026, 07:53 PM UTC

   This issue is resolved. Email delivery from Workbench has been restored, and phishing email submissions are processing normally. Suspected phishing emails submitted during this time were not received by Expel and could not be processed. Please ask your users to resubmit anything they reported during this period. Notification emails generated during this time have been delivered. Some may arrive later than the timestamp they were originally generated.

Read the full incident report →

Started Jul 17, 2026, 02:21 AM UTC· resolved Jul 17, 2026, 03:01 AM UTC

1. investigating Jul 17, 2026, 02:21 AM UTC

   At 9:58pm EDT, we began experiencing a problem with the Workbench database that is preventing users from accessing Workbench. We will provide an update by 11pm EDT.

2. monitoring Jul 17, 2026, 02:34 AM UTC

   We have implemented a fix and believe the incident to be resolved. We are monitoring the health of the infrastructure and will resolve this if there are no outstanding issues. Please let us know if you are experiencing any problems.

3. resolved Jul 17, 2026, 03:01 AM UTC

   The incident has been resolved, and all systems are once again fully available. No customer data was lost; SOC operations were impacted, but are back to normal.

Read the full incident report →

Started Jul 13, 2026, 08:20 PM UTC· resolved Aug 12, 2026, 05:47 PM UTC

1. investigating Jul 13, 2026, 08:20 PM UTC

   On June 18th, a change was made in Expel's environment that inadvertently introduced logic that silently indexed vendor alerts. This change was reverted in order to restore alerting as soon as it was identified on July 1st. Our team has identified several alerts that occurred during the impacted service period within a number of customer environments that we are replaying. If any incidents surface, impacted customers will be notified via Workbench. In the meantime please do not hesitate to reach out to our team with any questions.

2. resolved Aug 12, 2026, 05:47 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 18, 2026, 08:37 PM UTC· resolved Jun 18, 2026, 11:28 PM UTC

1. investigating Jun 18, 2026, 08:37 PM UTC

   At 2pm ET, we began experiencing a problem with our notification system that is causing notification delays to our customers. We will provide an update by 5pm ET.

2. identified Jun 18, 2026, 09:05 PM UTC

   We've identified the cause of the delayed notifications as an issue with a third-party notification vendor. A fix is currently being applied. Workbench notifications have been delayed since 19:09 UTC, and we'll provide another update at 21:30 UTC.

3. identified Jun 18, 2026, 09:35 PM UTC

   Workbench notifications continue to be delayed since 19:09 UTC due to an issue with a third-party notification vendor. They are working on a fix. All delayed notifications will be processed once the outage is resolved. Next update 22:00 UTC

4. monitoring Jun 18, 2026, 10:13 PM UTC

   The cause of the notification delays has been resolved and we are observing delayed messages being delivered. All delayed notifications will be processed and we will continue to monitor.

5. resolved Jun 18, 2026, 11:28 PM UTC

   All delayed messages have been delivered and the notifications system is fully operational.

Read the full incident report →

Started Jun 17, 2026, 11:11 PM UTC· resolved Jun 18, 2026, 01:29 PM UTC

1. investigating Jun 17, 2026, 11:11 PM UTC

   We are investigating an issue affecting the processing of phishing submissions. Beginning at 19:47 UTC, phishing submissions are not being processed, which is preventing the creation of Phishing Expel Alerts. Suspected phishing emails submitted for review during this period may not yet be analyzed. Our team is actively working to identify the cause. We will provide an update by 00:00 UTC.

2. investigating Jun 18, 2026, 12:07 AM UTC

   We are continuing to investigate this issue

3. investigating Jun 18, 2026, 12:59 AM UTC

   We are continuing to investigate this issue. Will post another update in 60 minutes.

4. investigating Jun 18, 2026, 02:12 AM UTC

   We think we have identified the problem and are working on a resolution right now. Will update again in 60 minutes.

5. investigating Jun 18, 2026, 03:17 AM UTC

   Beginning at 19:47 UTC, phishing submissions are not being processed, which is preventing the creation of Phishing Expel Alerts. Suspected phishing emails submitted for review during this period may not yet be analyzed. We've identified the cause and we are working with the vendor to address the issue. We expect to retrieve and process them once service is restored.

6. resolved Jun 18, 2026, 01:29 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 17, 2026, 04:16 PM UTC· resolved Jun 17, 2026, 04:59 PM UTC

1. investigating Jun 17, 2026, 04:16 PM UTC

   At 10am ET, we began experiencing a problem with alert ingestion for some AWS Cloudtrail devices. We will provide an update by 1pm ET.

2. monitoring Jun 17, 2026, 04:37 PM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Jun 17, 2026, 04:59 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jun 09, 2026, 03:40 PM UTC· resolved Jun 09, 2026, 05:33 PM UTC

1. investigating Jun 09, 2026, 03:40 PM UTC

   Workbench is currently experiencing connectivity issues and may be inaccessible for some users. We are investigating the issue and will provide an update within an hour.

2. investigating Jun 09, 2026, 04:42 PM UTC

   Workbench is still experiencing connectivity issues. We are still investigating the issue and will provide an update in 1 hour.

3. monitoring Jun 09, 2026, 05:22 PM UTC

   We have identified the issue, have rolled out a fix and are monitoring the situation.

4. monitoring Jun 09, 2026, 05:24 PM UTC

   We are continuing to monitor for any further issues.

5. resolved Jun 09, 2026, 05:33 PM UTC

   This incident has been resolved.

Read the full incident report →

Started May 13, 2026, 04:23 PM UTC· resolved May 13, 2026, 04:46 PM UTC

1. identified May 13, 2026, 04:23 PM UTC

   We are aware of an issue with the Expel Alerts count being inflated for customers. We have identified the root cause and are working on a remediation. SOC operations and alert ingestion are not affected. We will provide another update by 1pm EDT.

2. identified May 13, 2026, 04:38 PM UTC

   We have remediated the issue with Expel Alerts count being inflated for customers by shifting to a different source of statistics. We are working on fixing the underlying issue with our main source of count data. We will provide another update by 1pm EDT.

3. resolved May 13, 2026, 04:46 PM UTC

   The incident has been resolved, and all alerts counts are once again accurate. No customer data was lost, and SOC operations were not impacted.

Read the full incident report →

Started May 01, 2026, 06:50 PM UTC· resolved May 01, 2026, 08:01 PM UTC

1. investigating May 01, 2026, 06:50 PM UTC

   At 2pm EDT, we began experiencing a problem with the customer device secrets service that is preventing our infrastructure from accessing customer security devices. We will provide an update by 3:30pm EDT.

2. monitoring May 01, 2026, 07:09 PM UTC

   We have implemented a fix and believe the incident to be resolved. We are seeing customer security devices returning to healthy status. We are monitoring the health of the infrastructure and will post another update by 4pm EDT.

3. resolved May 01, 2026, 08:01 PM UTC

   The incident has been resolved, and all systems are once again fully available. No customer data was lost, and all previously-accessible security devices are once again accessible and ingesting alerts.

Read the full incident report →

Started Apr 20, 2026, 04:20 PM UTC· resolved Apr 20, 2026, 08:54 PM UTC

1. investigating Apr 20, 2026, 04:20 PM UTC

   At 10:59AM EDT, we noticed that a set of devices have been unhealthy since last week due to invalid credentials. We believe the cause to be a change to our device credentials storage subsystem. We are working to identify the specific set of devices and restore the credentials. Once restored, all delayed alerts will be ingested. We will provide an updated by 1pm EDT.

2. investigating Apr 20, 2026, 05:00 PM UTC

   We have identified the specific subset of devices that are affected and are working on restoring the credentials for those devices. Once restored, all alerts that have not been ingested for these devices will be ingested. We will provide another update by 1:30pm EDT.

3. investigating Apr 20, 2026, 05:35 PM UTC

   We have identified the specific subset of devices that are affected and are working on restoring the credentials for those devices. Once restored, all alerts that have not been ingested for these devices will be ingested. We will provide another update by 2:00pm EDT.

4. investigating Apr 20, 2026, 06:01 PM UTC

   We have identified the specific subset of devices that are affected and are working on restoring the credentials for those devices. Once restored, all alerts that have not been ingested for these devices will be ingested. We will provide another update by 2:30pm EDT.

5. identified Apr 20, 2026, 06:34 PM UTC

   We have restored the credentials for the affected subset of devices. We are monitoring closely to ensure proper ingestion of delayed alerts. We will provide another update by 3:00pm EDT.

6. identified Apr 20, 2026, 07:02 PM UTC

   We have restored the credentials for the subset of devices. We are monitoring closely to ensure proper ingestion of delayed alerts. We will provide another update by 3:30pm EDT.

7. monitoring Apr 20, 2026, 07:34 PM UTC

   We restored the credentials for the subset of devices, and are seeing that the majority of devices have returned to a healthy state. We are investigating the remaining unhealthy devices, which do not seem related to the credentials. We will provide another update by 4:00pm EDT.

8. monitoring Apr 20, 2026, 08:01 PM UTC

   We restored the credentials for the subset of devices, and are seeing that the majority of devices have returned to a healthy state. We are investigating the remaining unhealthy devices, which do not seem related to credentials. We will provide another update by 4:30pm EDT.

9. resolved Apr 20, 2026, 08:54 PM UTC

   We restored the credentials for the subset of devices, and are seeing that the majority of devices have returned to a healthy state. We investigated the remaining unhealthy devices, which are not related to the customer secrets vault upgrade. This incident is resolved.

Read the full incident report →

Started Mar 24, 2026, 04:58 PM UTC· resolved Mar 24, 2026, 09:12 PM UTC

1. investigating Mar 24, 2026, 04:58 PM UTC

   Notifications are currently not being delivered to Microsoft Teams since 4pm UTC. We are actively investigating to determine and address the root cause. We advise you login to Workbench for timely updates and/or to engage with Expel's SOC until the issue is resolved. Updates will be shared as soon as they are available. We will provide an update by 5:30pm UTC.

2. identified Mar 24, 2026, 05:49 PM UTC

   Update: We have confirmed there are no technical issues with Workbench or with our third party systems that support notifications. Microsoft has since updated its Teams service health to indicate they are investigating a possible issue. We recommend you check your MSFT 365 service health and Microsoft's status page for updates: https://status.cloud.microsoft/m365/referrer=serviceStatusRedirect Until further notice, please continue to login to Workbench for timely updates and/or to engage with Expel's SOC. We will provide notice when Workbench notifications to Teams are operational.

3. monitoring Mar 24, 2026, 09:02 PM UTC

   Update: We are observing a broad recovery in MS Teams message delivery as of 19:10 UTC. However, Microsoft has confirmed that service remains degraded for some users in the West United States region due to ongoing infrastructure optimizations. We are continuing to monitor the situation. Any messages delayed during this incident are being automatically reprocessed for delivery.

4. resolved Mar 24, 2026, 09:12 PM UTC

   Resolved: Microsoft has confirmed that the issues affecting Teams bots and message delivery are now fully resolved. All delayed messages have been reprocessed and delivered. Service is operating normally.

Read the full incident report →

Started Mar 02, 2026, 06:35 PM UTC· resolved Mar 02, 2026, 08:36 PM UTC

1. monitoring Mar 02, 2026, 06:35 PM UTC

   We are currently monitoring an outage affecting the AWS GuardDuty service. As a result of this outage, our integration with AWS GuardDuty is currently reporting as unhealthy. We will provide an update within 60 minutes, or as soon as more information is available.

2. monitoring Mar 02, 2026, 07:36 PM UTC

   We are working on a workaround that will bypass the faulty AWS region in order resume alert ingestion from healthy regions. Once the outage in the faulty region is over, we will resume ingestion in that region. We will provide an update within 60 minutes, or as soon as more information is available.

3. resolved Mar 02, 2026, 08:36 PM UTC

   Workaround is in place, we are bypassing the faulty AWS region and all impacted devices have resumed ingestion. Once the outage in the faulty region is over, we will resume ingestion in that region. Alert Ingestion issue resolved.

Read the full incident report →

Started Feb 02, 2026, 09:00 PM UTC· resolved Feb 02, 2026, 10:33 PM UTC

1. investigating Feb 02, 2026, 09:00 PM UTC

   Expel is investigating an issue with Workbench notifications that may be preventing users from receiving outbound notifications from Workbench to User Email, Email Ticketing, Slack, MS Teams, PagerDuty, and OpsGenie integrations since 19:30 UTC. We will provide an update by 21:30 UTC.

2. identified Feb 02, 2026, 09:15 PM UTC

   We have identified the root cause as an issue with a 3rd party vendor. They are actively working on resolving the issue. We have confirmed that outbound notifications from Workbench have not been delivered to to User Email, Email Ticketing, Slack, MS Teams, PagerDuty, and OpsGenie since 19:30 UTC. These notifications are queued and will be re-sent when the issue is resolved. Alert ingestion is not affected. We will provide another update by 21:30 UTC.

3. identified Feb 02, 2026, 09:41 PM UTC

   Outbound notifications from Workbench to User Email, Email Ticketing, Slack, MS Teams, PagerDuty, and OpsGenie continue to be delayed. We will provide an update by 22:00 UTC.

4. identified Feb 02, 2026, 10:00 PM UTC

   Outbound notifications from Workbench to User Email, Email Ticketing, Slack, MS Teams, PagerDuty, and OpsGenie continue to be delayed. We will provide an update by 22:30 UTC.

5. monitoring Feb 02, 2026, 10:12 PM UTC

   We are observing that delayed messages are starting to be delivered. We will monitor the backlog of delayed notifications and the health of the system. We will provide an update by 22:30 UTC.

6. resolved Feb 02, 2026, 10:33 PM UTC

   The incident has been resolved, and all delayed notifications have been delivered. No customer data was lost, and SOC operations were not impacted.

Read the full incident report →

Started Jan 20, 2026, 08:31 PM UTC· resolved Jan 20, 2026, 11:02 PM UTC

1. investigating Jan 20, 2026, 08:31 PM UTC

   At 3:00pm ET, we began experiencing a problem with alert ingestion. We will provide an update by 4:30pm ET.

2. monitoring Jan 20, 2026, 08:54 PM UTC

   A fix has been implemented and we are monitoring the results.

3. resolved Jan 20, 2026, 11:02 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Jan 07, 2026, 07:51 PM UTC· resolved Jan 07, 2026, 10:54 PM UTC

1. investigating Jan 07, 2026, 07:51 PM UTC

   Starting 1/6/25 at roughly 12:00 EST, we have identified an issue with our phishing service where outcome emails are being sent multiple times to some users and are investigating the root cause. Ingestion and email review are not affected. We will provide an update at 4pm EST.

2. identified Jan 07, 2026, 09:11 PM UTC

   We believe we have identified the root cause of duplicate phishing outcome emails and are preparing a hotfix. Next update at 5pm EST.

3. monitoring Jan 07, 2026, 10:00 PM UTC

   The hotfix for duplicate phishing outcomes has been deployed and we are monitoring. Next update at 6pm EST.

4. resolved Jan 07, 2026, 10:54 PM UTC

   The hotfix for phishing submission outcome emails was successful and behavior has returned to normal. This incident is resolved.

Read the full incident report →

Started Dec 29, 2025, 09:26 PM UTC· resolved Dec 29, 2025, 10:09 PM UTC

1. investigating Dec 29, 2025, 09:26 PM UTC

   At 3:17, we began experiencing a problem with enrichment service that is impacting detections. We will provide an update by 4:45.

2. monitoring Dec 29, 2025, 09:49 PM UTC

   We have identified and implemented a fix and are monitoring; service queues are approaching normal.

3. resolved Dec 29, 2025, 10:09 PM UTC

   Detection pipelines are caught up. Service is nominal.

Read the full incident report →

Started Nov 18, 2025, 03:34 PM UTC· resolved Nov 19, 2025, 06:17 PM UTC

1. identified Nov 18, 2025, 03:34 PM UTC

   Workbench cannot currently deliver notifications to Microsoft Teams. The issue began around 9:45am ET. Expel is actively investigating the issue to determine if it is related to the larger Cloudflare outage. We recommend you utilize email notifications in the interim, and can confirm communicating with Expel personnel via Microsoft Teams still works. The issue is specific to Workbench notifications.

2. monitoring Nov 18, 2025, 03:50 PM UTC

   The underlying issue has been resolved We are monitoring the health of the infrastructure and will resolve this if there are no outstanding issues. Please let us know if you are experiencing any problems.

3. resolved Nov 19, 2025, 06:17 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Nov 12, 2025, 03:28 PM UTC· resolved Apr 17, 2026, 01:52 PM UTC

1. identified Nov 12, 2025, 03:28 PM UTC

   We’re upgrading our API connection and that may impact delivery of some alerts to Workbench. We are actively investigating and collaborating on a solution to ensure the consistent and complete delivery of all alert data. Please reach out to Orca if you’d like additional information. Thank you for your patience and understanding as we work through this.

2. resolved Apr 17, 2026, 01:52 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Nov 03, 2025, 04:56 PM UTC· resolved Nov 03, 2025, 07:43 PM UTC

1. investigating Nov 03, 2025, 04:56 PM UTC

   At 10:50am ET, we began experiencing a problem with pivoting to Wiz console that resulting in some degraded analyst triage experience. We will provide an update by 12:50pm ET.

2. investigating Nov 03, 2025, 05:50 PM UTC

   We have reached out to Wiz and waiting to hear back. We will provide an update by 1:50pm ET.

3. monitoring Nov 03, 2025, 06:55 PM UTC

   Analysts are starting to successfully SSO into the Wiz console. We will continue to monitor the situation. We will provide an update by 3:00pm ET.

4. resolved Nov 03, 2025, 07:43 PM UTC

   Analysts are able to successfully SSO into the Wiz console. Incident is closed.

Read the full incident report →

Started Oct 29, 2025, 05:17 PM UTC· resolved Oct 30, 2025, 02:22 AM UTC

1. identified Oct 29, 2025, 05:17 PM UTC

   Microsoft has reported an outage affecting O365 services. As a result of this outage, our integration with O365 is currently reporting as unhealthy. We are actively monitoring this issue and will provide an update within 60 minutes, or as soon as more information is available.

2. identified Oct 29, 2025, 06:13 PM UTC

   Microsoft has reported an outage affecting O365 services. As a result of this outage, our integration with O365 is currently reporting as unhealthy. We are actively monitoring this issue and will provide an update within 60 minutes, or as soon as more information is available.

3. identified Oct 29, 2025, 07:09 PM UTC

   Microsoft has reported an outage affecting O365 services. As a result of this outage, our integration with O365 is currently reporting as unhealthy. We are actively monitoring this issue and will provide an update within 60 minutes, or as soon as more information is available.

4. identified Oct 29, 2025, 08:09 PM UTC

   Microsoft has reported an outage affecting O365 services. As a result of this outage, our integration with O365 is currently reporting as unhealthy. We are actively monitoring this issue and will provide an update within 60 minutes, or as soon as more information is available.

5. monitoring Oct 29, 2025, 08:59 PM UTC

   Our integration with O365 has become healthy. We are currently ingesting and processing a backlog of events and will provide another update in 60 minutes.

6. monitoring Oct 29, 2025, 09:57 PM UTC

   Our integration with O365 has become healthy and the backlog of events have been processed. We will continue to monitor the O365 service outage and will provide updates as they come.

7. resolved Oct 30, 2025, 02:22 AM UTC

   Microsoft has confirmed that the O365 outage has been completely resolved. Our integration with O365 remains healthy and no customer data was lost.

Read the full incident report →

Started Oct 20, 2025, 10:06 AM UTC· resolved Oct 20, 2025, 12:35 PM UTC

1. monitoring Oct 20, 2025, 10:06 AM UTC

   Amazon Web Services reported an outage affecting AWS services in the US-EAST-1 region starting at approximately 06:50am UTC. AWS communicated that it identified the root cause and took mitigation actions, and that it’s seeing significant signs of recovery. This outage is affecting how Expel Workbench ingests and processes alerts, as well as how we communicate with customers. At this time, Expel Workbench is operating normally. Our systems are working through a backlog of security device data.

2. monitoring Oct 20, 2025, 10:33 AM UTC

   We are continuing to monitor. Workbench is working the backlog of alerts. Please note that no customer data was lost as a result of the AWS outage. We will post the next update at 11:00am UTC.

3. monitoring Oct 20, 2025, 11:04 AM UTC

   We are continuing to monitor. Workbench continues to process the backlog of alerts. Amazon reports that it has mitigated the underlying the DNS issue, and most AWS Service operations are succeeding normally now. Please note that no customer data was lost as a result of the AWS outage. We will post the next update at 11:30am UTC.

4. monitoring Oct 20, 2025, 11:31 AM UTC

   We are continuing to monitor. Workbench continues to process the backlog of alerts. Please note that no customer data was lost as a result of the AWS outage. We will post the next update at 12:00pm UTC.

5. monitoring Oct 20, 2025, 11:59 AM UTC

   Expel Workbench is fully operational, has processed the full backlog of alerts, and is ingesting and processing current alerts normally. We will continue to monitor and provide additional updates as necessary.

6. monitoring Oct 20, 2025, 12:24 PM UTC

   We are continuing to monitor for any further issues.

7. resolved Oct 20, 2025, 12:35 PM UTC

   The incident has been resolved, and all systems are once again fully available. No customer data was lost.

Read the full incident report →

Started Oct 17, 2025, 05:55 AM UTC· resolved Oct 17, 2025, 06:59 AM UTC

1. investigating Oct 17, 2025, 05:55 AM UTC

   At 01:09UTC Oct 17th 2025, we began experiencing a problem with an upstream messaging provider that is preventing Workbench from sending automated messages to Microsoft Teams channels. We escalated the incident to the provider. They identified the cause of the problem and are working on a fix. We will provide an update by 06:30am UTC.

2. identified Oct 17, 2025, 05:56 AM UTC

   The issue has been identified and a fix is being implemented.

3. monitoring Oct 17, 2025, 06:13 AM UTC

   The upstream provider confirmed that they resolved the problem. Workbench is now successfully sending messages to Microsoft Teams channels. We will continue to monitor as Workbench retries to send messages that failed because of this issue. We will post an update at 06:30UTC.

4. monitoring Oct 17, 2025, 06:32 AM UTC

   We are continuing to monitor. Workbench continues to successfully send MS Teams messages. We will post the next update at 07:00am UTC.

5. resolved Oct 17, 2025, 06:59 AM UTC

   The incident has been resolved, and all systems are once again fully available. All Microsoft Teams messages from Workbench that failed during the incident have been successfully delivered.

Read the full incident report →

Started Oct 09, 2025, 01:56 PM UTC· resolved Oct 09, 2025, 02:25 PM UTC

1. investigating Oct 09, 2025, 01:56 PM UTC

   At 13:30UTC, we began experiencing a problem with the Alert Analysis Dashboard that is preventing users from seeing metrics on that page only. Alert ingestion & SOC operations are not affected. We will provide an update by 14:30UTC.

2. monitoring Oct 09, 2025, 02:23 PM UTC

   We have implemented a fix and believe the incident to be resolved. We are monitoring the health of the infrastructure and will resolve this if there are no outstanding issues. Please let us know if you are experiencing any problems.

3. resolved Oct 09, 2025, 02:25 PM UTC

   The incident has been resolved and the Alert Analysis Dashboard is once again fully available. No customer data was lost, and SOC operations were not impacted.

Read the full incident report →

Started Oct 08, 2025, 08:59 AM UTC· resolved Oct 08, 2025, 10:50 AM UTC

1. identified Oct 08, 2025, 08:59 AM UTC

   We have identified an issue with a 3rd party vendor that is causing a 10-15 minute delay in sending email, slack and MS Teams notifications from Workbench. Alert ingestion is not affected. Please be aware that this delay applies to all client notifications, such as Verify Actions and New Incident Notifications. There is no other impact to SOC operations. Customers can continue to request support as usual (ticket creation is not affected by this delay).

2. identified Oct 08, 2025, 09:34 AM UTC

   We are continuing to work on a fix for this issue.

3. monitoring Oct 08, 2025, 09:42 AM UTC

   We continue to experience a delay of approximately 10–15 minutes in delivering email, Slack, and Microsoft Teams notifications from Workbench. Our team has escalated the issue with our vendor and is actively monitoring the situation. We’ll provide an update here as soon as we have more information or when service performance returns to normal.

4. monitoring Oct 08, 2025, 10:04 AM UTC

   We are no longer observing delays in delivering email, slack and MS Teams notifications from Workbench. We will continue to monitor for the next hour as we work with our vendor to confirm that the issue is resolved.

5. resolved Oct 08, 2025, 10:50 AM UTC

   We have confirmed that the incident has been resolved. Email, slack and MS Teams notifications from Workbench are being delivered within normal timeframes.

Read the full incident report →