Expel Outage History

Started Sep 09, 2025, 01:17 PM UTC· resolved Sep 09, 2025, 01:34 PM UTC

1. identified Sep 09, 2025, 01:17 PM UTC

   There is a known issue with Wiz. This is preventing our ability to triage and investigate Wiz alerts. Wiz have identified the root cause and a fix is being implemented (https://status.wiz.io/). As an interim workaround for impacted customers, we are going to promote/verify any critical or high Wiz alerts that come into the queue

2. identified Sep 09, 2025, 01:22 PM UTC

   We are continuing to work on a fix for this issue.

3. resolved Sep 09, 2025, 01:34 PM UTC

   Wiz have confirmed that they have resolved the issue and our SOC Analysts are now able to triage and investigate Wiz alerts.

Read the full incident report →

Started Aug 20, 2025, 01:24 AM UTC· resolved Aug 20, 2025, 06:11 AM UTC

1. investigating Aug 20, 2025, 01:24 AM UTC

   We are currently investigating an outage affecting the Azure Security Center API. As a result of this outage, our integration with Azure is currently reporting as unhealthy. We will provide an update within 30 minutes, or as soon as more information is available.

2. investigating Aug 20, 2025, 02:10 AM UTC

   We continue to actively investigate the outage affecting the Azure Security Center API. We will provide an update at within 60 minutes, or as soon as more information is available.

3. investigating Aug 20, 2025, 03:03 AM UTC

   We continue to actively investigate the outage affecting the Azure Security Center API. We will provide an update at within 60 minutes, or as soon as more information is available.

4. investigating Aug 20, 2025, 04:05 AM UTC

   We continue to actively investigate the outage affecting the Azure Security Center API. We will provide an update at within 60 minutes, or as soon as more information is available.

5. investigating Aug 20, 2025, 05:20 AM UTC

   We continue to actively investigate the outage affecting the Azure Security Center API. We will provide an update at within two hours, or as soon as more information is available.

6. resolved Aug 20, 2025, 06:11 AM UTC

   The outage affecting the Azure Security Center API has been resolved, and all services are now fully operational. Our security alerts and recommendations are flowing as expected, and our integration with Azure is now reporting as healthy. No customer data was lost.

Read the full incident report →

Started Aug 08, 2025, 10:45 AM UTC· resolved Aug 08, 2025, 04:07 PM UTC

1. investigating Aug 08, 2025, 10:45 AM UTC

   At 2am ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 7:30AM.

2. investigating Aug 08, 2025, 11:23 AM UTC

   We are still investigating. We will provide an update by 8:30AM.

3. investigating Aug 08, 2025, 12:22 PM UTC

   We are still investigating. We will provide an update by 9:30AM.

4. investigating Aug 08, 2025, 01:26 PM UTC

   We are still investigating. We will provide an update by 10:30AM.

5. investigating Aug 08, 2025, 02:17 PM UTC

   Root cause still under investigation but system is recovering. We will provide an update by 11:30am.

6. monitoring Aug 08, 2025, 03:26 PM UTC

   We have identified the root cause. Alert ingestion is recovering. No customer data was lost. We will provide another update by 12:30pm ET.

7. resolved Aug 08, 2025, 04:07 PM UTC

   The incident has been resolved. All systems are once again fully available. No customer data was lost.

Read the full incident report →

Started Jul 09, 2025, 10:32 PM UTC· resolved Jul 09, 2025, 11:37 PM UTC

1. monitoring Jul 09, 2025, 10:32 PM UTC

   We have implemented a fix and believe the incident to be resolved. We are currently processing the backlog. We will provide another update by 7pm ET.

2. monitoring Jul 09, 2025, 11:00 PM UTC

   The backlog is still being processed. We will provide another update by 7:30pm ET.

3. resolved Jul 09, 2025, 11:37 PM UTC

   The backlog has been processed. The incident has been resolved. No customer data was lost, and SOC operations were not impacted.

Read the full incident report →

Started Jun 23, 2025, 09:51 AM UTC· resolved Jun 23, 2025, 08:04 PM UTC

1. investigating Jun 23, 2025, 09:51 AM UTC

   At approximately 4am EDT, we began experiencing a problem with our assembler VPN system that is preventing alerts from being ingested through assemblers. Alert ingestion is delayed for some devices behind an assembler. We will provide an update by 6:30am EDT.

2. identified Jun 23, 2025, 10:30 AM UTC

   We have identified the root cause and are working on a remediation. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 7:00 EDT.

3. identified Jun 23, 2025, 11:00 AM UTC

   We have identified the root cause and are working on a remediation. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 7:30 EDT.

4. identified Jun 23, 2025, 11:47 AM UTC

   We have identified the root cause and are working on a remediation. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 8:00 EDT.

5. identified Jun 23, 2025, 12:07 PM UTC

   We are continuing to work on a fix for this issue.

6. identified Jun 23, 2025, 12:08 PM UTC

   We have identified a further cause and are working on a remediation. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 8:30 EDT.

7. identified Jun 23, 2025, 12:42 PM UTC

   We have identified a further cause and are working on a remediation. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 9:30 EDT.

8. identified Jun 23, 2025, 01:30 PM UTC

   We have identified a further cause and are working on a remediation. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 10:30 EDT.

9. identified Jun 23, 2025, 02:31 PM UTC

   We have identified a further cause and are working on a remediation. Individual assemblers are coming back online. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 11:30 EDT.

10. identified Jun 23, 2025, 03:32 PM UTC

    We have identified a further cause and are working on a remediation. Individual assemblers are coming back online. Alert ingestion via some assemblers continues to be delayed. SOC operations are not affected. We will provide another update by 12:30 EDT.

11. monitoring Jun 23, 2025, 07:50 PM UTC

    We have implemented a fix and believe the incident to be resolved. We are monitoring the health of the infrastructure as individual assemblers come back online, and will resolve this if there are no outstanding issues. Please let us know if you are experiencing any problems. We will provide another update by 4:30pm EDT.

12. resolved Jun 23, 2025, 08:04 PM UTC

    The incident has been resolved, and all previously-available assemblers are once again fully available.

Read the full incident report →

Started Jun 11, 2025, 05:13 PM UTC· resolved Jan 26, 2026, 03:22 PM UTC

1. identified Jun 11, 2025, 05:13 PM UTC

   On May 19th, we temporarily disabled the alert status syncing feature between Expel Workbench and Wiz due to an identified error. Importantly, this does not affect Expel’s ability to deliver MDR services for Wiz. Workbench continues to ingest alerts from Wiz as expected, and our SOC is actively monitoring and responding. We will share an update as soon as the fix is deployed and syncing is re-enabled. Thank you for your understanding.

2. resolved Jan 26, 2026, 03:22 PM UTC

   Resolved - On January 23rd we have fixed and re-enabled alert status syncing between Expel Workbench and Wiz. If alert status syncing is not working as expected, please ensure the required permissions outlined in the Setup Guide are provided.

Read the full incident report →

Started Jun 06, 2025, 01:22 AM UTC· resolved Jun 06, 2025, 02:39 AM UTC

1. identified Jun 06, 2025, 01:22 AM UTC

   At approximately 11:20 am Eastern Time "updated at" metadata for Investigation records were incorrectly altered to a more recent time. This has triggered unintentional notifications to organizations. We are currently working to restore the correct "updated at" metadata for these records

2. monitoring Jun 06, 2025, 02:12 AM UTC

   We have corrected the incorrect "updated at" metadata for investigation records and we are currently monitoring system activity.

3. resolved Jun 06, 2025, 02:39 AM UTC

   We have restored the correct "updated at" metadata for these records. No further unintentional notifications should be triggered.

Read the full incident report →

Started May 13, 2025, 06:37 PM UTC· resolved May 13, 2025, 10:07 PM UTC

1. investigating May 13, 2025, 06:37 PM UTC

   We are actively investigating intermittent service degradation to Workbench investigative and remediation actions. Customers may not be able to access some sections of the portal as a side effect. We will provide an update at 3 PM ET

2. investigating May 13, 2025, 07:08 PM UTC

   While we have isolated the system with degraded performance, we continue the technical triage of the issue to determine the root case and restore full service as quickly as possible. We will provide an update at 4 PM ET

3. monitoring May 13, 2025, 07:32 PM UTC

   We have resolved the root issue and our workbench actions capabilities have fully resumed normal operations as of 3:15 pm ET

4. resolved May 13, 2025, 10:07 PM UTC

   The incident has been resolved, and Workbench investigative and remediation actions are fully available.

Read the full incident report →

Started Apr 14, 2025, 03:44 PM UTC· resolved Apr 14, 2025, 04:21 PM UTC

1. monitoring Apr 14, 2025, 03:44 PM UTC

   At 11:16AM ET, we began experiencing a problem with Workbench that is preventing users from accessing Workbench. We have identified the root cause and are working on a remediation. We have rolled out a previous, working version of Workbench and service has been restored. SOC operations were affected, but alert ingestion was not affected. We will continue monitoring and provide another update by 12:30pm ET.

2. resolved Apr 14, 2025, 04:21 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Apr 10, 2025, 09:02 PM UTC· resolved Apr 11, 2025, 08:09 PM UTC

1. investigating Apr 10, 2025, 09:02 PM UTC

   We are experiencing an unexpected surge in alert volume, impacting our analysts’ ability to triage alerts for customers. We are working to identify and address the root cause. In the meantime, you may experience an increase in notification volume. We are prioritizing the most critical alerts. We will provide an update by 5:30pm ET.

2. monitoring Apr 10, 2025, 09:22 PM UTC

   We have identified and remediated the root cause of the alert volume surge. Volume has now returned to normal levels, and we are actively triaging backlogged and new alerts. We are continuing to prioritize the most critical alerts. We will provide another update by 6:00pm ET.

3. monitoring Apr 10, 2025, 10:12 PM UTC

   System remains fully operational. We are continuing to triage both backlogged and new alerts, with a focus on the most critical. Alert volume has stabilized, and our analysts are working through the backlog to ensure no critical issues are missed. We’ll share another update by 7:00PM ET.

4. monitoring Apr 10, 2025, 10:59 PM UTC

   System remains fully operational. We are continuing to triage both backlogged and new alerts, with a focus on the most critical. Alert volume has stabilized, and our analysts are working through the backlog to ensure no critical issues are missed. We’ll share another update by 8:00PM ET.

5. monitoring Apr 10, 2025, 11:56 PM UTC

   System remains fully operational. We are continuing to triage both backlogged and new alerts, with a focus on the most critical. Alert volume remains stable, and our analysts are working through the backlog to ensure no critical issues are missed. We'll share another update by 9:00PM ET.

6. monitoring Apr 11, 2025, 12:59 AM UTC

   System remains fully operational. We are continuing with normal operations for triaging new alerts. Alert volume remains stable, and our analysts are working through the backlog to ensure no issues are missed. We'll share another update when all backlog alerts have been processed.

7. resolved Apr 11, 2025, 08:09 PM UTC

   System remains fully operational. We are continuing with normal operations for triaging new alerts. Alert volume remains stable. All alerts ingested during the surge have been reviewed.

Read the full incident report →

Started Mar 27, 2025, 09:29 PM UTC· resolved Apr 28, 2025, 02:32 PM UTC

1. identified Mar 27, 2025, 09:29 PM UTC

   As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device will have coverage restored shortly and begin reprocessing alerts. We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. We will provide a status update once we have enabled all onboarded Defender XDR devices. In the meantime, please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.

2. monitoring Mar 27, 2025, 10:40 PM UTC

   We have confirmed all Microsoft Defender XDR devices are enabled and ingesting data, and we are working to reprocess alerts. We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench) Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.

3. monitoring Mar 28, 2025, 01:38 PM UTC

   As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device have coverage and alerts are being processed. We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench). Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.

4. resolved Apr 28, 2025, 02:32 PM UTC

   As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device have coverage and alerts are being processed. We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench). Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.

Read the full incident report →

Started Mar 26, 2025, 08:41 PM UTC· resolved Mar 26, 2025, 11:00 PM UTC

1. investigating Mar 26, 2025, 08:41 PM UTC

   We are aware of intermittent login failures for Workbench. We are actively investigating. We will provide an update at 5:30 EST.

2. monitoring Mar 26, 2025, 08:58 PM UTC

   We have identified the issue and issued a fix.

3. resolved Mar 26, 2025, 11:00 PM UTC

   This incident has been resolved.

Read the full incident report →

Started Mar 14, 2025, 07:41 PM UTC· resolved Mar 17, 2025, 02:01 PM UTC

1. investigating Mar 14, 2025, 07:41 PM UTC

   We have identified a problem that is preventing Office 365 users from reporting phishing emails to Expel via Outlook. We will provide an update by 4:30PM EDT.

2. investigating Mar 14, 2025, 08:32 PM UTC

   We are continuing to investigate this issue and will provide an update by 5:00PM EDT.

3. investigating Mar 14, 2025, 09:02 PM UTC

   We are continuing to investigate this issue and will provide an update by 5:30PM EDT.

4. investigating Mar 14, 2025, 09:37 PM UTC

   We are continuing to investigate this issue and will provide an update by 6:30PM EDT.

5. identified Mar 14, 2025, 10:30 PM UTC

   We have identified a potential root cause and are working on a remediation. The Office 365 Phishing Button continues to be degraded. We will provide another update as soon as possible.

6. identified Mar 15, 2025, 12:59 PM UTC

   Phishing submissions continue to be degraded for a small number of customers that use the custom Expel Office 365 button. We have identified the root cause and will be rolling out an update as soon as possible. If your button isn’t working, talk directly with your Customer Success Manager (CSM), who will be able to offer you direct & tailored support as we work to resolve this. Alternatively, you can submit phishing emails manually. Visit our Help Center for step-by-step instructions.

7. identified Mar 17, 2025, 12:04 AM UTC

   Microsoft is rolling out deprecation of legacy Exchange tokens that may prevent your users from being able to report emails using the Expel custom Office 365 Phishing button. Expel is working on development and testing of an updated Expel O365/M365 Phishing button for web and desktop applications that will work with the NAA authentication scheme. Until Expel is able to deploy the newly developed Phishing button, you should follow the instructions from Microsoft (https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/turn-exchange-tokens-on-off) to enable legacy tokens for your tenant. It can take up to 24 hours for this change to take effect. Contact support if you need assistance with this process.

8. resolved Mar 17, 2025, 02:01 PM UTC

   Microsoft is rolling out deprecation of legacy Exchange tokens that may prevent your users from being able to report emails using the Expel custom Office 365 Phishing button. Expel is working on development and testing of an updated Expel O365/M365 Phishing button for web and desktop applications that will work with the NAA authentication scheme. Until Expel is able to deploy the newly developed Phishing button, you should follow the instructions from Microsoft (https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/turn-exchange-tokens-on-off) to enable legacy tokens for your tenant. It can take up to 24 hours for this change to take effect. Contact support if you need assistance with this process.

Read the full incident report →

Started Feb 27, 2025, 05:27 PM UTC· resolved Feb 28, 2025, 04:28 PM UTC

1. monitoring Feb 27, 2025, 05:27 PM UTC

   We are monitoring a json decoding error that has bubbled up for all Orca Security devices. We have reached out to the vendor and will post another update at 1:00 EST

2. monitoring Feb 27, 2025, 06:20 PM UTC

   We are continuing to monitor this outage. We are in talks with the vendor at this time. Will provide another update at 2pm EST

3. monitoring Feb 27, 2025, 07:03 PM UTC

   We are continuing to monitor this outage. We are in talks with the vendor at this time. Will provide another update at 3pm EST.

4. monitoring Feb 27, 2025, 08:54 PM UTC

   We are continuing to monitor this outage. We are waiting on the vendor to provide guidance. Will provide another update at 5pm EST.

5. monitoring Feb 27, 2025, 10:05 PM UTC

   Orca has identified a fix and is going to roll it out and monitor it overnight. We will mark this as resolved when we see devices come back online and monitor.

6. monitoring Feb 28, 2025, 03:06 PM UTC

   All devices are reporting healthy. We're considering this resolved and will continue to monitor.

7. resolved Feb 28, 2025, 04:28 PM UTC

   Fix was issued @ 3am EST.

Read the full incident report →