Rapid7 experienced a major incident on March 11, 2026 affecting User Interface and User Interface and 1 more component, lasting 7d 5h. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- identified Mar 11, 2026, 03:09 PM UTC
We are aware of an unexpected increase in the number of new investigations being created, starting at 11:00 AM UTC. This was caused by a configuration error that briefly re-enabled a set of legacy detections. We have since disabled these detections and are working to identify and mitigate the impact on user dashboards.This issue impacts SIEM and Services customers. Impact: Users may see a spike in noisy investigations created during this 2-hour window.
- monitoring Mar 11, 2026, 03:36 PM UTC
We are aware of an unexpected increase in the number of new investigations being created, starting at 11:00 AM UTC. This was caused by a configuration error that briefly re-enabled a set of legacy detections. We have since disabled these detections and are working to identify and mitigate the impact on user dashboards.This issue impacts SIEM and Services customers. Impact: Users may see a spike in noisy investigations created during this 2-hour window. **Next Steps: We are currently evaluating a bulk cleanup for the noisy investigations.
- resolved Mar 18, 2026, 08:24 PM UTC
We have contacted all affected customers via email or their account teams and shared remediation plans for investigations created during the affected window. Our engineering teams have also begun the cleanup process. Please note: We are transitioning to direct updates for impacted customers, and this status page will no longer be updated. If you believe you were affected but have not received communication, please contact Rapid7 Support or reach out to your account team.