Is Expel down?

At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 12:30PM ET.

At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 1:30PM ET.

At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 2:30PM ET.

At 10:30AM ET, we began experiencing a problem with alert ingestion. SOC operations are affected, but will catch up once service is restored; no data will be lost. We will provide an update by 3:30PM ET.

We have implemented a fix and believe the incident to be resolved. We are monitoring the health of the infrastructure and will resolve this if there are no outstanding issues. Please let us know if you are experiencing any problems.

This incident has been resolved.

Emails from Workbench are delayed since 12am UTC. We have identified the root cause and are working on a remediation. Phishing outcome responses, User Email notifications, and Org-Level Email Ticketing notifications are delayed since 12am UTC. SOC operations and alert ingestion are not affected. We will provide another update by 12:30pm UTC

We have identified the cause are continuing to work on remediation. We have also confirmed that due to this issue, when someone submits a suspected phishing email, the email will not reach Workbench for review. Next update at 1pm UTC.

We are continuing to work on remediation. MDR services are unaffected. Alert ingestion, detection, and investigation are operating normally. Slack, Microsoft Teams, PagerDuty, Opsgenie, and Service Now notifications are still being delivered. Email delivery from Workbench remains unavailable. No action is required at this time; we will confirm resubmission steps for phishing submissions once service is restored. Next update: Monday, 31 August at 13:00 UTC (9:00 AM ET)

Email delivery from Workbench is now working and emails in the queue are being replayed. An update will be posted once the replay is complete.

This issue is resolved. Email delivery from Workbench has been restored, and phishing email submissions are processing normally. Suspected phishing emails submitted during this time were not received by Expel and could not be processed. Please ask your users to resubmit anything they reported during this period. Notification emails generated during this time have been delivered. Some may arrive later than the timestamp they were originally generated.