Stopped Ingesting Microsoft Defender for Identity
Update - As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device have coverage and alerts are being processed.
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench). Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 28, 2025 - 09:38 EDT
Monitoring - We have confirmed all Microsoft Defender XDR devices are enabled and ingesting data, and we are working to reprocess alerts.

We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. (https://support.expel.io/hc/en-us/articles/38928860545299-Microsoft-Defender-XDR-Setup-for-Workbench) Please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 27, 2025 - 18:40 EDT
Identified - As part of a previously communicated Microsoft deprecation, Expel is no longer ingesting Microsoft Defender for Identity alerts (via the Microsoft Defender for Cloud Apps integration). Any customers who have onboarded a Microsoft Defender XDR device will have coverage restored shortly and begin reprocessing alerts.
We recommend that customers who have the Microsoft Defender for Cloud Apps integration, but have not yet onboarded Microsoft XDR to Workbench, complete the onboarding as soon as possible. We will provide a status update once we have enabled all onboarded Defender XDR devices.
In the meantime, please contact your Customer Success Manager if you need assistance with onboarding or if you have additional questions.
Mar 27, 2025 - 17:29 EDT
Expel Office 365 Phishing button
Identified - Microsoft is rolling out deprecation of legacy Exchange tokens that may prevent your users from being able to report emails using the Expel custom Office 365 Phishing button.

Expel is working on development and testing of an updated Expel O365/M365 Phishing button for web and desktop applications that will work with the NAA authentication scheme.

Until Expel is able to deploy the newly developed Phishing button, you should follow the instructions from Microsoft (https://learn.microsoft.com/en-us/office/dev/add-ins/outlook/turn-exchange-tokens-on-off) to enable legacy tokens for your tenant. It can take up to 24 hours for this change to take effect.

Contact support if you need assistance with this process.
Mar 17, 2025 - 10:03 EDT
Workbench availability Operational
Workbench global network connectivity Operational
Workbench login Operational
Workbench features Operational
Investigative actions Operational
File uploads Operational
Notifications Operational
Email Operational
Slack Operational
Teams Operational
Ticketing systems (via email, such as Jira) Operational
PagerDuty Operational
Opsgenie Operational
ServiceNow Operational
Assembler connectivity Operational
Alert ingestion Operational
Slack channels for customers Operational
Phishing submissions Operational
Operational
Degraded Performance
Partial Outage
Major Outage
Maintenance

Scheduled Maintenance

Scheduled Infrastructure Maintenance May 2, 2025 10:00-11:00 EDT

We will be undergoing routine maintenance between 10:00 - 11:00am ET on May 2nd.

All notifications and alerts will be processed during the maintenance window, but may be affected by intermittent delays.
Posted on Apr 25, 2025 - 17:23 EDT
System Metrics Month Week Day
Workbench global network connectivity ?
Fetching
Workbench availability ?
Fetching
Apr 26, 2025

No incidents reported today.

Apr 25, 2025

No incidents reported.

Apr 24, 2025

No incidents reported.

Apr 23, 2025
Scheduled Infrastructure Maintenance
Completed - The scheduled maintenance has been completed.
Apr 23, 10:53 EDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Apr 23, 10:00 EDT
Scheduled - We will be undergoing routine maintenance between 10:00 - 11:00am ET on April 23rd.

All notifications and alerts will be processed during the maintenance window, but may be affected by intermittent delays.
Apr 16, 14:28 EDT
Quarterly Patching and Reboots
Completed - The scheduled maintenance has been completed.
Apr 23, 06:00 EDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Apr 23, 05:00 EDT
Scheduled - We will be undergoing scheduled maintenance of assembler connectivity infrastructure during this time.
Apr 14, 16:17 EDT
Apr 22, 2025

No incidents reported.

Apr 21, 2025

No incidents reported.

Apr 20, 2025

No incidents reported.

Apr 19, 2025

No incidents reported.

Apr 18, 2025

No incidents reported.

Apr 17, 2025

No incidents reported.

Apr 16, 2025

No incidents reported.

Apr 15, 2025
Scheduled Infrastructure Maintenance
Completed - The scheduled maintenance has been completed.
Apr 15, 11:00 EDT
In progress - Scheduled maintenance is currently in progress. We will provide updates as necessary.
Apr 15, 10:00 EDT
Scheduled - We will be undergoing routine maintenance between 10:00 - 11:00am ET on April 15th.

All notifications and alerts will be processed during the maintenance window, but may be affected by intermittent delays.
Apr 8, 15:07 EDT
Apr 14, 2025
Workbench Access Degraded
Resolved - This incident has been resolved.
Apr 14, 12:21 EDT
Monitoring - At 11:16AM ET, we began experiencing a problem with Workbench that is preventing users from accessing Workbench.

We have identified the root cause and are working on a remediation. We have rolled out a previous, working version of Workbench and service has been restored. SOC operations were affected, but alert ingestion was not affected. We will continue monitoring and provide another update by 12:30pm ET.
Apr 14, 11:44 EDT
Apr 13, 2025

No incidents reported.

Apr 12, 2025

No incidents reported.

← Incident History Powered by Atlassian Statuspage