This issue is resolved. Email delivery from Workbench has been restored, and phishing email submissions are processing normally. Suspected phishing emails submitted during this time were not received by Expel and could not be processed. Please ask your users to resubmit anything they reported during this period. Notification emails generated during this time have been delivered. Some may arrive later than the timestamp they were originally generated.

Email delivery from Workbench is now working and emails in the queue are being replayed. An update will be posted once the replay is complete.

We are continuing to work on remediation. MDR services are unaffected. Alert ingestion, detection, and investigation are operating normally. Slack, Microsoft Teams, PagerDuty, Opsgenie, and Service Now notifications are still being delivered. Email delivery from Workbench remains unavailable. No action is required at this time; we will confirm resubmission steps for phishing submissions once service is restored. Next update: Monday, 31 August at 13:00 UTC (9:00 AM ET)

We have identified the cause are continuing to work on remediation. We have also confirmed that due to this issue, when someone submits a suspected phishing email, the email will not reach Workbench for review. Next update at 1pm UTC.

Emails from Workbench are delayed since 12am UTC. We have identified the root cause and are working on a remediation. Phishing outcome responses, User Email notifications, and Org-Level Email Ticketing notifications are delayed since 12am UTC. SOC operations and alert ingestion are not affected. We will provide another update by 12:30pm UTC