Incident & Breach Response
,
Security Operations
After Hours-Long Disruption, XDR Vendor Promises Full Root Cause Analysis of Outage
Cybersecurity vendor SentinelOne suffered a major outage Thursday that disrupted software updates and its monitoring of some customers’ endpoints and networks.
See Also: On Demand | Global Incident Response Report 2025
Reports of disruptions began to surface Thursday after 14:00 UTC, or 7 a.m. U.S. Pacific Time. The outage disrupted some aspects of the extended detection and response vendor’s services, which keep tabs not only on endpoint devices and network technology, but also cloud apps and software-as-a-service providers.
About six hours into the incident, SentinelOne issued this update to customers: “We are aware of ongoing console outages affecting commercial customers globally and are currently restoring services. Customer endpoints are still protected at this time, but managed response services will not have visibility. Threat data reporting is delayed, not lost.”
The XDR vendor told customers that its initial root cause analysis suggested the outage traced to “an internal automation issue, and not a security incident.”
“Managed response services not having access = your outsourced security detection and response has stopped,” said cybersecurity expert Kevin Beaumont in a post to social network Mastodon.
SentinelOne last September said it counted nearly 13,000 customers.
Every one of the company’s 11 services – bar its website – was listed as being unavailable on the unofficial, free sentinelonestatus.com site, including the firm’s endpoint, XDR, cloud security, identity, data lake, threat intelligence and vulnerability management services. While SentinelOne details system availability on its private support portal, the company has no official, public-facing page to track system outages.
About six hours after the outage began, at 19:41 UTC on Thursday, the vendor reported: “Access to consoles has been restored for all customers following today’s platform outage and service interruption. We continue to validate that all services are fully operational.”
“Our initial root cause analysis shows this was not a security incident, and we will be publishing a review of the event,” a SentinelOne support agent told customers. “We apologize for the inconvenience caused by this service interruption.”
Warnings over the “S1” global outage first came to light Thursday when administrators reported being unable to access their cloud-based SentinelOne console. “The portal was up until mid-morning U.S. Eastern time and has been down since,” one admin posted to Reddit, with rumors centering on an Amazon Web Service – based on error messages being encountered – or perhaps DNS problems or a distributed denial-of-service attacks.
The AWS “service health” page on Thursday did list one problem Thursday: “Elevated API error rates and connectivity issues in the AP-SOUTH-2 Region,” referring to systems based in the Hyderabad, India, region, that began at 17:08 UTC, which it said were resolved one hour later. That timing doesn’t appear to mesh with the details of the SentinelOne outage.
Administrators said the outage meant that endpoints wouldn’t receive any additional security updates, and also that any users disconnected from the internet after their system triggered a false positive couldn’t be reconnected, until they regained portal access. We have some ticked-off clients who can’t work,” one admin said in a Reddit post.
Custom detections created using the firm’s STAR – for SentinelOne Storyline Active Response – rules weren’t working. “STAR rules rely on internet connectivity between the agent and console. So any custom detections relying on STAR rules don’t work,” one admin posted.
“S1 is treating this as a SEV0 as it’s affecting multiple customers,” an admin posted before the outage was resolved.
Incident severity levels get rated from five to zero, with SEV0 typically signifying “a catastrophic event that demands immediate attention – the worst case scenario,” per incident response firm Incident.io.
Beaumont assessed the vendor as having responded relatively effectively to the outage. “Overall a good response I thought, they stuck it on the front page of their website,” he said. “Orgs did lack visibility and MDR coverage during the event, which sucks but hopefully lessons will be learnt.”