InsightIDR – Missing SentinelOne and CrowdStrike Alerts for some MDR customers

Final update

Delayed alerts for SentinelOne and CrowdStrike for MDR customers have now been resolved. Replay of the delayed alerts is now complete. The MDR SOC will reach out via standard methods if investigation reveals any alerts requiring customer awareness or response.

1. Resolved · Jul 29, 06:28 UTC
   Delayed alerts for SentinelOne and CrowdStrike for MDR customers have now been resolved. Replay of the delayed alerts is now complete. The MDR SOC will reach out via standard methods if investigation reveals any alerts requiring customer awareness or response.
2. Identified · Jul 29, 05:44 UTC
   The issue affecting alerts for SentinelOne and CrowdStrike for MDR customers has now been mitigated. Work is ongoing to replay missed alerts for MDR SOC analyst triage and investigation.
3. Investigating · Jul 29, 03:59 UTC
   We have identified an issue that began on July 24, 2025, at 17:21 UTC, where High and Critical alerts from SentinelOne and CrowdStrike are not populating correctly in InsightIDR for a subset of MDR customers who have opted to have the Rapid7 SOC monitor third-party alerts from these event sources.