InsightIDR – Missing SentinelOne and CrowdStrike Alerts for some MDR customers

Delayed alerts for SentinelOne and CrowdStrike for MDR customers have now been resolved. Replay of the delayed alerts is now complete. The MDR SOC will reach out via standard methods if investigation reveals any alerts requiring customer awareness or response.

The issue affecting alerts for SentinelOne and CrowdStrike for MDR customers has now been mitigated. Work is ongoing to replay missed alerts for MDR SOC analyst triage and investigation.

We have identified an issue that began on July 24, 2025, at 17:21 UTC, where High and Critical alerts from SentinelOne and CrowdStrike are not populating correctly in InsightIDR for a subset of MDR customers who have opted to have the Rapid7 SOC monitor third-party alerts from these event sources.