3rd Party Degraded Service: [Connector - MS Defender TVM]
Incident Report for Cisco
Resolved
This incident has been resolved.
Posted Nov 06, 2024 - 09:15 CST
Monitoring
The CVM engineering team has identified an issue with the Microsoft Defender for Endpoint APIs. Currently, attempting to export files from the following endpoint: https://api.securitycenter.microsoft.com/api/machines/SoftwareVulnerabilitiesExport
results in a 404 error indicating that the specified blob does not exist.

As a temporary workaround, we have moved the vulnerability extracts to the SoftwareVulnerabilitiesByMachine endpoint. Please note this endpoint operates significantly slower than the file export previously used, therefore, we expect connector runs to take longer than usual while the workaround is in place.

The engineering team will continue collaborating with Microsoft to revert to the original file export API once the issue is resolved.
Posted Nov 01, 2024 - 12:35 CDT
Identified
The MS Defender TVM Connector issue has been identified as isolated to a 3rd party service degradation.
This is currently affecting our ability to retrieve vulnerability data, resulting in failed responses from the MS Defender TVM endpoint, we are actively weighing possible workarounds to mitigate the impact while awaiting further updates from Microsoft.
Posted Oct 31, 2024 - 07:15 CDT
Investigating
We are currently investigating an issue with a 3rd party for failed responses [MS Defender TVM.]
This issue is isolated to the single 3rd party. We are currently unable to extract data from their endpoint.
Posted Oct 30, 2024 - 09:48 CDT
This incident affected: US - 1 (Connector Runs), EU (Connector Runs), US - 2 (Connector Runs), CA - 1 (Data Exports), KP - 1 (Connector Runs), KP - 2 (Connector Runs), KP - 4 (Connector Runs), KP - 5 (Connector Runs), US - 3 (Connector Runs), L - 1 (Connector Runs), USS - 1 (Connector Runs), EUS - 1 (Connector Runs), IN - 1 (Connector Runs), UST - 1 (Connector Runs), and EUT - 1 (Connector Runs).