[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpUkcUrUr4slfqlPCwf3Ede5SEdHWEVhLFr1n0T_rETU":3},{"article":4,"iocs":47,"watch_terms":48,"solutions":49,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"e5c80570-5e72-48e6-8918-29286f798892","Microsoft Struggles to Restore Email and Other Services in a Global Outage","microsoft-struggles-to-restore-email-and-other-services-in-a-global-outage-d96956","Microsoft is trying different ways to identify the cause of the problem and get its servers back online, using “a measured approach to identify and repair affected infrastructure.” The post Microsoft Struggles to Restore Email and Other Services in a Global Outage appeared first on SecurityWeek.","Microsoft experienced a widespread outage affecting Exchange Online, Outlook, Teams, and Copilot services globally, impacting hundreds of millions of users across commercial and government operations. The company stated the outage was not caused by malicious activity and employed a measured approach to identify and repair affected infrastructure, reporting incremental improvements but noting service health remained variable. The outage was compared by officials to the 2024 CrowdStrike incident, suggesting a potential faulty update was responsible.","Microsoft's global outage impacts Exchange Online, Outlook, Teams across multiple regions.","https:\u002F\u002Fwww.securityweek.com\u002Fmicrosoft-struggles-to-restore-email-and-other-services-in-a-global-outage\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002FAndroid-Microsoft_Apps-Flaw.jpg","2026-11-13T13:47:42+00:00","2026-11-13T14:00:28.145152+00:00",7,[17,20,23,25,27,29],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":22},"Microsoft 365","product",{"name":24,"type":22},"Exchange Online",{"name":26,"type":22},"Outlook",{"name":28,"type":22},"Teams",{"name":30,"type":22},"Copilot","c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73",{"id":31,"icon":33,"name":34,"slug":35},null,"Incident Response","incident-response",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[],[18,21,24],{"controls":50,"vendors":135},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"log-management","Log management and security data pipelines","Security logs are so expensive to collect and keep that teams drop the ones they need when an incident happens.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-transit","GreyMatter Transit","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Ftransit\u002F","Security data pipeline that normalises and routes telemetry and detects threats while the data is in motion, to cut lag and storage costs.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"cribl","Cribl","\u002Fvendor-logos\u002Fcribl.png","cribl-lake","Cribl Lake","https:\u002F\u002Fcribl.io\u002Fproducts\u002Flake\u002F","Managed data lake for IT and security telemetry in open formats, to store data cheaply and search or replay it later.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-onum","Falcon Onum","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-siem\u002Ffalcon-onum\u002F","Real-time telemetry pipeline from CrowdStrike's purchase of Onum. It filters and streams data into Falcon Next-Gen SIEM and can run detections on third-party data before it is stored.",{"slug":81,"name":82,"problem":83,"products":84},"security-monitoring-siem","Security monitoring (SIEM)","Logs from everywhere end up in one place, with alerts that someone actually sees.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xsiam","Cortex XSIAM","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xsiam","AI-driven security operations platform that centralises security data, detection, automation and response for the SOC.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"abstract-security","Abstract Security","\u002Fvendor-logos\u002Fabstract-security.png","abstract-composable-siem","Abstract Composable SIEM","https:\u002F\u002Fwww.abstract.security\u002Fplatform","SIEM built from separate parts for collection, AI-assisted detection and tiered retention, which can be adopted one at a time.",{"slug":110,"name":111,"problem":112,"products":113},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[114,119,127],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":115,"product_name":116,"url":117,"description":118},"unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",[136],{"slug":137,"name":18,"logo_path":138,"roles":139},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":151},"faulty-update-triggers-global-microsoft-outage-echoing-crowdstrike-incident","Faulty Update Triggers Global Microsoft Outage, Echoing CrowdStrike Incident","A suspected faulty software update caused a massive, prolonged outage across Microsoft's Exchange Online, Outlook, Teams, and Copilot services, affecting hundreds of millions of users worldwide. Much like the 2024 CrowdStrike incident, the root cause appears to be insufficient pre-deployment testing and validation of updates before they reached production infrastructure at scale. The 'measured approach' Microsoft described to restore services highlights the lack of a rapid, automated rollback capability for large-scale update failures. This matters because even non-malicious failures at hyperscale cloud providers can cripple commercial and government operations globally, underscoring systemic risk in concentrated cloud dependency.",[146,147,148,149,150],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 CM-3: Configuration Change Control","NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity","NIS2 Article 21(2)(c)","NIST CSF 2.0 RS.MI-02: Incident Mitigation",{"NIS2 Article 21(2)(c)":152,"NIST CSF 2.0 RS.MI-02: Incident Mitigation":153,"NIST SP 800-53 CM-3: Configuration Change Control":154,"NIST SP 800-53 SI-7: Software, Firmware, and Information Integrity":155,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":156},"NIS2 Article 21(2)(c) requires business continuity and crisis management plans, which would have ensured faster, structured recovery and minimised service disruption duration during the outage.","This category requires that organisations have the capability to contain and mitigate incidents rapidly, and the absence of fast automated rollback directly delayed service restoration after the faulty update was deployed.","CM-3 mandates formal change control processes including testing and approval gates before changes are implemented in production, which would have required the faulty update to pass validation checks first.","SI-7 requires integrity verification of software updates before deployment, helping detect or block a defective update before it propagates across production systems at scale.","CIS Control 4 requires validated, tested configurations before deployment; enforcing this for software updates would have caught the faulty update in a pre-production environment before it reached global infrastructure."]