# \[INC-1136\] Service Degradation Affecting SIEM Log Ingestion

- Provider: [Imperva](https://down.guide/imperva)
- Level: confirmed
- Impact: Degraded
- lasted 1h 38m
- started 2026-09-17 23:52 UTC
- SIEM Logs
- id: DWN-221e3a2e1c
- Official page: https://stspg.io/kz5mcvbj4gmd

## Updates from Imperva
### 2026-09-17 23:11 UTC: investigating
We are investigating an issue where some customers may receive SIEM logs from IP addresses that are no longer expected to be in use.
Our teams are actively investigating the issue and working to identify the cause.
We will provide further updates as more information becomes available.

### 2026-09-17 23:52 UTC: investigating
We have identified the source of the issue affecting a subset of customers, resulting in SIEM logs being received from IP addresses that are no longer expected to be in use.
Our teams are actively implementing mitigation measures to reduce customer impact and restore expected behavior. We will provide further updates as they become available.
The next update on the issue will be shared no later than 00:30 UTC.

### 2026-09-18 00:25 UTC: identified
Our teams continue to work on implementing mitigation measures to address the issue causing some customers to receive SIEM logs from IP addresses that are no longer expected to be in use.
Efforts remain focused on reducing customer impact and restoring expected behavior. We will provide additional updates as progress is made.
The next update on the issue will be shared no later than 01:00 UTC.

### 2026-09-18 00:59 UTC: monitoring
Our teams have successfully implemented mitigation measures to address the issue causing some customers to receive SIEM logs from IP addresses that are no longer expected to be in use. The observed impact has been mitigated, and services are operating as expected at this time.
We are continuing to closely monitor the environment to ensure ongoing stability and confirm the effectiveness of the mitigation. 
The next update on the issue will be shared no later than 01:30 UTC.

### 2026-09-18 01:30 UTC: resolved
Mitigation measures have been successfully implemented, and after a period of monitoring, our teams have confirmed that services are operating as expected with no further impact observed. This incident is now resolved.
We apologize for any inconvenience and thank you for your patience while we worked to address this issue.

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by Sazabi (https://sazabi.com/?utm_source=down-guide&utm_medium=markdown).