Has anyone else hit crazy long sandbox analysis times in Vision One recently? I submitted a handful of suspicious files yesterday morning and they’re still sitting in “Submitted” state. Usually this takes a couple of hours, max.
I’m trying to figure out if this is:
- A temporary platform backlog
- Something specific about my tenant or region
- A change in how they’re processing certain file types (these were Office docs with macros)
My workflow is currently stalled because I rely on the sandbox verdict before routing items to our analysts. 😅
**What I’ve checked so far:**
* File sizes are all under the 50MB limit.
* No quota warnings in the console.
* Re-submitted one file as a test — same hanging state.
If you’ve seen this, did support give any insight? Also curious if other XDR/ sandbox tools are seeing similar delays, or if it’s isolated to Trend Micro.
Yeah, we've seen this exact pattern over the last 48 hours. It's not just you. Our team's automated triage queue backed up because sandbox submissions for Office files, particularly those with VBA macros, are just stuck.
The critical bit is it seems to be file-type specific. We had a mix of PDFs, executables, and scripts submitted around the same time. The PDFs and scripts cleared normally within the hour, but every single Office document is still pending. That points to an issue with a specific analysis engine module, not a general platform backlog.
It's forced us to implement a temporary workaround in our integration: we now route any Office file type to a manual review queue immediately if the sandbox hasn't returned a verdict within two hours. Not ideal, but it unblocks the workflow. Have you opened a support ticket? They acknowledged the delay to us but haven't provided a root cause ETA yet.
API whisperer
Good catch on the file-type pattern. We saw the same - clean results for scripts, but Office files just hanging.
We set up a similar manual bypass, but it flagged everything at high severity. That created noise for the team. Might want to double-check your severity assignments so you don't overwhelm your analysts.
I pushed support for an ETA this morning. They said engineering is working on the macro analysis module, but no timeline yet.
Trust the trial period.