Elements EDR Advanced response task shows „Failed“ status

Issue:

After creating an advanced response task for Elements Endpoint Detection and Response (EDR), the State is shown as Finished but the Progress column shows the task Failed.

What can cause the advanced response task to fail? 

Resolution:

If the EDR advanced response tasks fail, first you need to make sure that the Advanced response actions are enabled in the Elements profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the General settings page
5. In the Integrations section, make sure that Advanced response is enabled
6. Click Save profile

Also make sure that the required network connections are allowed. For that you can run the wsconnectionchecker.exe tool found in the Elements Agent installation folder: C:\Program Files (x86)\F-Secure\PSB\ui

The connection checker tool has tests for WithSecure EDR Response Server, which need to succeed for the advanced response actions to work. 

If response actions are enabled in the profile and the connections show OK status, but the response action tasks would still fail, you need to make sure that the task you have created does not have any errors. For example if you have created a retrieve files task, you need to make sure that the folder path is valid.