We are excited to announce the next generation of our XDR detection engine.

With the tightening of security budgets as cyber-attacks continue to soar, everyone is feeling the pressure to get the most out of security investments and make their operations more efficient. We have been listening to our partners desire to scale their business and protect more customers with the same number of resources.

This has led us to investigate how we can use automation and Artificial Intelligence to reduce detection volumes while maintaining security value.

Our most requested feature was Accepted Behavior where partners can configure suppression rules to silence Broad Context Detections (BCDs) which they know to be false positives.

However, we have taken this initiative one step further to introduce automatic, dynamic risk score that uses closure codes to improves the risk score accuracy of BCDs we present in the Elements Security Centre.

After 6 months of research, development and testing between our W/Intelligence and own internal threat hunting teams, we are delighted to release the next generation of our detection engine. Unlike Accepted Behavior which requires additional configuration for the partner, the new score relies on end user’s investigation results. Therefore, the benefits are gained automatically from day-to-day operations which means a more efficient method of tackling the age-old problem of false positives.

The new model learns from your environment by using closure codes to determine how well our detection logic is performing. This allows us to identify areas of enhancement by highlighting detection logic that should be optimized. We use the new implementation to guide our detection engineering team to refine and improve the ‘noise makers’ and strive towards a signal to noise ratio our users appreciate not tolerate.

Most importantly, we wanted to cut down on the number of false positives, without reducing the detection efficiency of our engine.

We have achieved a significant reduction in reported BCDs, in some cases this could be up to half. Therefore, you can look forward to proactive improvements for your detection, and response teams who should now be able to focus on the right detections.

With the reduction in BCDs, organizations which have been focusing on High and Severe alerts, may also want to consider monitoring Medium level alerts also.

These improvements are part of our XDR strategy to make your work more efficient with automation, Artificial Intelligence, and easy to interpret and understand User Interfaces.

As a customer, what do I need to do to utilize the benefits of the improved engine?

In short, you don’t need to do anything to enable the new risk score. Just continue closing incidents as either “confirmed” or “false positive/accepted behavior/” as normal and we will automatically do the rest.

This has been a massive effort on our part and we look forward to sharing this success with you.

Please note, that Confident and Criticality are no longer used in the calculation of the risk score, and therefore will be removed from the user guides, portal and email notifications over the upcoming weeks. For more information regarding the risk score, please find the latest information:

https://www.withsecure.com/userguides/product.html?business/edr/latest/en/concept_3FEF66C8BBE2409CB2030767FD719BF3-latest-en

Due to changes announced in Upcoming changes to WithSecure Elements client installations we will soon remove the ability to install Agents from old installer versions depending on obsolete Elements Agent registration API.

We strongly advise against using old installers and recommend to always take the latest versions from the Download Center or Elements Security Center.

Starting from 1.08.2024 it is impossible to make new Agent deployments using old installers,

The installers used MUST now be AT LEAST

• Windows version 24.3.300
• Mac version 24.1.52031
• Linux version 12.0.482

As many of you are aware, we recently held our SPHERE24 event here in Helsinki, where we had many partners and customers attending. As part of the event, we launched several new products and services, to further expand our Elements Cloud portfolio.

Here is a brief summary of the new launches:

WithSecure Elements Exposure Management (XM)

Elements Exposure Management is a continuous and proactive solution that predicts and prevents breaches against a company’s assets and business operations. The solution provides visibility into attack surface and enables the efficient remediation of highest-impact exposures through a unified view, thanks to our exposure scoring and AI-enabled recommendations.

The existing solutions of Elements Vulnerability Management and Elements Cloud Security Posture Management will be included in Exposure Management and will be phased out later as separate solutions.

Public Website: XM

WithSecure Elements Extended Detection and Response (XDR)

Elements Extended Detection and Response is an expansion on our existing Elements Endpoint Protection (EPP) and Elements Endpoint Detection and Response (EDR) products, incorporating more of the partners’ and customers’ estate.  XDR is a unified solution to protect modern IT estates by minimizing impact of attacks with advanced preventive controls, AI-powered tooling, and access to flexible, round-the-clock expert services.

Elements XDR is comprised of:

• Elements Endpoint Security
• Elements Identity Security
• Elements Collaboration Protection

Elements Endpoint Security is a new market offering comprised of the existing EPP and EDR products, as complete protection for endpoint devices.

Elements Identity Security is a new module that protects organizations’ Microsoft Entra ID identities that are commonly used to access Microsoft 365 applications and third-party cloud services. These organizations face regular advanced threats targeted to their users’ identities and the identity and access management (IAM) infrastructure itself. The solution allows organizations to gain the visibility needed to detect and respond to identity-based threats, including monitoring identity-related changes and events that might signal an ongoing attack.

Elements Collaboration Protection is the same product we all know and love, but now marketed as part of the overall Elements XDR solution. It adds advanced protection, detection and response capabilities to Elements XDR solution to cover cloud-based Microsoft 365 email, Teams, OneDrive and SharePoint services.

Public Website: XDR

WithSecure Managed Detection and Response (MDR)

WithSecure™ Managed Detection and Response service is a continuous 24/7 detection and response service, in which WithSecure’s cyber security experts protect your IT environment by investigating and remediating cyber security attacks across your estate using data collected by Elements Endpoint Detection and Response (EDR). This gives customers access to expert-backed Detection and Response capabilities that their in-house team with detection and response tooling may not be able to cover.

Public Website: MDR

WithSecure Luminen GenAI

WithSecure Luminen™ is a generative AI experience based on a Large Language Model (LLM). Natively embedded into WithSecure™ Elements Cloud, Luminen™ supercharges IT and cyber security teams with better situational awareness through natural language explanations of security events and Broad Context Detections™. Luminen™ also provides summary reports in the user’s local language.

WithSecure Luminen™ is not a new product in itself, but is included in Elements products such as Elements XDR to enhance the experience for the users.

Public Website: Luminen

What to do next

As with all WithSecure offerings, these new products and services are available through our wide partner network.

If you are interested in any of these, and are an existing customer, please reach out to your Partner to find out more.

If you aren’t an existing customer, you can find your nearest WithSecure sales partner via our Partner Locator.

Alternatively, you can contact us via the form on each of the product webpages, although please note that the level of interest in our new products and services exceeded even our own high expectations, and we will need a little time to process all enquiries. Please be patient, we will get round to responding as soon as possible 😊

If you are an existing WithSecure partner, you can find more information via your dedicated Partner Portal account.

And if you would like to become a WithSecure partner, please find out more at our Partner Program page

We are delighted to announce that we are officially launching the Public Holidays coverage for the Co-Monitoring Out of Office service.

This coverage is currently available for the following countries, and for country-wide public holidays only:

• Nordics: Finland, Norway, Sweden, Denmark
• DACH: Germany, Austria, Switzerland
• UK: England, Wales, Scotland and Northern Ireland
• USA: Federal holidays only, not unique state holidays
• Netherlands
• Belgium
• France (mainland only)
• Italy
• Estonia
• Republic of Ireland
• Singapore
• Japan

Countries not listed above cannot currently use the Public Holiday coverage, but we will consider adding more in the future.

Please contact your WithSecure Sales Representative for more details. For End Customers, this is typically the partner that you purchased your WithSecure products and services from.

A new integration of WithSecure Elements to Microsoft Sentinel has been published in the Azure marketplace.

The new integration is more secure, serverless and requires no maintenance from the customer. It brings all security events supported by the Elements API to MS Sentinel.

Alternatively, the connector can be installed from the command line by following the instructions in github.

How it works

The integration allows ingesting WithSecure Security Events into Microsoft Sentinel Logs Workspace. It periodically polls Security Events from Elements backends and forwards it to Azure cloud. A Sentinel administrator can then use the ingested events to create Workbooks, Playbooks and use other useful Sentinel features.

In line with our commitment to keep you informed of changes, we are announcing that we will shortly be publishing an update to the WithSecure Elements Privacy Policy.

The changes are relatively minor, the highlights being:

• Consolidation of the individual product policies into one single policy covering the whole of WithSecure Elements
• Changes in the retention time for audit logs
• Minor rewording to aid clarity

The new policy will take effect from 12 June 2024, and no action is required from partners, customers, or end users.

We are updating the names of products that are visible in Device Discovery view of Elements Vulnerability Management, to more closely match the names used elsewhere in WithSecure websites and product materials.

These changes are entirely limited the the visible name, and no functional changes are being made.

Editor’s Highlights

Our teams have been working extremely hard preparing for the launch of some new products and services at our SPHERE24 partner event late in May.

Because of this, the following summary does not contain details of everything they have been working on, and details of these will be announced after SPHERE24.

Elements Endpoint Protection

WithSecure Elements Agent for Windows workstation and servers: version 24.3

A new version of the endpoint client for Microsoft Windows is now available.

This release makes the Elements Agent version 24.3 available (internal version 24.3.300).

The endpoints automatically upgrade, without a reboot.

Features:

• This release brings several enhancements and corrections, particularly focusing on installation processes, proxy management, and automated tasks.

WithSecure Element Agent for MacOS 24.1 released

This release introduces new features and fixes. Please note that this release has significant changes and customers are advised to check the linked article.

Actions required:

MDM profiles must be updated as instructed on page Release Announcement: New WithSecure client for macOS. 

Added features:

• This release introduces new WithSecure Elements agent update mechanisms. We are taking into use backend services that are completely distinct from the services used by F-Secure products. Therefore this release also introduces new server addresses where the endpoints connect to. Switch to the new backend services happens like the usual automatic endpoint upgrade and will require full definitions download.
• The product is now signed using the WithSecure certificate and installed to the new location:

/Library/WithSecure (instead of /Library/F-Secure used for earlier versions)

/Applications/WithSecure (instead of /Applications/F-Secure used for earlier versions)

activator tool is now moved to /Library/WithSecure/bin/activator

• Background connectivity checker tool is now added to the product. Client now detects and reports connectivity issues to the Element Security Center to highlight Firewall misconfiguration to the administrator.
• Elements Agent is now using the new Browsing Protection extensions. If you use MDM or group policies to manage browser extensions it is recommended to allow or preinstall these extensions as instructed on page Pre-Announcement: New WithSecure client for macOS. 
• Auditd is not required for the sensor to function on Sonoma and we will gradually reduce dependency on auditd on older OS versions.

Fixed issues:

• Performance degradation on macOS Sonoma is now fixed.

WithSecure™ Element Agent is compatible with the following versions:

• macOS 12 Monterey
• macOS 13 Ventura
• macOS 14 Sonoma

Dropped functionality:

• macOS 11 Big Sur support is discontinued. The Elements Agent won’t be upgraded on Big Sur and older OS versions and will remain running the previous product version until its end of life. WithSecure recommends upgrading these endpoints to macOS 12 or above to ensure uninterrupted service. Please upgrade Elements Agent manually if the version running is 22.4 and older. Versions 23.1 and newer will be upgraded automatically.

WithSecure Elements Mobile Protection app for iOS has been released

An update to the WithSecure Elements Mobile Protection app for iOS has been released.

It includes the following new features and improvements:

• Network Gateway replaces the traditional VPN feature
• The app now supports the Safari extension
• The app and the WithSecure Elements Endpoint Protection portal now support the following settings:
  • Network Gateway
  • Remind user to activate the browser plugin
  • Reputation based browsing
    • Block access when web site is rated harmful
    • Block access when web site is rated as suspicious
    • Block access when web site is rated as prohibited
    • Block access when web site contains trackers
  • Web content control
    • Block everything except allowed sites
    • Web site exceptions
      • Allowed sites
      • Denied sites
    • Include the blocked URLs in all security events
• The app and the WithSecure Elements Endpoint Protection portal now support security events for Browsing protection
• The app now supports Firebase Crashlytics
• The app now handles multiple remote operations seamlessly 
• The app can now automatically select the appropriate VPN profile
• Improvements to app stability on iPads
• Improvements to app stability for non-secured HTTP traffic

WithSecure Elements Mobile Protection app for Android has been released

An update to the WithSecure Elements Mobile Protection app for Android has been released

It includes the following new features and improvements:

• Support for Network Gateway was added
• The app and the WithSecure Elements Endpoint Protection portal now support the following settings:
• Network Gateway
• Reputation-based browsing
  • Block access when web site is rated harmful
  • Block access when web site is rated as suspicious
  • Block access when web site is rated as prohibited
  • Block access when web site contains trackers
• Web content control
  • Block everything except allowed sites
  • Web site exceptions
    • Allowed sites
    • Denied sites
• Include the blocked URLs in all security events
• The app and the WithSecure Elements Endpoint Protection portal now support security events for Browsing protection

It includes the following new features and improvements:

• Android 9 support has been dropped, Malware Protection will be still available on these devices
• Improvements to app stability
• The app now allows Samsung devices to receive updates when Network Protection is turned on

Elements Vulnerability Management

EVM: System Scan

Vulnerability detections have been added for the following products in authenticated scanning on Microsoft Windows:

• Microsoft Support Diagnostic Tool UAC Bypass
• IBM Engineering Requirements Management DOORS
• Vim

Integrations

Device subscription change

The Elements API allows a solution provider to move an endpoint device from one subscription to another.

Example query like curl -X PATCH -H “Authorization: Bearer {token}” -H “Content-Type: application/json” https:// connect.withsecure.com /devices/v1/devices -d ‘{“subscriptionKey”: “E43V-DE4H-U2X8-87L2-438V”, “targets”: [“ec8a0100-d313-4896-b3cb-02188e060bf3”,1c49df1a-02d9-4bc4-91db-5609b80ad709]}

From response client can find which devices have been successfully moved to a new subscription, and which ones failed to do that and why.

Other items of interest

Monthly Threat Highlights Report: March 2024

These issues underscore the diverse and evolving nature of cybersecurity threats faced by organizations in March 2024.

1. Political Espionage by China: The report highlights instances of political espionage by China, specifically mentioning the compromise of the UK Electoral Commission by Chinese state-sponsored attackers. This indicates a concerning trend of state-sponsored cyber attacks targeting critical government institutions, potentially for espionage or influence operations.
2. Increase in Ransomware Attacks: The FBI’s report reveals a significant increase in ransomware attacks against critical infrastructure. The statistics show an 18% rise in reported ransomware attacks compared to the previous year, with a 74% increase in losses due to these attacks. Of particular concern is the 37% increase in attacks against critical infrastructure organizations, underscoring the heightened risk faced by essential services and infrastructure.
3. IoT Vulnerabilities: The report highlights significant vulnerabilities in IoT devices, such as the Saflok brand of RFID-based keycard locks used in millions of hotel doors worldwide. The slow patching process for these vulnerabilities poses a serious security risk, as only a fraction of affected locks have been updated so far. Additionally, the inclusion of CVE-2019-7256 in the Nice Linear eMerge E3-Series operating system further emphasizes the critical need for timely patching to prevent remote code execution attacks.
4. Cybersecurity Industry Disagreements: The disagreements between cybersecurity organizations, such as JetBrains and Rapid7, over responsible disclosure practices, and the dispute between CISA and Ivanti regarding the effectiveness of detection and remediation tools, highlight internal challenges within the industry. These disagreements can impact collaboration and information sharing, potentially hindering collective efforts to combat cyber threats effectively.
5. Ransomware Industry Updates: Recent developments in the ransomware industry, including the closure of major players like BlackCat/ALPHV and the subsequent crisis of trust within the Ransomware as a Service sector, demonstrate the dynamic nature of cyber threats. The exit scam carried out by BlackCat/ALPHV against their affiliates, coupled with the takedown of Lockbit, underscores the ongoing battle between defenders and threat actors in the ransomware landscape.

Download report

Share your ideas with us

Our purpose is to co-secure the world with you – now as WithSecure™. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure™ Elements Security Center.

Further information

Changelogs and Release Notes for all parts of WithSecure™ Elements can be found at the Help Center 

Update 2024-06-19: We will be enabling the Accepted Behavior feature globally from 26 June 2024. Please see the section below “Accepted Behavior after 26 June 2024” for more information

With the introduction of Accepted Behavior, it is now possible to create suppression rules which can accept the behavior of a user or a process. This can significantly aid in silencing BCDs for expected behavior.

This is required by many partners and customers as WithSecure creates an EDR solution that is suited to many different environments, which means there may be specific detection uses cases where, due to your environment, you want to ‘allow’ or accept behavior. i.e. you may use a software called “ABC” and you can confidently trust that process “XYZ” is legitimate and therefore want to suppress the detection so a similar BCD is not generated.

For a period of time, we have accepted ad-hoc request for allow listing but now we have created a wizard in Elements Security Center where you can self-serve the suppression rules.

How does Accepted Behavior work?

A “Broad Context Detection” (BCD) is a collection of detections that highlight malicious or suspicious behavior. Each BCD has one or more “key detections”. A “Key detection” is in stand-alone detection that would, on their own, produce a new BCD. In order to prevent similar BCDs from recurring, each key detection in a BCD must be suppressed. One suppression rule is created per key detection.

Accepted Behavior is required if your organisation’s specific circumstances mean a detection should be suppressed. Elements users should be careful when suppressing detections, to ensure they don’t suppress too broadly and silence behavior that, although common, might also be part of a legitimate attack.

What limitations of the first release?

• We will enable “accepted behavior” for a small group of partners initially, to collect feedback and improve the suppression mechanisms.
• At launch, this feature will be available for BCDs with up to 5 key detections. We are working to make it available to all BCDs, by reducing the overall number of key detections without removing any unique information from the BCD.
• There may be cases where identical rules are created due to repeating key detection with the same parameters, this will be addressed in upcoming weeks.

How to tell if you are over-suppressing BCDs?

When you apply a suppression rule, any new BCD created will be automatically closed with the resolution “Auto Accepted Behavior”. To provide you of an indication of how many BCDs are silenced, the detection engine will generate at most one new BCD every 24 hours per suppression rule, if the suppression criteria are met. After 24 hours have elapsed, a new BCD will be generated if the supression rule is triggered. WithSecure recommend that partners regularly review the suppressed BCDs to ensure malicious activity is not suppressed.

Note: Accepted behavior is required in cases where BCDs are causing reoccurring false positives have similar but not identical BCD fingerprints. If a BCD has been closed with “False Positive”, identical BCDs, with an identical fingerprint are automatically closed with the resolution “Auto-False Positive”.

How do I silence a BCD?

First step, would be to find a BCD you want to silence.

When the investigation is finished, change the status to closed, and set the resolution to ‘Accepted Behavior’, a pop-up window will ask you whether you would like to create an ‘suppression rule’.

Click yes, to be taken to the Suppression Rule Wizard, and then you can choose what endpoints should be affected.

There are 6 different parameters that can be used for BCD suppression. The parameters are pre-filled with data collected from the BCD. Those suppression parameters are explained below.

WithSecure has enforced the use of at least 2 parameters for each key detection, to ensure the ‘accepted scope’ is minimized.

Parameters that are enabled by default have a green toggle indicating the parameter will be used in the rule. Click ‘show more’ to view further parameters, these will be disabled by default i.e. those parameters that are not used within the existing rule. You can choose to disable/enable them by toggling off the parameter. Most parameters are pre-populated from the information from the BCD.

For BCDs with multiple key detections, there will be an accordion and set of parameters for each key detection. Each key detection in a BCD must be suppressed by a rule, to silence the BCD.

The table below shows the parameters that could be used

Which operators can I use when configuring parameters in a key detection?

Suppression rules allow you to set up two operators: “Equals,” which applies to all parameters when their length is less than 1024 characters, and “Contains,” which is applicable to all parameters. Please note, the Contains operator does not support wildcard characters (*).

Does the allow listing take effect immediately?

You can check suppression rules on the Automated Actions area, see the ‘Suppression Rules’ tab.

You can click on the rule, and click on count of BCDs that have been silenced, this will take you to the BCD view, where corresponding BCDs that have been silenced by this rule will be listed.

We will not close pre-existing BCDs when a new rule is implemented. Any new BCDs will be created after the rule is implemented will be closed with “Auto Accepted Behavior” resolution.

NOTE: Our partners/customers will be able to create a suppression rule, for newly created BCD after the feature is released.

Why can’t I see rules that align to my existing allow-listing requests?

The WithSecure Detection and Response Team (DRT) have implemented allow-listing on a different level in the WithSecure detection engine, which means BCDs are not created for allow-listing performed by the DRT. Therefore rules are not available in the ‘Suppression Rules’ view.

What are WithSecure doing from to reduce false positives?

We are currently working on improving detection quality by increasing our True Positive to Total Reported Incidents ratio. The solution has three parts, which we have had promising results from a simulation to suggest BCD volumes could reduce by 40%.

The three parts detailed below, will result in fewer Medium, High and Severe BCDs being created with a more accurate risk rating;

• Improvement of noise suppression mechanisms – We are redesigning our mechanism to suppress detections that are from usual behavior.
• Enhanced BCD risk scoring algorithm – We are implementing a new algorithm that will calculate a risk score of a BCD based on the distribution of severities across the detections contained within the BCD as well as using past and present data to improve the accuracy of the scoring.
• Integration of the BCD clustering ML model – This model will cluster together incidents based on their similarity to others that have already been assessed as FPs or confirmed by customers and partners.

Who can edit the suppression rules?

If you are a read-only user should not be allowed to add or edit rules.

If you are a user with Full Access, to a company, you are able to;

• Create Rules
• Edit rules created for your company.

If you are a partner with Full Access, you should be able to:

• Create Rules
• Edit the rules created at the partner level by yourself or your colleagues.
• Edit the rules created by your customers in the companies you manage.

Are the rules company specific?

Yes, currently one rule can apply to one company only. We have received feedback that partners would like rules to apply to multiple companies, so have added this to our roadmap.

Whose responsibility is it to validate suppression rules?

The partner is responsible for ensuring their analysts and end users understand and able to configure and manage suppression rules. The partner must accept they understand that rules that are overly suppressive may result in missed compromises as BCDs are hidden. Therefore, we recommend the partner/end user regular review the rules and their effectiveness.

Resolution codes new

• Accepted Behavior – The incident has been closed and is no longer monitored. The detection was confirmed as acceptable behavior.
• Auto Accepted Behavior – The incident has been closed automatically as accepted behavior based on the existing suppression rules.

Note: closing a BCD as Accepted Behavior doesn’t silence similar BCDs, a rule must be created.

Accepted Behavior after 26 June 2024

From 26 June 2024, ‘Accepted Behavior’ will be available globally to all customers.

It will be possible to create suppression rules that accept the behavior of a user or process. This feature aids in silencing “Broad Context Detections” (BCDs) for expected behavior. Partners and customers using WithSecure’s EDR solution can utilize this functionality to allow specific behavior in their environments. For example, if you trust a process called ‘XYZ’ associated with software ‘ABC,’ you can suppress similar BCDs to avoid unnecessary alerts.

Accepted Behavior works by suppressing key detections within a BCD. Each BCD contains one or more key detections that highlight suspicious behavior. Organizations can create suppression rules based on their specific circumstances. However, users should be cautious not to suppress too broadly, as legitimate behavior might also be affected.

The limitations of this release include enabling ‘accepted behavior’ on BCDs with up to 5 key detections. We will soon address cases where identical rules are created due to repeating key detections.

Additionally, a partner can create a suppression rule which applies to all the companies they manage. At this time there is a limitation that they can apply the rule to one organization, or all organizations they manage. We hope to enable more fine-grained control of this in the future.

Update: For operational reasons, we had to postpone this maintenance from 1.5.2024 to 7.5.2024

We will be performing some maintenance on Elements Cloud Security Posture Management to improve the performance of the system.

This maintenance will start on 7th May 2024 at 10.00 UTC, and is expected to be completed within 30 minutes.

During the maintenance period, it will not be possible to access the Cloud Security Posture Management section of the Elements Security Center.

We apologise for the late notification of this change, and any inconvenience it may cause to our customers.