New Remote Operation: Scan For (software) Updates

We’ve added a new remote operation scanForUpdates that allows you to scan for available software updates on target devices.

What it does:

• Remotely triggers a scan for available software updates on selected devices
• Works on computer-type devices only
• Requires no additional parameters – simply specify the target devices

This complements the existing installSoftwareUpdates operation by providing a way to check what updates are available before deciding whether to install them.

Read from from the Elements API specification page and look for the POST /devices/v1/operations endpoint.

New remote operation: Install Software Updates

The installSoftwareUpdate remote operation is now available in the WithSecure™ Elements API. This operation allows you to remotely install software updates on your managed devices.

Features

• Install updates by severity level (critical, important, or everything)
• Install specific updates using bulletin IDs
• Target individual devices or device groups
• Option to force close applications during updates

This remote operation is supported for the “computer” device type only.

Read from from the Elements API specification page and look for the POST /devices/v1/operations endpoint.

New fields in Devices endpoint and Security Events

The latest release in Elements API brings several new fields to the query devices endpoint and human-readable descriptions to Security Events.

New device endpoint fields

More information on connectivity status, various security parameters, installation tags and browsing protection status are exposed from the query devices endpoint.

The full list of new device fields below:

• installationTags
• connectivityStatus
• unreachableConnectionAddresses
• unstableConnectionAddresses
• networkExtensionContentFilterServiceEnabled
• systemIntegrityProtectionEnabled
• systemExtensionEnabled
• guestAccount
• fullDiskAccessGranted
• defaultBrowser
• defaultBrowserStatus
• browsingProtectionExtensionChrome
• browsingProtectionExtensionFirefox
• browsingProtectionExtensionSafari
• browsingProtectionExtensionEdge

See more information on the fields from the api specification (under Devices).

New human-readable Security Events fields

Two new fields are added:

• message — details of the security event
• description — short general description of the type of the event

You can see examples of these fields from Security Events specification.

Cloud-based incidents

The latest release of the Elements API introduces new incident types from cloud sources. This update enhances our threat detection capabilities by incorporating incidents from Azure and AWS environments. These incidents include identity and access management threats as well as cloud workload-based threats.

New Incident Source Types:

• identityAzure: Incidents related to Azure identity and access management detections.
• workloadAzure: Incidents detected from Azure workloads.
• workloadAws: Incidents detected from AWS workloads.

For a detailed overview of the API specifications for incidents, please refer to the complete documentation.

Exposure management Security Events

The latest release of Elements API adds support for Exposure Management recommendations as Security Events.

You can see the new event specification from the API documentation for Security Events.

The Security Events are retrievable via the security events endpoint defined here.