New remote operation (Send Full Status)

We have added API support for the sendFullStatus remote operation, allowing administrators to request a full status report from devices. This operation is available for both computer and mobile devices and requires no additional parameters. After the operation is sent, the target device(s) will asynchronously send their status to the Elements Cloud.

Read more from the api specification page under POST /devices/v1/operations endpoint.

New Remote Operation: Scan For (software) Updates

We’ve added a new remote operation scanForUpdates that allows you to scan for available software updates on target devices.

What it does:

• Remotely triggers a scan for available software updates on selected devices
• Works on computer-type devices only
• Requires no additional parameters – simply specify the target devices

This complements the existing installSoftwareUpdates operation by providing a way to check what updates are available before deciding whether to install them.

Read from from the Elements API specification page and look for the POST /devices/v1/operations endpoint.

New remote operation: Install Software Updates

The installSoftwareUpdate remote operation is now available in the WithSecure™ Elements API. This operation allows you to remotely install software updates on your managed devices.

Features

• Install updates by severity level (critical, important, or everything)
• Install specific updates using bulletin IDs
• Target individual devices or device groups
• Option to force close applications during updates

This remote operation is supported for the “computer” device type only.

Read from from the Elements API specification page and look for the POST /devices/v1/operations endpoint.

New fields in Devices endpoint and Security Events

The latest release in Elements API brings several new fields to the query devices endpoint and human-readable descriptions to Security Events.

New device endpoint fields

More information on connectivity status, various security parameters, installation tags and browsing protection status are exposed from the query devices endpoint.

The full list of new device fields below:

• installationTags
• connectivityStatus
• unreachableConnectionAddresses
• unstableConnectionAddresses
• networkExtensionContentFilterServiceEnabled
• systemIntegrityProtectionEnabled
• systemExtensionEnabled
• guestAccount
• fullDiskAccessGranted
• defaultBrowser
• defaultBrowserStatus
• browsingProtectionExtensionChrome
• browsingProtectionExtensionFirefox
• browsingProtectionExtensionSafari
• browsingProtectionExtensionEdge

See more information on the fields from the api specification (under Devices).

New human-readable Security Events fields

Two new fields are added:

• message — details of the security event
• description — short general description of the type of the event

You can see examples of these fields from Security Events specification.

Cloud-based incidents

The latest release of the Elements API introduces new incident types from cloud sources. This update enhances our threat detection capabilities by incorporating incidents from Azure and AWS environments. These incidents include identity and access management threats as well as cloud workload-based threats.

New Incident Source Types:

• identityAzure: Incidents related to Azure identity and access management detections.
• workloadAzure: Incidents detected from Azure workloads.
• workloadAws: Incidents detected from AWS workloads.

For a detailed overview of the API specifications for incidents, please refer to the complete documentation.

Exposure management Security Events

The latest release of Elements API adds support for Exposure Management recommendations as Security Events.

You can see the new event specification from the API documentation for Security Events.

The Security Events are retrievable via the security events endpoint defined here.

Elements Connector

A new release of Elements Connector 25.17 for both Windows and Linux is now available. This release includes the following changes:

1. Linux service
   • The Elements Connector now runs as a systemd unit, extending support to modern Linux distributions.
2. Java Runtime Environment
   • Upgraded to JRE 17 for enhanced performance and security.
3. Spring Framework
   • Updated Spring Framework to version 6.2.4.
   • Updated Spring Security to version 6.4.4.
4. Removal of old update server
   • Elements Connector no longer attempts to connect to the old update server (https://guts2.sp.f-secure.com), which was taken offline earlier this year.
5. Security enhancements
   • Addressed multiple recently discovered vulnerabilities, including:
     • JRE vulnerabilities: CVE-2024-21147, CVE-2024-21140, CVE-2024-21235, CVE-2025-21502
     • Spring vulnerabilities: CVE-2024-38829, CVE-2024-38828, CVE-2024-38820, CVE-2024-38819, CVE-2024-38816
6. MSI installation fix
   • Resolved an issue with MSI installation, where non-default HTTPS port was reverted back to default.
7. New supported platforms
   • Linux: Added support for Alma 9, Oracle 9, RHEL 9, and Rocky 9.
   • Windows: Added support for Windows Server 2025.
8. General improvements
   • Missing update version cache is refreshed in every polling interval instead of 1 hour.
   • Other fixes and enhancements for better stability and performance.

Elements Connector 25.17 supports the following operating systems:

Windows:

• Windows Server 2016
• Windows Server 2019
• Windows Server 2022
• Windows Server 2025
• Windows 10
• Windows 11

Linux:

• Alma Linux 8, 9
• Debian 11, 12
• openSUSE Leap 15
• Oracle Linux 8, 9
• Red Hat Enterprise Linux 8, 9
• Rocky Linux 8, 9
• SuSE Linux Enterprise Server 12, 15
• SuSE Linux Enterprise Desktop 12, 15
• Ubuntu 18.04, 20.04, 22.04, 24.04 LTS

NOTE! Known Limitations of Early access versions distribution

We want to inform you about a known limitation with the Elements Connector when used to redistribute definition updates to managed Elements agents for Windows and Mac. If any connected devices are enrolled in the early access client software program, early access versions might inadvertently be distributed to all devices fetching definitions from this Connector instance.

To ensure smooth operation and avoid unintended early access updates distribution, please set up a separate Connector instance to serve definitions to the early access agents group, or disable the use of the Connector for devices in the early access group. This limitation will be addressed in future Connector versions.

Installation Options

• First-Time Installers: Available on our Software download page.
• Automatic Channel Upgrade: Scheduled for Monday, May 5th 2025.