Issue:

Can we hide Elements Agent user interface in Windows when it has been installed with stand-alone Exposure Management subscription key? We would want the user to not see any WithSecure icon in the system tray or have any visible pop-up windows.

Resolution:

Yes you can hide the Elements Agent user interface even if it has been installed with an Elements Exposure Management stand-alone subscription key. The Elements profiles still control the user interface even if the device wouldn't have any Endpoint Protection or Endpoint Detection and Response features enabled. 

Follow these steps to hide the Elements Agent user interface and tray icon:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security configurations > Profiles page
3. Click Create a profile
4. Give the profile a name
5. Go to the General settings page
6. Disable Show user interface to clients
7. Click Create profile
8. Go to the Environment > Devices page
9. Select the devices you want to assign the profile to (an Actions menu will appear)
10. Click Assign profile 
11. Select the profile 
12. Confirm by clicking Assign profile

Now the devices which you have assigned the profile to will have the user interface hidden and no tray icon will be shown.

Issue:

How to configure sending of Elements Exposure Management scan notification emails to multiple recipient email addresses? 

Resolution:

If you want to have the email notifications to be sent to multiple recipient email addresses when either a Discovery Scan or a Network Scan (System scan / Web Scan) has started or finished, you can follow the steps below. 

For Network scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans page
3. Select the Network scans tab
4. Click on the three dots for a scan group 
5. Select Edit scan group 
6. Go to the Notifications step
7. Enable notifications
8. Select if you want to send the notification when:
   1. Scan starts
   2. Scan ends 
   3. Scan starts or ends
9. Enter the recipient email addresses separated by a comma:
   1. user1@example.com, user2@example.com, user3@example.com
10. Finish the setup

For Discovery scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans page
3. Select the Discovery scans tab
4. Click on the three dots for a discovery scan
5. Click Edit scan settings 
6. Go to the Other settings step
7. Enable Notifications 
8. Select if you want to send the notification when:
   1. Scan starts
   2. Scan ends 
   3. Scan starts or ends
9. nter the recipient email addresses separated by a comma:
   1. user1@example.com, user2@example.com, user3@example.com
10. Click Save and close

Issue:

I receive the following error when trying to access the Exposure Management in the Elements Security Center:

No access rights.
You do not have rights to Exposure Management content of this organization.
No permission You don't have access to view this page. Please contact your organization administrator to receive access

Resolution:

Ensure that you have valid subscription for Elements Exposure Management. If you have an expired commercial or trial subscription for Elements Exposure Management but you still have Elements Exposure Management access rights, you will receive "No access rights – Failed to fetch" errors when you try to access pages meant for Elements Exposure Management.

You can check the validity of your Elements Exposure Management subscription from the Management > Subscriptions page in the Elements portal

If you have a valid Elements Exposure Management subscription, ensure that your user has the following access rights (roles):

• Exposure Management – Exposure (admin)
• Exposure Management – Vulnerabilities (role)

The access rights can be checked by following these steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Management > Organization Settings > Security Administrators page
3. Click on the user's email address
4. Check that the user has both enabled:
   1. Exposure – Full Editing
   2. Vulnerabilities – Management or Team member
5. Click close 

If you are partner, check if the error only occurs when selecting a specific company from the scope-selector drop-down menu. 

Issue:

We have enabled Vulnerability Management scan (agent based scanning) on our devices which have Elements Agent installed, and the CPU usage is very high when the Vulnerability Management agent is scanning. What can we do to improve the performance? 

Resolution:

By default, Elements agent will run the vulnerability scan every 4 hours. You can change the vulnerability data refresh schedule on the endpoints to either 6 hours, 12 hours or 24 hours. This way any performance issues wouldn't happen as often.,

To change the setting on how often the Elements Agent scans for vulnerabilities:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Vulnerability Settings page
3. Go to teh General settings tab
4. Expand the Miscellaneous section
5. Select the desired time from the Vulnerability data refresh schedule on endpoints drop-down menu

Note: this setting affects all installed WithSecure Elements Agents, but it will not apply to the ones installed in future.

WithSecure Elements Agent is installed on the client device to scan for vulnerabilities. The first scan happens right after you enable scanning on a device in the management portal. Next scans happen after any major change on the list of installed software or in time interval chosen from the Vulnerability data refresh schedule on endpoints. 

If there are no changes in the scan results, the scan report is postponed to avoid processing the same results again. Regardless of the changes, a scan report with the up-to-date vulnerability status is sent to the management portal after 7 days. 

Issue:

When a customer's Elements Exposure Management subscription is terminated or has expired, is the customer's exposure / vulnerability related data (or part of it) immediately lost or will the data still be available if the licenses are renewed again later?

Resolution:

There is a 4 month period (120 days) when you are able to re-activate the license/company if needed, after that everything is deleted. A subscription key is automatically removed from the Elements Security Center portal after the subscription has been expired for 120 days. After a company account has no subscription keys, the account will be automatically removed from the Elements Security Center portal. 

Issue:

On a Windows computer, application loading / startup is slow or does not work at all when DeepGuard feature is enabled. What can be done if a software is having issues when DeepGuard is enabled? 

Resolution:

We recommend to check and ensure that the Security Cloud is enabled and that the endpoints are able to connect to the Security Cloud. 

You need to ensure that the connectivity to the Security Cloud. 

If necessary, you can run the Connectivity Tool to validate the connectivity state to the WithSecure services backend:

• Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
• Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
• Elements EPP for Computers and Elements EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\fsconnectionchecker.exe

Other than this, you may exclude the application from being monitored by DeepGuard by creating an exclusion for the application. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Server Configuration > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Note that you can use wildcards when creating the exclusions. For example: C:\Users\*\AppData\Local\test\ 

For Business Suite products (Client Security and Server Security):

1. Log in to Policy Manager Console
2.  Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Navigate to Windows > Real-time scanning 
5. Scroll down to the Files and application excluded from scanning table
6. Enable Do not scan the following files and application 
7. Click Add from the right side of the table 
8. Select:
   1. File path if you want to enter the full file path to the application
   2. Application SHA-1 if you want to enter the SHA-1 hash value of the application to exclude it anywhere on the system
9. Click OK
10. Distribute the policy (Ctrl + D)

Issue:

Elements Endpoint Protection Agent or Business Suite Client Security / Server Security DeepGuard feature has blocked a safe application. How do I unblock it?

Resolution:

If DeepGuard has blocked a safe application (a false positive), then we still recommend to submit the sample file to our Labs so that we can analyze the file and correct the detection if necessary. 

You can open a ticket using the Sample Validation service in the Elements portal: https://support.withsecure.com/userguides/product.html#business/elements-welcome/latest/en/submitting_a_file_sample-latest-en

If you are sure that the detection is a false positive, you can create a DeepGuard exclusion to immediately get the application working again. How to centrally create the exclusion depends on if you are using Business Suite or Elements Endpoint Protection. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Go to the Security Configurations > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Alternatively, the DeepGuard exclusion rule can be also added using the Security events page:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Exclude folders and files from all security scans list
5. Click Save profile

For Business Suite:

1. Log in to the Policy Manager Console
2. Select a policy domain or host from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning settings
5. Scroll to the Files and applications excluded from scanning table and enable Do not scan the following files and applications 
6. Click Add
7. Set the scope as All scans and select File path from the drop-down menu
8. Add the file path C:\Program Files\Exampleprogram\examplefile.exe and click OK
9. Distribute the policy (Ctrl + D)

On all products, to locally allow an application that DeepGuard has blocked:

1. Open the WithSecure program
2. Click Settings
3. Under the Malware Protection tab, click View quarantine
4. Go to the Blocked tab
5. Select the application that you want Deepguard to allow to run
6. Click Allow
7. Click Close

Issue:

Can a standard user without admin rights / privileges manually install patches or updates using the Software Updater feature? The Software Updater can show these updates to be available to standard user on the local user interface (GUI), but how can a standard user install them? 

This article is valid for:

• Elements Endpoint Protection (Elements EPP for Computers and Elements EPP for Servers)
• Business Suite (Client Security and Server Security)

Resolution:

Local users require administrator privileges to be able to manually start installing software updates from the local graphical user interface for Elements Agent, Client Security or Server Security. 

There are a few options how to handle such scenarios:

• User can contact the administrator and request the administrator to install an update using the Elements Security Center portal or Policy Manager Console
• User can provide administrator credentials when elevation is prompted and install the software update locally using the Software Updater view in the local graphical user interface.
• IT administrator should have Software Updater scheduled to install patches automatically

Issue:

Can Policy Manager Server coller BitLocker recovery keys from hosts which have Client Security or Server Security installed on them

Resolution:

Business Suite products Policy Manager Server, Client Security and Server Security do not have system drive encryption features, so it cannot collect the BitLocker recovery keys from the devices. 

Elements Security Center portal has this feature, so if you have Elements Agent installed on the devices with a Premium Elements Endpoint Protection subscription, you can collect the recovery keys from the devices and find them in the Elements Security Center portal on the device details page.  

Issue:

How to allow users to make settings changes locally in the Client Security or Server Security graphical user interface (GUI)?

Resolution:

To allow a local Client Security or Server Security user with administrator privileges to change the settings locally in the graphical user interface, you need to leave the setting unlocked in the Policy Manager policy that has been distributed to the host. 

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Expand the Windows settings section

Here you can open each settings section, for example Real-time scanning or Manual scanning. In the right side of most of the settings you can find a lock icon. When the lock is left in an unlocked state, it means that the local user is able to change this setting if it is available in the local Client Security or Server Security user interface and if the user has local administrator rights. 

Note: Not all settings are available in the local user interface. For example Device Control, Application Control and Web Content Control settings cannot be at all found in the local user interface of Client Security or Server Security.

Issue:

Does Linux Security 64 support installation on an Security-Enhanced (SELinux) Ubuntu distribution?

Resolution:

Linux Security 64 does not support Ubuntu distribution if it is running a SELinux system policy. You can find the supported SELinux distributions in the user guide:  System requirements | Linux Security 64 | Latest | WithSecure User Guides 

Issue:

After the deployment of Cloud Protection for Salesforce 2.0 tried to import leads into Pardot with the help of an integration user they get the following error message: "Custom Validation Exception: WithSecure Cloud Protection: Your message cannot be processed because you do not seem to have the Cloud Protection User permission set assigned.
Please contact your administrator for help.
 

Resolution:

If the installed version of the app is 2.5 or above, assign “WithSecure Cloud Protection Integration User“ permission set to the integration user. 

If the installed version of the app is 2.4.1 or below 

1. Clone the WithSecure Cloud Protection Admin permission set and remove the access for Visualforce page at the cloned permission set 

2. Assign the cloned permission set and “WithSecure Cloud Protection Connected App” to the integration user 

Alternatively, you may consider changing the user type to Standard User. 
 
As for the need to update the permission set for each release : This is not something frequently required. Connected App permission set will need the access of certain apex API services. But they are introduced very rarely (Ex: ATA).

Issue:

WithSecure is using Future Method to run scans and clashes with custom scripts that also uses Future Method. Any suggestions on how to resolve this?

Resolution:

By default Cloud Protection for SalesForce uses Queueable Jobs for invoking email attachment scan. However if Future Method was called, this means that the limits of Queueable jobs has been reached so WithSecure App switches to using Future Method instead. It is not possible to call Future Method from a Future Method as they are asynchronous.

We suggest to use the Queueable interface instead of a Future Method for custom scripts. The Queueable interface allows chain jobs, meaning WithSecure job could be started without the system exception from custom jobs. 

Issue:

Salesforce stores "documents" in three different objects: ContentVersion (aka Files), Document, Attachment. WithSecure Cloud Protection for Salesforce does not appear to be checking Documents uploaded via API or Manually. It is testing ContentVersion and Attachment.

Resolution:

This is by design. WithSecure Cloud Protection for Salesforce only scans files stored as ContentDocument / ContentVersion and Attachment objects. We do not plan to add support for Document objects as Salesforce told us earlier that they would discontinue this file storage in the future. In the long-run, Salesforce plan to have only one file storage based on ContentDocument / ContentVersion objects, which provide better security and usability.