Business Suite or Elements Endpoint Protection DeepGuard feature has blocked a safe application

Issue:

Elements Endpoint Protection Agent or Business Suite Client Security / Server Security DeepGuard feature has blocked a safe application. How do I unblock it?

Resolution:

If DeepGuard has blocked a safe application (a false positive), then we still recommend to submit the sample file to our Labs so that we can analyze the file and correct the detection if necessary. 

You can open a ticket using the Sample Validation service in the Elements portal: https://support.withsecure.com/userguides/product.html#business/elements-welcome/latest/en/submitting_a_file_sample-latest-en

If you are sure that the detection is a false positive, you can create a DeepGuard exclusion to immediately get the application working again. How to centrally create the exclusion depends on if you are using Business Suite or Elements Endpoint Protection. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Go to the Security Configurations > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Alternatively, the DeepGuard exclusion rule can be also added using the Security events page:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Exclude folders and files from all security scans list
5. Click Save profile

For Business Suite:

1. Log in to the Policy Manager Console
2. Select a policy domain or host from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning settings
5. Scroll to the Files and applications excluded from scanning table and enable Do not scan the following files and applications 
6. Click Add
7. Set the scope as All scans and select File path from the drop-down menu
8. Add the file path C:\Program Files\Exampleprogram\examplefile.exe and click OK
9. Distribute the policy (Ctrl + D)

On all products, to locally allow an application that DeepGuard has blocked:

1. Open the WithSecure program
2. Click Settings
3. Under the Malware Protection tab, click View quarantine
4. Go to the Blocked tab
5. Select the application that you want Deepguard to allow to run
6. Click Allow
7. Click Close