How to submit a false positive or negative sample file or URL to WithSecure

Issue:

Real-time scanning or DeepGuard has detected a file to be malicious. How to submit a sample file to Virus labs to find out if it is a false positive?

A web site (URL) is blocked by WithSecure either due to its rating (malicious) or category.

What if a possibly malicious file has not been detected, how to submit a sample file to virus labs to find out if it is a false negative?

Resolution:

If you suspect that:

• A clean file or URL has been falsely detected as malicious, or;
• A file or URL that is malicious but has not been detected by our software

you can submit the file for analysis suing the Sample Validation service found in the Elements portal:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Go to the Requests page on the menu on the left
3. Click Create Request
4. Open the Request type drop-down menu and select Submit sample for validation 
5. Open the Sample type drop-down menu and select File or URL
   1. Make sure you selected the correct sample type for the File:
      1. File-Based False Positive: A clean file incorrectly detected as malware. For example, a company’s internal tool flagged as a trojan.
      2. Potentially Unwanted Application (PUA): Legitimate software detected as unwanted. For example, a remote admin or adware-style installer used for business purposes.
      3. File-Based False Negative: A malicious file not detected by the product. For example, a ransomware executable encrypts data without being blocked.
   2. Make sure you selected the correct sample type for the URL: 
      1. URL-Based False Positive: A safe website is blocked by mistake. For example, https://partnerportal.company.com blocked as phishing.
      2. URL Categorization: Request to update or correct the URL category. For example, reclassifying a corporate blog from “Unknown” to “Business.”
      3. Unknown URL: A new or uncategorized domain requiring classification. For example, submitting https://newvendor.io for review.
      4. URL-Based False Negative: A harmful website is not blocked by the product. For example, http://malicious-site.ru remains accessible and serves malware.
   3. All types of sample types and their definitions can be found here: #business/elements-welcome/latest/en/creating_and_viewing_sample_validation_request_in_the_request_views-latest-en.
6. Drag and drop the file or click Browse to upload the file (if File submission)
7. Open the Request reason drop-down menu and select the appropriate reason
8. Open the Product name drop down menu and select the product
9. Add a short title for the request in the Title field.
10. Write down a description of the file or summary of concern
11. Click Create Request

The sample submission is analyzed by our analysts and the databases will be updated if necessary.

You can read more about the Sample Validation service from the user guide: WithSecure User Guides 

Note: If the file is larger than the upload limit, upload it via the Dropzone

• Always use the password infected — this ensures safe handling by security analysts
• Never email the file directly.
• Always upload it through Elements Security Center or the Dropzone in case of sample being larger then 100MB
• Include as much context as possible (where the file came from, what it does, and why you’re submitting it).