Issue:

• When user tries to access some specific web Sites, admin gets alerts in Policy Manager Console that a DNS query was blocked for a domain

• We get error from Policy Manager containing "309    2020-03-22  21:57:47+01:00  SERVER0X SYSTEM  F-Secure Network Filter  1.3.6.1.4.1.2213.11.1.12 Blocked a DNS query for the following unsafe domain:  www.test.com

Resolution:

Note: The notifications you get from F-Secure Policy Manager Server regarding the DNS Filter, are not errors. These are alerts/notifications send from Clients.F-Secure Policy Manager does not generate errors on behalf of clients. Clients generate errors locally, and they only send alerts to Policy Manager.
If the alert forwarding is enabled via Policy Manager, each time a query is blocked, admin will be notified according to that.

This is an expected behavior, and to understand it better, please read the explanation bellow:
DNS queries are based on ORSP rating, so ORSP needs to be activated from Policy Manager Console for all Clients.
How to enable Security Cloud using F-Secure Policy Manager Console:

1. Log in to WithSecure Policy Manager Console and navigate to Advanced view

2. Expand the F-Secure Security Cloud Client Settings and make sure the "allow deeper analyses" and "Client is enabled" is set to "yes" and distribute the policy.

ORSP stands for Object Reputation Service Protocol. When a new object, such as a file or URL, is encountered on one client, the product communicates with the Security Cloud using the strongly encrypted Object Reputation Service Protocol (ORSP) to query for the object's reputation details. Anonymous metadata about the object, such as file size and anonymized path, are sent to the Security Cloud. You may find more information about the Security Cloud here: https://www.f-secure.com/en/web/legal_global/privacy/security-cloud

Botnet blocker works on the level of DNS resolution and IP address filtering.
When DNS filtering is enabled, we don't allow to resolve DNS addresses if we know these DNS addresses are not safe.
When IP reputation filtering is enabled, we block connections to IP addresses for which we have reputation in ORSP.
When you allow all queries, it means you have disabled DNS filter, by doing this you are disabling DNS scanning on NIF (Network interception Framework) level.
If you set to example „Allow safe queries only „it might still block local DNS.
DNS record information is usually cached (stored on your local browser, computer or network forwarder) for a specific amount of time; anywhere from 5 minutes to 8 hours is normal.

• block unsafe => unknown, susp, safe will go thru.

• unsafe (malicious) are blocked Block unsafe, susp => unknown and safe go thru.

• unsafe (malicious) and suspicious are blocked allow safe only => only safe rated go thru. unknown, suspicious, unsafe (malicious) are blocked

Blocking botnet communication

Botnet Blocker is a security feature that aims to prevent botnet agents from communicating with their command and control servers.
The feature uses DNS reputation data to verify the security of queries when translating DNS requests to IP addresses.
To configure Botnet Blocker in Standard view:

1. On the Settings > Web traffic scanning page, go to Botnet blocker

2. Set the filtering to use for DNS queries.

By default, this set to Block unsafe queries.

1. Set the alert level to use for notifications of blocked DNS queries.

2. Distribute the policy:

You can choose what works for you best, you have different option in Policy Manager Console:

Issue:

By default, Linux distributions set a umask of 022. However, if this is modified e.g. to harden the underlying system, it can cause a problem where the Automatic Update Server process (bwserver) fails to start. This is due to the process bwserver not being able to read its own config-file /etc/opt/f-secure/fsaus/conf/server.cfg.

This will prevent legacy clients from downloading updates from the Policy Manager Server. Legacy clients include:

• Email and Server Security version 12.x and older 
• Server Security 12.x and older
• Client Security versions older than 13.x.

Resolution:

The workaround is to manually set the permission for server.cfg after installation and restart the fspms daemon.

As root execute the following commands:

# chown fspms.fspms /etc/opt/f-secure/fsaus/conf/server.cfg
# /etc/init.d/fspms restart

Issue:

Other Anti Virus is showing different result in Virus Total
　
Virus Total
https://www.virustotal.com/gui/home/upload

Resolution:

The criteria of maliciousness is different in each antivirus software.
If you really want to check the file, please submit the file to SAS.

https://www.f-secure.com/en/business/support-and-downloads/submit-a-sample

Issue:

MSI product code for WithSecure Client Security is generated each time differently when the installation package is created.

This is troublesome as I need to include a number of MSI product codes in the SCCM's detection method, to detect the existing installation of WithSecure Client Security.

Other than using the MSI product code, what's your recommendation to create the detection method in SCCM?

Resolution:

You can use the custom made type of detection method, based on the product registry. We recommend to use the following detection methods:

1. Using the product registry detection, whereby the product version is being kept at the following registry:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\F-Secure\NS\default\OneClient\Version(REG_SZ)

For example, to detect the existing installation of F-Secure Client Security 15.20 installed on the device

Issue:

Policy Manager Server upgrade to 16.00 fails if previous 15 version installation is not on default C:\ drive.

If for example Policy Manager Server has been installed on the E:\ drive, the upgrade fails and after launching Policy Manager Console, user in greeted with an empty policy Domain Tree. 

During the 15.x -> 16.00 upgrade, user is asked to enter TCP-ports, which should not happen when upgrading an existing Policy Manager Server installation. 

Resolution:

You may use 16.01 with the TARGETDIR msi parameter to install 16.01 to the alternative location using the guide https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_6124FC32495E494B9AE5352EBAB7E1A2-16.00-en

Note – Regarding the default data directory, it is always in %ProgramData% location. 

Issue:

Policy Manager Server temporarily loses contact to the Active Directory (AD) Server. This causes the AD user accounts to be at some times unable to log in to Policy Manager Console. 

User gets error: com.fsecure.fsa.SessionStartException: Cannot connect to the server: authorization failed because the specified user credentials are invalid.

Resolution:

1. Verify Connection and Address:

   • Ensure proper network connectivity exists between the Policy Manager Server and the Active Directory server.
   • Double-check the LDAPS address configured in the Policy Manager Server. The address in the error message ("LDAPS://EXAMPLEADDRESS.COM") should match the actual server address.

2. Update Active Directory Address Using H2 Console (if address mismatch):

   Important: Back up your registry before making any changes. Refer to the F-Secure Policy Manager documentation for instructions on registry backup: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_F3496EC8C79842E1B5A479E8D195E8A5-16.00-en

   Enable H2 Console:

   1. Close the Policy Manager Console (if open).
   2. Stop the Policy Manager Server service.
   3. Open the Registry Editor (regedit).
   4. Locate the appropriate registry key based on your Policy Manager version:
      • For Policy Manager 15: HKEY_LOCAL_MACHINE\SOFTWARE(Wow6432Node)\Data Fellows\F-Secure\Management Server 5\additional_java_args
      • For Policy Manager 16: HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\additional_java_args
   5. Edit the "additional_java_args" value.
   6. Add the following parameter: -Dh2ConsoleEnabled=true
   7. Close the Registry Editor and start the F-Secure Policy Manager Server service.

   Open H2 Console:

   1. Open a web browser (Internet Explorer or Firefox).

   2. Navigate to https://<PolicyManagerServerIP>:<AdminPort>.

      • Replace <PolicyManagerServerIP> with the actual IP address of the Policy Manager Server.
      • Replace <AdminPort> with the configured administration port (default: 8080). You can use localhost if accessing from the Policy Manager Server itself.

   3. Select the domain.

   4. Execute the following SQL statement:

      SQL

      SELECT * FROM ACTIVE_DIRECTORY_SERVERS;
      

   5. Click the edit button (pen icon) for the relevant entry.

   6. Update the "LDAPS Address" field with the correct address.

   7. Save the changes.

The Policy Manager Server should automatically start using the updated LDAPS address after saving the changes in the H2 Console.

Additional Notes:

• This article provides a general guideline. Refer to the F-Secure Policy Manager documentation for detailed instructions specific to your version.
• If the issue persists after following these steps, contact F-Secure Support for further assistance.

Issue:

After a scheduled scan of Client Security or Server Security host, Policy Manager Console Alerts page's description field shows "Malicious code found in file. No action taken" 

Resolution:

If the infections without any action taken are either items inside an compressed archive (ZIP, RAR, 7z, CAB) or temporary files, scan engine will not extract the file from archive just to deleted instead it will be reported as infected and no action taken. In case of temporary files it could be that item was already removed by system when the engine tried to delete it. 

You can also open the full scanning report and check of the following is shown for the file: "Skipped – potentially unwanted applications are not removed automatically"

WithSecure endpoint protection software does not automatically remove Potentially Unwanted Applications. It will detect them but the decision to remove and the actions are left for the administrator. 

Issue:

The Policy Manager Console runs slow and sometimes it's unable to connect to the Policy Manager Server

Resolution:

Make sure your Policy Manager Server and Policy Manager Console are the same versions, otherwise the connection will not work.

If both Policy Manager Sever and Policy Manager Console are the same versions, the performance issues could be due to having a very high number of alerts, or a very high volume of scanning reports being kept in the Policy Manager Server. This would slow down the console. 

You may remove some of the alerts or scanning reports to improve the performance.

If the above mentioned steps do not help, please proceed with the following:
Policy Manager 15.x and earlier:

1. Stop the F-Secure Policy Manager Server service.
2. Backup the H2DB folder (…\F-Secure\Management Server 5\data\h2db). DO NOT proceed further without having a working H2DB backup in place.
3. Run the database maintenance tool (…\F-Secure\Management Server 5\bin\fspms-db-maintenance-tool.exe) and follow the on-screen instructions to optimize the database.
4. Start the F-Secure Policy Manager Server service.
5. Log in to the Policy Manager Console.

In case the issue remains, you can execute the H2DB recovery tool (…\F-Secure\Management Server 5\bin\fspms-db-recover.bat) in the Windows command prompt to repair the H2DB.
Note: Make sure to stop the F-Secure Policy Manager Server service before running the tool.

If necessary, you can refer to the read me file (..\F-Secure\Management Server 5\bin\README-recover-db.txt) on how to execute the H2DB recovery tool.

Policy Manager 16.x and above :

1. Stop the WithSecure Policy Manager Server service (net stop wspms).
2. Back up the H2DB folder (`C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\h2db\`). DO NOT proceed without a working H2DB backup.
3. Run the database maintenance tool (`C:\Program Files\WithSecure\Policy Manager\Policy Manager Server\bin\fspms-db-maintenance-tool`) and follow the on-screen instructions to optimize the database.
4. Start the WithSecure Policy Manager Server service(net start wspms).
5. Log in to the Policy Manager console.

If the problem persists, you can run the H2DB recovery tool (C:\Program Files\WithSecure\Policy Manager Server\bin\fspms-db-recover.bat) in the Windows command prompt to repair the H2DB database.

Note: Make sure you stop the WithSecure Policy Manager Server service before running the tool.

If necessary, you can refer to the read me file (C:\Program Files\WithSecure\Policy Manager Server\bin\README-recover-db.txt) for instructions on how to run the H2DB recovery tool.

Once you have finished repairing the H2DB using the tool, you can proceed to take the repaired H2DB into use, restarting the F-Secure Policy Manager Server service after doing so.
Try to login to the Policy Manager Console again after the service has been started.

Issue:

Trying to send emails through MSG results in the following Non-Delivery Report (NDR) message:
SMTP Protocol Returned a Permanent Error 550 5.7.0 Blocked – see https://ipcheck.proofpoint.com/?ip=<ip.address.goes.here>

Resolution:

The sending IP-address has been blocked by Proofpoint Dynamic Reputation (PDR). This can be double-checked by visiting the page https://ipcheck.proofpoint.com
The section About Proofpoint® Dynamic Reputation (PDR) contains more information about the function as well as a link to an FAQ-page with common questions and answers, for example what to do to prevent this from happening.

To get the situation investigated quicker, open a support ticket with F-Secure. Include the IP that is blocked and information about how long the situation has been ongoing.

Issue:

Smart Search reports that search fails and there are repeated eid.general-errors in the MSG alert viewer

The errors have the following rawlog-data:

[] err src=admin mod=CloudSearch sub=getResults err="Service unavailable"
[] err src=admin MISUtil::getIndexList failed. Response code: 503. url: https://:10000/mis/_stats/store

Resolution:

These messages could be a result of the Smart Search service being stopped. This might be the result of a system update or patch causing the service to hang.

To check if the Smart Search service is running:

1. Log in to the MSG Web UI
2. Select the System-tab
3. Navigate to System -> Servers using the left-side menu
4. Click the plus-sign next to the server names to expand information about their running services (Smart Search by default runs on the configuration master)
5. Check the status of the service pss
6. If it is stopped, use the Start-button to the right in the action-column to attempt a restart. Trying this a few times might be needed

If the service doesn't start, open a support ticket. Also make sure that the following support IP-addresses can access the MSG-appliance on ports 22 and 10000:

203.112.232.170                 F-Secure Support / Kuala Lumpur
193.110.108.33                   F-Secure Support / HTC Helsinki
208.86.202.10                     Proofpoint
208.84.66.21                       Proofpoint
208.84.67.21                       Proofpoint