Issue:

Software Updater shows error status "Could not download update" in the Policy Manager Console's Software updates tab. 

Resolution:

By default Policy Manager Server downloads the Software Updater updates directly from the vendor's sites. Make sure that the connectivity it not blocked by the servers firewall where you are running Policy Manager Server. 

The Client Security and Server Security host devices can be set to download the Software Updater updates directly from the vendor's sites, bypassing the Policy Manager Server, by following these steps:

1. Log in to the Policy Manager Console 
2. Select a host or policy domain from the domain tree
3. Open the Settings tab
4. Navigate to Windows > Software updater
5. Ifrom the Download software updates from Policy Manager drop-down menu, select If possible
6. Distribute the policy (Ctrl + D)

Now the clients will try to first download the update from the Policy Manager and if that would fail, they will fall back to trying to download the update directly from the vendor's site. 

If clients require a proxy to access the internet, you can set up the proxy settings:

• Centralized management > Internet connections > Use HTTP proxy
• Centralized management > Internet connections > HTTP proxy address

If issues persist, we recommend to look into fspms-software-updater.log on the Policy Manager Server in C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\log to see if there are any obvious download issues. 

You can also collect an wsdiag diagnostic file from the affected devices and view the fssua.log to view Software Updater related issues.

Issue:

Will configuring settings locally on a Linux server with Atlant's atlantctl utility overwrite the settings created in the the Policy Manager's policy?

Resolution:

If a setting for the distributed policy is locked in the Policy Manager, then that setting is enforced and you cannot edit it locally with the atlantctl command-line utility. But, if the setting has not been locked in the policy, then the setting configured previously in the Policy Manager's policy will be overwritten by the local changed setting. 

Issue:

Is it possible to install and run Linux Security 64 or Elements Linux Protection on a Linux machine that is also running Policy Manager Server ?

Resolution:

Yes, any WithSecure Linux client (Linux Security 64 or Elements Linux Protection) can be installed on the same server that is running Policy Manager Server for Linux. There are no conflicts. 

Issue:

How to disable email alerts only for one or few Client Security or Server Security host devices in Policy Manager Console? 

Resolution:

If you do not want to receive email alerts from specific Client Security or Server Security host devices, you can create a new sub policy domain and move the hosts to it. Once done, you can disable the alert forwarding in that sub policy domain. 

How to create a new policy domain in the Policy Manager Console's domain tree:

1. Log in to the Policy Manager Console
2. Right-click an existing policy domain in the domain tree
3. Select New policy domain
4. Enter a name and comment
5. Click OK

Now you can move the hosts for which you don't want to receive email alerts to that policy domain:

1. Right-click the host in the domain tree
2. Select Cut (Ctrl + X)
3. Right-click the policy domain you want to move it to
4. Select Paste (Ctrl + V)

Now you can right-click the new policy domain and select Alert forwarding for domain and then disable the Forward alerts via email setting. 

Issue:

How to hide Server Security system tray icon for Citrix environment end-users so that administrators can still open the Server Security user interface?

Resolution:

To hide the system tray icon, disable the Show local user interface setting via Policy Manager:

1. Log in to Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Windows > Centralized management settings page
5. Scroll down to the Local user interface section
6. Uncheck the Show local user interface setting
7. Distribute the policy (Ctrl + D)

In order to open user interface after changing Show local user interface setting, the administrator can run the fsmaincorporate.exe executable from the product installation folder:
C:\Program Files (x86)\F-Secure\Server Security\ui\wsmain.exe

Issue:

For how long are the items (files) stored in quarantine by Business Suite – Client Security or Server Security? Can the time duration be changed / modified / adjusted? 

Resolution:

By default Business Suite Client Security and Server Security products store the files in the quarantine for 30 days. This setting can be changed from the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab 
4. Navigate to the Windows > Quarantine management settings page
5. Change the Remove items Older Than value
6. Distribute the policy (Ctrl + D)

If you want to disable the quarantine from removing old items automatically. you can from the same settings view disable the Remove Old items Automatically setting.

Issue:

What are the severity levels for each alerts which are sent to the Policy Manager Console by Client Security or Server Security? Are they listed somewhere? The Export alerts descriptions CSV file doesn't include this information. 

Resolution:

INFO:

• offload_scanning_agent.connection.established
• fsav_for_exchange.restored.restore
• connection_control.page.block
• connection_control.connection.block

WARNING:

• network_interceptor.dns.block"
• network_interceptor.ip.block" // Deep Guard
• firewall.fs_rule_triggered.block"
• firewall.fs_rule_application.failed"
• on_access_scanner.error"
• on_access_scanner.update.failed"
• software_updater.reboot.required"
• application_control.settings.error
• integrity_protection.process_modifying_file"
• integrity_protection.file_modified"
• fsav_for_exchange.scanning.error"
• fsav_for_exchange.restoring_error.nothing"
• fsav_for_sharepoint.scanning.error"
• online_safety.suspicious_page.block"
• online_safety.category_page.block"
• on_demand_scanner.error"

FATAL ERROR: 

• pmp.tls_cert_untrusted.nothing

SECURITY ALERT:

• web_traffic_scanning.url.block
• web_traffic_scanning.content_type.block
• deep_guard.malware.block
• deep_guard.admin.block
• deep_guard.user.block
• deep_guard.modifying_settings.block
• deep_guard.modifying_another_process.block
• deep_guard.modifying_file_or_folder.block
• deep_guard.suspicious_behaviour.block
• deep_guard.riskware.block
• deep_guard.rare.block
• deep_guard.network_access.block
• deep_guard.exploit.block
• deep_guard.unwanted_application.block
• deep_guard.ransomware.block
• on_access_scanner.file_infection.nothing
• on_access_scanner.file_infection.block
• on_access_scanner.file_infection.disinfect
• on_access_scanner.file_infection.rename
• on_access_scanner.file_infection.delete
• on_access_scanner.file_infection.quarantine
• on_access_scanner.system_infection.nothing
• on_access_scanner.system_infection.block
• on_access_scanner.system_infection.disinfect
• on_access_scanner.system_infection.rename
• on_access_scanner.system_infection.delete
• on_access_scanner.system_infection.quarantine
• on_access_scanner.spyware.nothing
• on_access_scanner.spyware.block
• on_access_scanner.spyware.disinfect
• on_access_scanner.spyware.rename
• on_access_scanner.spyware.delete
• on_access_scanner.spyware.quarantine
• VIRUS_DEFINITIONS_OLD_ALERT_NAME
• PMP_VIRUS_DEFINITIONS_OLD_ALERT_NAME
• on_access_scanner.reboot.required
• on_access_scanner.protection.malfunction
• on_disinfect.file_infection.disinfect
• on_disinfect.file_infection.rename
• on_disinfect.file_infection.delete
• on_disinfect.file_infection.quarantine
• on_disinfect.system_infection.disinfect
• on_disinfect.system_infection.rename
• on_disinfect.system_infection.delete
• on_disinfect.system_infection.quarantine
• on_disinfect.spyware.disinfect
• on_disinfect.spyware.rename
• on_disinfect.spyware.delete
• on_disinfect.spyware.quarantine
• PMP_SWUP_DB_OLD_ALERT_NAME
• PMP_SWUP_DB_MISSING_ALERT_NAME
• application_control.application_start.block
• application_control.application_start.report
• application_control.module_load.block
• application_control.module_load.report
• application_control.installation_start.block
• application_control.installation_start.report
• application_control.file_access.block
• application_control.file_access.report
• access_control.file.block
• access_control.file.reported
• offload_scanning_agent.connection.error
• offload_scanning_agent.scanning.aborted
• device_control.device.blocked
• device_control.modification.blocked
• device_control.execution.blocked
• fsav_for_exchange.attachment.nothing
• fsav_for_exchange.attachment.delete
• fsav_for_exchange.attachment.stop_message
• fsav_for_exchange.grayware.nothing
• fsav_for_exchange.grayware.disinfect
• fsav_for_exchange.grayware.delete
• fsav_for_exchange.grayware.stop_message
• fsav_for_exchange.suspicious_content.nothing
• fsav_for_exchange.suspicious_content.delete
• fsav_for_exchange.suspicious_content.stop_message
• fsav_for_exchange.virus.nothing
• fsav_for_exchange.virus.disinfect
• fsav_for_exchange.virus.delete
• fsav_for_exchange.virus.stop_message
• fsav_for_exchange.manual.incorrect_admin_credentials
• fsav_for_exchange.quarantine.failed
• fsav_for_exchange.quarantine_storage.size.exceeded
• fsav_for_exchange.quarantine_storage.items.exceeded
• fsav_for_exchange.unsafe_urls.nothing
• fsav_for_exchange.unsafe_urls.stop_message
• fsav_for_sharepoint.suspicious_content.nothing
• fsav_for_sharepoint.suspicious_content.block
• fsav_for_sharepoint.virus.block
• fsav_for_sharepoint.grayware.nothing
• fsav_for_sharepoint.grayware.block
• amsi.infection.block
• amsi.spyware.block
• online_safety.harmful_page.block
• online_safety.illegal_page.block
• online_safety.denied_page.block
• online_safety.unrated_page.block
• product.url.excluded
• product.path.excluded
• tamper_protection.process.block
• tamper_protection.file.block
• tamper_protection.registry.block
• tamper_protection.service.block
• tamper_protection.uninstall.block
• on_demand_scanner.file_infection.nothing
• on_demand_scanner.file_infection.rename
• on_demand_scanner.file_infection.delete
• on_demand_scanner.spyware.nothing
• on_demand_scanner.spyware.rename
• on_demand_scanner.spyware.delete
• connection_control.remote_access.block

Issue:

Can I use environment variables for defining exclusions in Linux for Elements Linux Protection or Linux Security 64?

Example: $HOME/build

Resolution:

Environment values are not supported in exclusions nor in any settings in Linux. Wildcards can be used for on-access scanning exclusions for Elements Linux Protection and Linux Security 64.

To use the example above, /home/*/build would be nearly equivalent to the example provided.

Issue:

How to use the –override-distro parameter to install Elements Linux Protection or Linux Security 64 on an unsupported Linux distribution? 

–help parameter for the linuxsecurity-installer shows:

• –subscription-key=KEY Specify subscription key (required);
• –profile-id=PROFILE-ID Specify profile ID;
• –next-boot Schedule the product to be activated
  on the next boot;
• –override-distro=ID:VERSION-ID Spoof a supported operating system;

Resolution:

The override-distro parameter is mainly to be used to install Elements Linux Protection or Linux Security 64 on a newer version of a particular Linux distribution that WithSecure has not yet added to the officially supported distributions list.

The –help for the installer provides the format for the –override-distro: ID:VERSION-ID.
Examples:

• –override-distro=debian:11 
• –override-distro=rhel:8
• –override-distro=ubuntu:22.04

Even though we provide the means to install Elements Linux Protection or Linux Security 64 on an unsupported Linux distribution, distro override is to be used at your own discretion. If you are facing an issue while or after installing on a Linux distro version that is not yet officially supported, we can't provide support on it.

Issue:

How to check the Policy Manager Server address, HTTP port and HTTPS port which was entered when exporting the Atlant installer from the Policy Manager Console?

Resolution:

Policy Manager (PM) address setting cannot be viewed by atlantctl get command.
Instead, here are some other ways to check their PM address, HTTP port and HTTPS port settings in Atlant.

/var/opt/f-secure/atlant/fsbg/setup/mgmt-mode.json
-> This will show PM address and HTTPS port

/etc/opt/f-secure/atlant/baseguard/updated.ini > [server::policymanager]
-> This will show PM address and HTTP port

Apart from the method mentioned above, it is also possible to check the PM address and its port directly from the process's parameter by running the command below.

# ps aux | grep fsma2