Issue:

What is "suspicious hidden inbox rules" option on inbox rule scanning feature in Collaboration Protection.

Resolution:

Detect suspicious inbox rule where attacker tries to move content between hidden folders to remain undetected.
Attackers use these kinds of rules to manipulate the original mailbox user, remain undetected in the mailbox, and may simultaneously perform internal phishing campaigns using the compromised mailbox.

Issue:

Why does not Elements Collaboration Protection automatically quarantine a high severity email detection, but an email with a medium severity detection is quarantined?

Resolution:

The Elements Collaboration Protection Severity level indicates whether an administrator action is needed to mitigate the immediate risk.

• Low: No action is needed because the item is coming from a trusted source.
• Medium: No action is needed. The item was automatically either quarantined or deleted.
• High: Action required. No automatic action is specified in the policy.
• Critical: Immediate action is required to mitigate the risk.

If some emails are quarantined and not others, it can be that in the policy you have set only specific content (URLs or files) to trigger a quarantine action.

In case of URLs, they are divided into harmful and suspicious in the policy. Both can be given differend actions. 

How to check the action for both malicious and suspicious URLs:

1. Log in to the Elements portal
2. Open the Collaboration Protection section from the menu on the left
3. Go to the Policies page
4. Open the policy that is in use on your cloud service
5. Open the Exchange tab and go to the URL scanning page

Here in the Action section you can make sure that both Malicious URL and Suspicious URL are set to Move the item to quarantine. Take no action would result in the admin having to manually delete or take action on the item (resulting in a high severity classification).

If the email with high severity classification includes a malicious file, make sure that the malware scanning action has been set up to quarantine the file:

1. Open the policy that is in use on the cloud service
2. Open the Exchange tab and go to the Malware scanning page
3. In the Action section, make sure that the action is set to Move whole item into quarantine

Issue:

We have a client where an email address was deleted (in Office 365). Now, I see in the portal that there is a free license available, but when I try to assign the license to another user, it doesn’t seem to be available. Is it possible that the license is still linked to the deleted mailbox? I also cannot delete the user in the portal.

Resolution:

This is caused by Microsoft 365. Our Elements Collaboration Protection simply reflect the status provided by Microsoft. If Microsoft shows the mailbox, everything is fine. If not, we mark it as unavailable until Microsoft restores it. This doesn’t always indicate an issue with the mailbox but rather an incomplete response from Microsoft, which happens frequently. If the "unavailable" status persists for more than 1-2 days, you should verify whether the mailbox still exists (e.g., the AD user behind it may have been canceled or the mailbox may have been terminated).

Whenever a mailbox is unreachable, it is marked as "unavailable." Every 2-3 hours, we request an updated list of resources (mailboxes, sites, etc.) from Microsoft. If a mailbox previously existed in our system but is no longer returned by Microsoft, we mark it as unavailable. This status can occur due to temporary Microsoft issues, which are often resolved within a few hours. By marking mailboxes as unavailable instead of removing them, we can restore them to "unprotected" status if they reappear in future updates without needing to recreate them in the database.

Issue:

In compromised account, there's private and public as breach type shown in the detection detail page.
What do those breach types mean?
 

Resolution:

Private – Breach details are not publicly available on the internet. Attackers are selling for cryptocurrency on Tor forums ("dark web")

Public – Breach details are easily found on the internet. Attackers have shared publicly online e.g. forums for script kiddies, pastebin etc
 

Issue:

What time is the scheduled report generated in Collaboration Protection?

Resolution:

Report generation starts at 3 AM (according to the timezone selected in report task) and takes up to a few minutes.
Generation frequency depends on a frequency selected in report tasks

daily: every day
weekly: every Monday
monthly: every 1st day of a month

Issue:

There are two detections which description in breach details and time of breach are same on Elements Collaboration Protection(ECP).
But Time of detection is different. Time of detections are14.04.2023 and 04.07.2023.

Does it mean that ECP detected same information about the breach twice? 
Are those breaches considered as identical incident?

Resolution:

Yes, these two detections refer to the same incident. The breach only occurred once, but because our breach detection engine have a significant breach information modification, it caused a new detection to be triggered as well.

Issue:

Unable to delete, modify or edit Elements Collaboration Protection policy due to it being read-only or having public visibility. 

Resolution:

If a Elements Collaboration Protection policy has the Read-only tag or Public visibility. it means that it either has been created on the partner level or it is a default WithSecure policy, in which case a user on the company level will be unable to delete or modify the policy (settings are grayed out). The Owner column will show you on which account the policy was created on. 

If the policy is a default policy that has been created by WithSecure, you will not be able to modify it or delete it. 

To delete the policy:

• If you are an end-customer, please ask your WithSecure partner to delete the policy. 
• If you are an WithSecure partner, make sure you are logged in with your partner level user account and that you have selected the partner level from the scope drop-down menu.

To edit a policy:

• If you are an end-customer, you cannot edit policies which are not created by you (settings are greyed out). You can click on the three dots on the right side of the policy to copy it and then assign that newly created policy on your cloud services.
• If you are a WithSecure partner, select the solution provider level from the scope down-down menu (located on the top of the page) to be able to edit the policy.

Issue:

Resolution:

If the detection found except neither Inbox nor Sent, it might cause when the mail was moved directory.
The suspicious emails are automatically scanned depending on the action defined in the security policy.

Issue:

Why is spam / bulk / advertising / phishing email getting through even if Elements Collaboration Protection is in use? Shouldn't spam email be filtered by the spam filter? 

Resolution:

Elements Collaboration Protection does not include a spam filter. Microsoft Office 365 has its own anti-spam policies, of which you can learn more from here: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-worldwide

All the Security Features available in Elements Collaboration Protection are listed in the Help Guide: https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/concept_A2F2B7767CA646668F86D4A6D6C7BB01-latest-en

Issue:

Protection for OneDrive assets are always Unprotected. If we try to enable it manually, after a short time it will goes back to Unprotected status.
This happens a few tenant accounts

Resolution:

In relation to the issue of OneDrive assets losing protection over time, you might want to review the Elements Collaboration Protection permissions in Microsoft Azure for OneDrive. There's possibility permission for the OneDrive assets were revoked and that's why it keeps reverting back to 'Unprotected' status.

In that case, the solution would be to manually disconnect the affected OneDrive service on affected tenant accounts and once it's disconnected, reconnect it and configure protection if needed according to the instruction in this product admin guide:

https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/task_81C9FFE13F4F41C6A0BD117DDA07AE41-latest-en

In order to reconnect the OneDrive service, you will need to use Microsoft admin account for given tenants.

If the issue continues, provide the following information for further assistance.

• Microsoft Azure Active Directory (tenant) ID 
• WithSecure (tenant) ID
• License keys

Follow this guide on how to obtain aforementioned information:

1. Log on to the Elements Security Center https://elements.withsecure.com/
2. Go to Collaboration Protection > Cloud services
3. Select the tenant cloud services
4. The information will be displayed under the Summary tab