Issue:

Do WithSecure endpoint products have a Host-based Intrusion Prevention System (HIPS) function?

Products:

• Elements Endpoint Protection (Elements EPP for Computers and Servers)
• Business Suite Client Security and Server Security

Resolution:

Yes, WithSecure product such as Elements Endpoint Protection, Client Security and Server Security do have a Host-based Intrusion Prevention System (HIPS).

The feature is called DeepGuard and instead of relying solely on traditional signature-based detection (which checks files against a database of known threats), DeepGuard acts as a behavioral layer of security. It monitors applications in real-time to intercept and block unknown or zero-day threats based on how they act.

Issue:

Where can I find information about which Elements and Business Suite product versions are supported? 

Resolution:

The supported product versions for Elements and Business Suite are listed on the WithSecure Supported product versions page: Supported product versions – WithSecure™ 

To read about our general product lifecycle policies for our products, you can read our General product lifecycle policies page: General product lifecycle policies – WithSecure™ 

Issue:

How to view a list of all users who have access to a company's eService portal? 

Resolution:

At least one user in the company should be assigned as the eService admin user. This user will have the User Management tab visible in the WithSecure eService portal. From the User Management tab you can view and manage the current members. 

If you do not know who in your company has the eService admin user rights, please contact your WithSecure Customer Experience Manager. 

Issue:

How to block all USB mass storage devices (USB flash drive / stick) with the Device Control feature?

Resolution:

To block all USB Mass Storage Devices with the Elements Endpoint Protection Device Control feature:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > profiles page
3. Open the profile that is in use on the devices
4. Go to the Device control settings page
5. In the Device access rules section, change the Access to device value for USB Mass Storage devices from Allow to Block
6. Click Save profile

To Block all USB Mass Storage Devices with the Client Security or Server Security Device Control feature via a Policy Manager policy:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Open the Settings tab
4. Navigate to Windows > Device control
5. In the Device access rules table, change the Access level for USB Mass Storage Devices from Full access to Blocked 
6. Distribute the policy (Ctrl + D)

Issue:

Is is possible to run the WithSecure Quarantine Dumper Tool(wsdumpqrt.exe / wsdumpqrt64.exe) be run remotely?

Resolution:

The WithSecure Quarantine Dumper tool can't be used remotely. Currently the tool is designed to be used locally only, so you need to download and run the tool on the device itself with administrator privileges. 

If you have remote administrator access to the device, you can log in to the device and run the tool that way. 

Collect quarantined files using WithSecure Quarantine Dumper by following the instructions below:

1. Click on this link to download  to a location of your choice, for example, c:\temp:
   • 32bit version: https://download.withsecure.com/support/tools/wsdumpqrt/wsdumpqrt.exe
   • 64bit version: https://download.withsecure.com/support/tools/wsdumpqrt/wsdumpqrt64.exe
2. Launch Command Prompt (CMD).
3. Navigate the directory to the location you selected in step 1. For example, type cd c:\temp\ and press Enter on your keyboard to go to c:\temp\ folder.
4. Type wsdumpqrt.exe -d c:\temp\ to run the tool.
5. Enter your administrator credentials when prompted. WithSecure license terms are now shown.
6. Scroll all the way to the end of the license terms before you can accept them.
7. Press E on your keyboard to accept the license terms.
8. Press any key to complete the run. The quarantined files will be collected in a file named malware_samples.zip with the default password (infected) in the location you specified in step 1. 

Issue:

Can a standard user without admin rights / privileges manually install patches or updates using the Software Updater feature? The Software Updater can show these updates to be available to standard user on the local user interface (GUI), but how can a standard user install them? 

This article is valid for:

• Elements Endpoint Protection (Elements EPP for Computers and Elements EPP for Servers)
• Business Suite (Client Security and Server Security)

Resolution:

Local users require administrator privileges to be able to manually start installing software updates from the local graphical user interface for Elements Agent, Client Security or Server Security. 

There are a few options how to handle such scenarios:

• User can contact the administrator and request the administrator to install an update using the Elements Security Center portal or Policy Manager Console
• User can provide administrator credentials when elevation is prompted and install the software update locally using the Software Updater view in the local graphical user interface.
• IT administrator should have Software Updater scheduled to install patches automatically

Issue:

How or where to buy WithSecure products if we are a new potential customer? How do I find a reseller partner? 

Resolution:

WithSecure products are sold via reseller partners. If you are interested in WithSecure products and you are thinking of buying, you can fill the contact form on the WithSecure home page and our sales can be in touch with you so that we can find a suitable reseller partner for you: Contact WithSecure | We Are Here to Help 

Issue:

We're looking for a way to verify the Browsing Protection Web Content Control categorization of an website address (URL). Does WithSecure have an online tool that allows a user to check the categorization of a website? How or where to check to which Web Content Control category a website belongs to?

Resolution:

WithSecure does not have a service or tool to view what Web Content Control categories are set for a specific web site or what the site is rated as in the Security Cloud. If a website is blocked by Web Content Control, the user will be shown a block page in their browser, which informs the user which categories are blocking the user from accessing the web site. To be able to show the block page on HTTPS web sites, the Browsing Protection by WithSecure browser extension is required to be installed and enabled in the browser. 

The Web Content Control is a part of the WithSecure Browsing Protection feature which blocks phishing, scam and malicious web sites. Malicious sites can be various, for example: website injected with coin mining, URL for download malicious files and so on which might harmed our users.

Issue:

I would like to remove a user from Partner Portal. How to deactivate user if they no longer work for the partner? 

Resolution:

At least one user from the reseller partner is designated as an administrator in the Partner Portal. 

A Partner Portal admin user can remove Partner Portal access rights for a user, but to fully remove the user you need to open a User Management Assistance support case through the Partner Portal.

How to remove user rights in the Partner Portal: 

1. Log in to the Partner Portal
2. Click on your username in the top-right corner 
3. Select Account Management 
4. Click Edit Member 
5. Select the member from the list and click Next 
6. Click on the portal roles you want to remove and click Save 

Note: Academy & Support User role cannot be removed. 

Issue:

Do WithSecure endpoint products scan emails for infections or viruses?

This article applies to:

• Business Suite: Client Security / Server Security
• Elements Endpoint Protection: EPP for Computers and EPP for Servers 

Resolution:

WithSecure endpoint products do not scan emails immediately. Real-time scanning will automatically start when you run a file from an email, and will scan it before allowing the file to open or execute.