Issue:

Elements Endpoint Protection Agent or Business Suite Client Security / Server Security DeepGuard feature has blocked a safe application. How do I unblock it?

Resolution:

If DeepGuard has blocked a safe application (a false positive), then we still recommend to submit the sample file to our Labs so that we can analyze the file and correct the detection if necessary. 

You can open a ticket using the Sample Validation service in the Elements portal: https://support.withsecure.com/userguides/product.html#business/elements-welcome/latest/en/submitting_a_file_sample-latest-en

If you are sure that the detection is a false positive, you can create a DeepGuard exclusion to immediately get the application working again. How to centrally create the exclusion depends on if you are using Business Suite or Elements Endpoint Protection. 

For Elements Endpoint Protection:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Go to the Security Configurations > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Alternatively, the DeepGuard exclusion rule can be also added using the Security events page:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Exclude folders and files from all security scans list
5. Click Save profile

For Business Suite:

1. Log in to the Policy Manager Console
2. Select a policy domain or host from the Domain Tree
3. Go to the Settings tab
4. Go to the Real-time scanning settings
5. Scroll to the Files and applications excluded from scanning table and enable Do not scan the following files and applications 
6. Click Add
7. Set the scope as All scans and select File path from the drop-down menu
8. Add the file path C:\Program Files\Exampleprogram\examplefile.exe and click OK
9. Distribute the policy (Ctrl + D)

On all products, to locally allow an application that DeepGuard has blocked:

1. Open the WithSecure program
2. Click Settings
3. Under the Malware Protection tab, click View quarantine
4. Go to the Blocked tab
5. Select the application that you want Deepguard to allow to run
6. Click Allow
7. Click Close

Issue:

Real-time scanning or DeepGuard has detected a file to be malicious. How to submit a sample file to Virus labs to find out if it is a false positive?

A web site (URL) is blocked by WithSecure either due to its rating (malicious) or category.

What if a possibly malicious file has not been detected, how to submit a sample file to virus labs to find out if it is a false negative?

Resolution:

If you suspect that:

• A clean file or URL has been falsely detected as malicious, or;
• A file or URL that is malicious but has not been detected by our software

you can submit the file for analysis suing the Sample Validation service found in the Elements portal:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Go to the Requests page on the menu on the left
3. Click Create Request
4. Open the Request type drop-down menu and select Submit sample for validation 
5. Open the Sample type drop-down menu and select File or URL
   1. Make sure you selected the correct sample type for the File:
      1. File-Based False Positive: A clean file incorrectly detected as malware. For example, a company’s internal tool flagged as a trojan.
      2. Potentially Unwanted Application (PUA): Legitimate software detected as unwanted. For example, a remote admin or adware-style installer used for business purposes.
      3. File-Based False Negative: A malicious file not detected by the product. For example, a ransomware executable encrypts data without being blocked.
   2. Make sure you selected the correct sample type for the URL: 
      1. URL-Based False Positive: A safe website is blocked by mistake. For example, https://partnerportal.company.com blocked as phishing.
      2. URL Categorization: Request to update or correct the URL category. For example, reclassifying a corporate blog from “Unknown” to “Business.”
      3. Unknown URL: A new or uncategorized domain requiring classification. For example, submitting https://newvendor.io for review.
      4. URL-Based False Negative: A harmful website is not blocked by the product. For example, http://malicious-site.ru remains accessible and serves malware.
   3. All types of sample types and their definitions can be found here: #business/elements-welcome/latest/en/creating_and_viewing_sample_validation_request_in_the_request_views-latest-en.
6. Drag and drop the file or click Browse to upload the file (if File submission)
7. Open the Request reason drop-down menu and select the appropriate reason
8. Open the Product name drop down menu and select the product
9. Add a short title for the request in the Title field.
10. Write down a description of the file or summary of concern
11. Click Create Request

The sample submission is analyzed by our analysts and the databases will be updated if necessary.

You can read more about the Sample Validation service from the user guide: WithSecure User Guides 

Note: If the file is larger than the upload limit, upload it via the Dropzone

• Always use the password infected — this ensures safe handling by security analysts
• Never email the file directly.
• Always upload it through Elements Security Center or the Dropzone in case of sample being larger then 100MB
• Include as much context as possible (where the file came from, what it does, and why you’re submitting it).

Issue:

How to release or remove a file from the Quarantine list via the client's Graphical User Interface (GUI)?

Resolution:

Note: These instructions are valid for:

• Business Suite Client Security 14 and later
• Business Suite Server Security 14 and later
• Elements Endpoint Protection (EPP for Computers and EPP for Servers) 

Follow these steps:

1. Open the graphical user interface (you may click on the client icon in the Windows system tray)
2. Click open settings
3. Under Malware Protection, click View Quarantine
4. Select the Quarantined tab
5. Select the file, and click on Allow or Remove

Administrator privileges will be required to perform the action. The function is also dependent on the settings set from the Policy Manager or the Elements Endpoint Protection Portal.

If the Allow and Remove buttons are grey, the operation has not been allowed by the administrator.

For Elements Endpoint Protection, the following End user rights setting must be set to unlocked for the Allow button to not be gray:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the General > End user rights settings page
5. In the Scanning settings section, unlock Global exclusions
6. Click Save profile

Issue:

How can a Partner Portal user who already has the main admin role give the same admin role rights to an another Partner Portal user? 

Resolution:

A Partner Portal admin user can give the admin role to an another user by following these steps: 

1. Log in to the Partner Portal
2. Click on the user name in the top-right corner 
3. Go to Account Management 
4. Click Edit Member 
5. Select a member from the list and click Next 
6. Select the Admin user role from the Update Portal Roles section
7. Click Save 

Issue:

Customer's own (developed) file causes a false positive detection by the WithSecure Endpoint Protection (EPP for Computers or Servers) and Busines Suite (Client Security and Server Security) products. 

Resolution:

To solve the issue, firstly sign the file with a digital signature certificate and then submit the file to the WithSecure labs using the Sample Validation service in the Elements Security Center portal 

You can submit the file for analysis suing the Sample Validation service found in the Elements portal:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Go to the Requests page on the menu on the left
3. Click Create Request
4. Open the Request type drop-down menu and select Submit sample for validation
5. Open the Sample type drop-down menu and select File
   1. Make sure you selected the correct sample type for the file:
      1. File-Based False Positive: A clean file incorrectly detected as malware. For example, a company’s internal tool flagged as a trojan.
      2. Potentially Unwanted Application (PUA): Legitimate software detected as unwanted. For example, a remote admin or adware-style installer used for business purposes.
      3. File-Based False Negative: A malicious file not detected by the product. For example, a ransomware executable encrypts data without being blocked.
   2. All types of sample types and their definitions can be found here: #business/elements-welcome/latest/en/creating_and_viewing_sample_validation_request_in_the_request_views-latest-en.
6. Drag and drop the file or click Browse to upload the file
7. Open the Request reason drop-down menu and select one option:
   1. False Positive – Clean file was blocked
   2. False Negative – Malicious file not detected
   3. Potentially unwanted application detected
   4. Request whitelisting
8. Open the Product name drop down menu and select the product
9. Add a short title for the request in the Title field.
10. Write down a description of the file or summary of concern
11. Click Create Request

The submitted file will be subjected to a verification process. Once verified clean, the file will be whitelisted and the database will be updated accordingly to prevent the file from causing new false positive detections. 

Issue:

How to perform a silent uninstall of WithSecure Client Security for Mac or Elements Agent for Mac / Elements EPP for Mac?

Resolution:

Before running any uninstall operation, you need to deactivate the system extension. You can use the following command:

/Applications/WithSecure/WithSecure\ Agent.app/Contents/MacOS/wsagent --deactivate-system-extension

This will deactivate the system extension. It should be run with a user session, or it can also be run without it if there is an MDM profile configured that allows sysext uninstallation. In any case this command should be executed before uninstall_MacProtection script.

You can uninstall Elements Agent for Mac and Client Security for Mac using the command line by running the following command:

sudo /Library/WithSecure/bin/uninstall_MacProtection

The script needs to run as ”root” so depending on what kind of logon scripts, It may or may not work.  A script executed by a remote administration tool such as JAMF or Apple Remote Desktop (or just using SSH) can be run as root so it should work.

Note: If the uninstall_MacProtection uninstallation method fails, it could be that you have in the Elements profile "Allow user to uninstall the product" set as disabled.  If the subscription has expired and client settings cannot be changed anymore, then delete the following file to remove the restriction:

/Library/WithSecure/fsmac/sysconfig/.no_uninstall

Issue:

How to upgrade an existing Elements Endpoint Protection EPP for Computers or EPP for Servers subscription from Standard to Premium or how to add Endpoint Detection and Response (EDR) feature to the existing subscription? 

Resolution:

If the customer has an Evergreen (monthly) subscription and you want to upgrade the subscription to to premium or add Endpoint Detection and Response (EDR) to the subscription, you can amend the current Evergreen contract. 

1. Log in to the Partner Portal
2. Go to Sales > Accounts
3. Choose the correct account and proceed to Deal Ordering & Subscriptions tab and click Amend Contracts
4. Select Amend Subscriptions and click Next
5. Choose the contract that will be amended, click Amend next to the contract you want to amend
6. Set Amendment Start Date
   1. By default, start date is today, it can be set up to 31 days in future. Note that if start date is in future, provisioning will happen in the amendment start date
7. Select Contact for the amendment, click Next
   1. Please note that while contact is mandatory to select, we are not sending any order documentation to the end customer contact. Instead, Certificates are available for Partner to download directly from Partner Portal
8. Verify that you are opening the correct contract for amendment, proceed by clicking Amend
9. Contract is now being opened for amendments; this might take a moment. Once the amendment quote is open, you can proceed to book following amendment types for the contract:
   1. Upsell/Downsell (change subscription quantity)
   2. Upgrade (change subscription product to a higher value another product variant)
   3. Cross-sell (add subscription for a new product on the contract)
   4. Termination (end subscription), note that the process flow for this starts slightly differently for this option
10. Click Amend products from the top menu and select Upgrade to change the subscription to a higher value product variant
11. Select the product you want to upgrade, click Next
    1. You can adjust the quantity or keep it unchanged on the new quote line of the new product, Quick Save after each adjustment
12. Click Save to save the amendment quote. and proceed with deal preparation or generate an order from the quote
    1. Please note that net pricing on the quote refers to the monthly value (of a full month), and pricing is not prorated on the quote
       Instead, prorated prices will be applied on the invoice. Evergreen subscriptions that are upgraded mid-month, are billed with prorated pricing: Old product follows a proration from start of the billing cycle until the upgrade date, and new product is prorated from order start date to the end of the billing cycle

After clicking the Generate Order button, the subscription will be upgraded on the day that was set as the start date. If the start date was set for today, then the subscription will be upgraded immediately and the new features will be available in the Elements portal immediately. 

Note: You do not need to change the subscription key for any device, since the subscription key will be the same when upgrading the subscription. The devices will take the new features into use within 6 hours. If you want to make the process quicker, you can send a Full status update operation to the devices from the portal. 

Issue:

When an WithSecure endpoint product is installed on a computer or server, there is high CPU or memory (RAM) usage and applications are experiencing performance issues. The connectivity of some applications can also be slow or blocked completely. 

Issue affects all WithSecure clients:

• Elements Endpoint Protection EPP for Computers 
• Elements Endpoint Protection EPP for Servers 
• Business Suite Client Security
• Business Suite Server Security 
• Business Suite Email and Server Security

Resolution:

Performance issues can for example be the result of:

• Connectivity issues to the Security Cloud
• Misconfigured Application Control
• Web Traffic scanning
• A scheduled scan is running

Connectivity issues to the Security Cloud

What is Security Cloud?
When Security Cloud is enabled on WithSecure endpoint products, it connects to WithSecure Backend to check reputation and other objects. WithSecure endpoint products have database updates which can detect the malware without connection to cloud, but, to check the reputation we need the cloud connection. There is a local cache, but the reputation is checked first using Security Cloud, since it has the latest information. 

When you enable Security Cloud, you need to make sure that the endpoints can communicate to Security Cloud:

• *.withsecure.com
• *.fsapi.com

Note: The domains mentioned above needs to be whitelisted to your firewall or proxy. In case you have enabled some proxy in your environment, the client reads it via discovery service and tries to connect to *.fsapi.com through it. 

To test the connectivity, use WithSecure Connectivity Tool, which is available in the installation folders of Elements Endpoint Protection (EPP for Computers and EPP for Servers), Business Client Security and Business Suite Server Security. With the tool you can view the list of addresses the product connects to and check the connectivity towards them. 

The tool is located in the following folder:

• Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
• Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
• Elements EPP for Computers/Elements EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

Misconfigured Application Control

If you have a premium subscription of Business Suite or Elements Endpoint Protection, it will include the Application Control feature. 

If the product is using high amounts of CPU performance, make sure you have not set the Application Control Global rule as Allow and monitor all applications. This setting should be used only during testing to find out which applications need exclusion rules, since it will affect the performance of devices.

Also make sure that you have not created Application control exclusion rules which only include a SHA1/SHA256 as a condition, since the calculation of the SHA1/SHA256 will require some CPU performance. Instead, we recommend using other conditions (such as the target path, etc.) in conjunction with the file hash condition.

Web Traffic Scanning

If you are experiencing performance issues with network based applications, which communicate over HTTP to an internal server, it could be that Web Traffic Scanning (Advanced Network Protection) is causing the issue. Try to temporarily disable Web Traffic Scanning to confirm if the issue is caused by it. If issue was caused by Web Traffic Scanning, you can add the internal servers address and hostname to the Allowed sites list so that the communication between the clients and the internal server is not checked. 

In order to troubleshoot further what part of the product is causing the slow down, try disabling security features one by one:

1. DeepGuard
2. Real-time Scanning
3. Firewall
4. Browsing Protection
5. Web Content Control
6. Web Traffic Scanning
7. Application Control
8. DataGuard
9. Device Control
10. Software Updater

Which process is being slowed down, and how is it visible? eg. – fshoster process taking up high CPU usage?

A Scheduled scan is running: 

Make sure that a scheduled scan is not currently running, since a running scheduled scan will use a lot of CPU and memory resources depending on the chosen settings. You can from the Windows Task Manager's Details tab check if fsscan.exe is running. If fsscan.exe is running, either a scheduled scan or a manual scan is currently being run. 

Issue:

Where can I view WithSecure consulting services for Payment Card Industries (PCI) and Data Security Standard (DSS)?

Resolution:

You can visit our website below for WithSecure consulting services regarding Payment Card Industries and Data Security Standard (DSS)

https://www.withsecure.com/en/about-us/legal/corporate-privacy?a=container-1241413461

Issue:

I have disabled Windows Firewall in the Elements Endpoint Protection profilem but Windows Firewall is still enabled on the host device.

Resolution:

For Windows:
You are only allowed to disable either "Apply WithSecure firewall profiles" or "Use Windows Firewall" in the Elements Endpoint Protection profile. As an example, when the WithSecure firewall is disabled in the profile, the product will not disable Windows Firewall even if you disable "Use Windows Firewall" in the profile. This is by design.

For Mac:
You are only allowed to disable either "WithSecure firewall " or "Apple Firewall" in the Elements Endpoint Protection profile. As an example, when the firewall is disabled in the profile, the product will not disable Apple Firewall even if you disable the "Apply Firewall" in the profiles. This is by design.