Issue:

Can we remove or delete specific or particular Elements Endpoint Detection and Response Broad Context Detections (BCDs) from the Elements Security Center portal's Events > Security Events page. 

Resolution:

Broad Context Detections cannot be fully deleted or removed from the Elements Security Center portal's Events > Broad Context Detections page, they can only be archived. 

To archive a Broad Context Detection:

1. Log in to the Elements Security Center portal
2. Navigate to the Events > Broad Context Detections page
3. Select a Broad Context Detection by clicking on the box on the left side of the detection (a menu will appear)
4. Click Archive / Unarchive items 

To view the archived Broad Context Detections, create an Archived – equals – True filter.

Issue:

How to in the Elements Security Center portal on the Environment > Devices list show only EPP and EDR devices that have been assigned the Critical importance level?  

Resolution:

You can on the Environment > Devices page in the Elements Security Center portal use a filter to only show devices with a specific importance level. 

Here are the steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. With the filter feature on top of the devices table, create a "Device importance – equals – Critical" filter
4. Click Apply

Now only the devices which have been assigned the Critical device importance will be listed on the Devices table. 

To change the importance of a device, select the device from the list and then from the Actions menu at the bottom of the page click Update importance and select either minor, normal or critical from the drop-down menu and then click Update. 

Issue:

Is the Elements Endpoint Detection and Response (EDR) sensor required to connect to the Internet and / or WithSecure back-end services to work?

Resolution:

The Elements Endpoint Detection and Response sensor needs to be able to reach the internet and the WithSecure back-end services to work, since the detections are processed and shown only in the Elements Security Center portal. 

If you have devices in isolated environments where you want to install Elements Agent, you need to use a proxy. We have Elements Connector which can be used in Ultimate Mode as proxy, so that all connections go through it: Elements Connector overview | Elements Connector | Latest | WithSecure User Guides 
 

Issue:

We have installed Elements Agent using an EDR subscription key. Why are the local settings in the Elements Agent user interface missing? 

Resolution:

When Elemenst Agent has been installed using an EDR for computers or EDR for Servers subscription key,  the local Elements Agent user interface does not include any settings because EDR doesn't have any local settings. 

In order to have the Elements local settings, you need to change the subscription key to an Elements EPP + EDR subscription key. You can change the subscription key either from the Elements Security Center portal by using the Change subscription operation or you can change the subscription key locally by using the ws_oneclient_logout.exe tool. 

How to use the Change subscription feature from the Elements portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Select the devices from the list (an Actions menu will appear)
4. Click Change subscription 
5. Select the EPP + EDR subscription key
6. Confirm the subscription key change by clicking Change subscription

Devices will then immediately start using the new subscription key. 

How to change locally using the ws_oneclient_logout.exe:

1. Open a Command Prompt as an administrator
2. Navigate to C:\Program Files (x86)\F-Secure\PSB\
3. Run the following command: ws_oneclient_logout.exe –keycode <subscription-key>

Issue:

Do Elements Endpoint Detection and Response (EDR) and Elements Endpoint Protection (EPP) connect to the Amazon Web Services addresses (*.amazonaws.com)?

I notice that the connectivity to some *.amazonaws.com addresses on port 443 and 8883 are listed, when running the WithSecure Connectivity Tool.
 

Resolution:

Elements Endpoint Detection and Response feature (EDR) called "Advanced response actions" requires outbound access to specific AWS endpoints for your region.

You can see the required Amazon Web Services domains for each region in the EDR user guide: Turn on advanced response actions | Elements Endpoint Detection and Response | Latest | WithSecure User Guides 

Issue:

How to list only a specific device's detections on the Events > Broad Context Detections page in the Elements Security Center portal? There is no "device name" filter option

Resolution:

On the Events > Broad Context Detections page there is a Data content filter option, which can be used to show specific strings that a detection contains. It can be used to show only detections that contain a specific device name and it can be also be used to show only a specific BCD-ID. 

1. Log in to the Elements Security Center portal
2. Navigate to the Events > Broad Context Detections page
3. Select the Broad Context Detections tab
4. Click in the filter Choose an option and select Data content
5. Use the Contains setting
6. In the Add value field, enter the string that the detection should contain, for example a device's host name
7. Click Add

Now the list will show only the detections that include that string. 

Issue:

How to send Elements Endpoint Detection and Response (EDR) scheduled reports via email?

Resolution:

You can on the Elements Security Center portal's Reports > My Report page create a custom template which can then be used on the Email notification and report tab as a source for a scheduled email report. 

Follow these steps:

1. Log in to the Elements Security Center portal 
2. Navigate to the Reports > My reports page 
3. Click New view template and enter a name for the template
4. Click Add widget
5. Enter a name for the chart 
6. Select from the Data Source drop-down menu Broad Context Detections
7. Select from the Data drop-down menu the Broad Context Detections information you want to add as a widget
8. Click Create 

You can repeat steps 4. through 8. to add multiple widgets.

Once you have created the template, you can create the scheduled email report that uses the template as the data source:

1. Go to the Email notification and report tab
2. Click Add email report
3. Enter a name for the report
4. As Data source, select My report
5. From the Template drop-down menu select the EDR template that you created earlier
6. Enable Include list of EDR Broad Context Detections 
7. Select the language
8. Choose the Schedule
9. Enable Send only when report has content
   1. Note: If you want to send a test report with the Send test report button, temporarily disable the Send only when report has content setting before sending the test report. This because if report has no content, the test report will not be sent. 
10. Enter the recipients
11. Click Save

Issue:

Is it possible to automatically isolate a device from the network with Elements Endpoint Protection Agent when an infected / malicious file on a device is found?

Resolution:

If a file is detected as malicious by Elements Endpoint Protection's real-time scanning or DeepGuard features, the device cannot be automatically set to be isolated from the network. When real-time scanning or DeepGuard detect a file, the Elements Agent will either Block, Quarantine or Delete the file based on the action on infection setting in the device profile. 

Only if Elements Detection and Response (EDR) detects a medium or higher risk level detection on a device, can it be set to isolate the device from the network. This is done using the Automated actions rule which is an EDR feature. 

To create an Automated actions rule for your devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Automated actions page
3. Select the General page
4. Click Add rule
5. Enter a name for the rule
6. Select Rule type as Endpoint
7. Select response as Device isolation
8. Select the organizations the rule applies to (this setting is for partners)
9. Select if the rule should apply to also devices which have been classified as "critical"
10. Select the risk level when the rule should be triggered
11. Select schedule as Continuous
12. Click Add

Issue:

When Elements Endpoint Detection and Response (EDR) detected a high or severe level risk on a device, the automatic network isolation feature triggered a host isolation but it didn't isolate the computer. The network isolation state remains pending on the portal. 

What can cause the automated isolation action to fail? 

Resolution:

Ensure your Windows Defender firewall is controlled by WithSecure and that you do not have firewall rules or configurations via GPO. Rules and configurations created via GPO override any firewall rules created by the WithSecure firewall profile, even isolation rules. 

Issue:

Error "Failed to fetch remove operations data" when trying to load a certain BCD ID. Only that specific BCD ID is displaying the error. Other BCDs have no issue.

Resolution:

Do check if the device linked to the problematic BCD is still in the device list, or has not been removed. As the reason this error could occur is possibly due to the Device no longer being listed.