Issue:

How to in the Elements Security Center portal on the Environment > Devices list show only EPP and EDR devices that have been assigned the Critical importance level?  

Resolution:

You can on the Environment > Devices page in the Elements Security Center portal use a filter to only show devices with a specific importance level. 

Here are the steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. With the filter feature on top of the devices table, create a "Device importance – equals – Critical" filter
4. Click Apply

Now only the devices which have been assigned the Critical device importance will be listed on the Devices table. 

To change the importance of a device, select the device from the list and then from the Actions menu at the bottom of the page click Update importance and select either minor, normal or critical from the drop-down menu and then click Update. 

Issue:

Normally, the alert notification email from EDR will be sent when a detection with he risk level at "Severe", "High" and "Medium" has been added to the portal, but is it possible to configure the alert email that ONLY will be notified when "Severe" or "high" risk level has happened?  Is it possible to filter the email alerts coming from EDR? I don't want to get a lot of low risk alert emails, but only medium and higher. Or only higher or severe etc.

Resolution:

From the Management > Organization Settings > Detection and Reponse settings tab, it is not possible to edit which classification EDR detections would send emails.

In this case, you have to use this workaround to generate an email report that only goes when there is High or Severe level detection:

1. Log in to the Elements portal
2. Go to Events > Security Events
3. Apply these two filters:
   • Source Equals EDR 
   • Severity Equals Action needed
4. Open the view menu on the top right corner and select "Save as" at the bottom of the menu
5. Give the view a descriptive name and save it
6. Go to Reports > Email notification and report
7. Click Add email report
8. Give it a name you want to see in your email subject
9. For Data source select Security Events
10. For template select the view you previously created
11. Configure schedule and recipient (continuous will send email every even 10 minutes if a new event has appeared)
12. Leave the Send only when report has content toggle enabled
13. Click Save

This report report is sent whenever High or Severe level detection appears on that Security Events page. Unfortunately, it is not possible to choose to send emails only about Severe level detections, because on the Security Events page that Severity equals Action needed filter includes both High and Severe level detections.

We will be improving those reporting and email features this year, but there is no specific estimate at this time.

Here you need to note that if you are trying to send a test report from that new report using the Send test report button, remember to first temporarily disable Send only when report has content, because if there is no content in the report, the test report will not be sent either.

Here is an in more detail explanation why the test report is not being sent: https://community.withsecure.com/en/kb/articles/32337-no-test-report-sent-when-security-events-source-is-used-for-elements-email-notification-and-report

Issue:

After installing Elements Agent client with EDR subscription, the message "Device sensor is not operational" is shown in the local Elements Agent user interface.

Resolution:

You need to ensure that you have allowed the network traffic to the following addresses in your network firewall. The client sensor silently collects activity from the endpoint on which it is installed and then submits a representation of this data to a backend.

To guarantee proper transmission, the endpoints need to be able to communicate over HTTP and HTTPS, port 443 with the services listed here:
https://community.withsecure.com/en/kb/articles/31217-network-addresses-for-withsecure-elements-cloud-managed-products

You should also allow connections to the digicert.com domain, as the Windows API may need to verify WithSecure services that are signed with a certificate that is issued by Digicert.

In case you have an SSL interceptor to intercept the network traffic, we recommend creating whitelisting on the SSL interceptor for the EDR addresses. EDR and Countercept use the same certificate pinning approach that prevents connectivity when TLS interception solutions are used.

Services that need to be whitelisted in the interceptor are:

• DIS
• Doorman
• FAMP/Response

If the connectivity is OK on the device and you still receive the error "Device sensor is not operational", you can check if the EDR sensor has at all been installed:

1. Right click the Elements Agent icon on the device
2. Click "Check for updates" 
3. Scroll down the "Update history" list and check if it includes an entry for WithSecure Sensor (64-bit) and that it shows status as "installed" 

If the WithSecure Sensor is completely missing or status is not installed, then the sensor installation failure can be due to a device having had Elements MDR or WithSecure Countercept installed on it before and the MDR or Countercept installation hasn't been fully uninstalled. 

Elements MDR and Countercept both have a similar WithSecure Sensor component and if it hasn't been uninstalled before installing Elements Agent, the installation of the Elements Agent version of the sensor will fail. 

To solve the issue, you will need to run the WithSecure uninstallation tool to uninstall both Elements Agent and Elements MDR / Countercept. You need to restart the device after running the uninstallation tool, then you can try to install Elements Agent back to the device. 

Issue:

WithSecure Elements Endpoint Detection and Response (EDR) sensor does not activate on Ubuntu. The state appears as "Waiting for connection" in the Elements Endpoint Protection portal and the Elements Endpoint Detection and Response portal. 

Resolution:

Elements Endpoint Detection and Response functionality requires the auditd service to be installed and running on the system.

If Elements Endpoint Detection and Response sensor installation fails, an error like this will be printed to the system journal:

"Sep 29 14:07:37 localhost fsbg[6692]: update installation failed: /sensor/1601277158"

It is possible to fix the failed sensor installation by installing auditd and running the update command to let update system install the sensor automatically.

1. Run the command below to install auditd:
sudo apt-get install auditd

2. Fixing sensor installation:
sudo su

Note: sudo su will give the root shell, please execute the next command in that root shell

/opt/f-secure/baseguard/bin/update $(/opt/f-secure/baseguard/bin/update –list | grep sensor | cut -d ' ' -f 1)

Issue:

Why are the quick action buttons (such as “Isolate Affected Device” and “Scan Device”) under the Broad Context Detection detail's view greyed out in the Elements Security Center?

Resolution:

The remote operations (such as “Isolate Affected Device” and “Scan Device”) in the Elements Security Center are only available for a device with Elements agent installed using the Elements EDR for Computers/Elements EDR for Servers or Elements EDR and EPP for Computers/Elements EDR and EPP for Servers subscription.

If you have Business Suite product (Client Security/Server Security) installed on the device with the Endpoint Detection & Response sensor activated, we are unable to trigger remote operations from the Elements Security Center. We need to do this using Operations tab in the Policy Manager Console.

Issue:

How to test if EDR sensors on Windows, Mac and Linux are working and reporting detections to the Elements Endpoint Detection and Response portal?

Resolution:

For Windows sensors there are a few tests outlined in the product Simple test with Windows system tools | Elements Endpoint Detection and Response | Latest | WithSecure User Guides

Mac sensors can be tested by running the following Terminal commands for different detection event types:

file event test:
uuid=$(uuidgen) && touch "$uuid" $(printf this_is_%s_test_file f_secure)

socket event test:
python -m SimpleHTTPServer

Linux sensors can be tested by running the following Terminal commands for different detection event types:

file event test:
touch this_is_f_secure_test_file

socket event test:
python -m SimpleHTTPServer

Issue:

I have uninstalled the sensor, how to remove the device from the Elements Endpoint Detection and Response portal?

Resolution:

The devices cannot be manually removed from the Elements Endpoint Detection and Response portal. Inactive devices will remain in the Elements Endpoint Detection and Response (EDR) portal Devices view for 90 days before the removal. If a device becomes active after removal, it will appear back in the list.

Here is a list of the different possible statuses:

EDR Status and color code:
Active   | Green = seen in last 24 hours 
Inactive | Yellow = seen in last 7 days 
Inactive | Red = not seen in 7 days

The device details are not removed from the EDR portal immediately after e.g. device is deleted from the EPP side or the client is uninstalled. The reason for this is that EDR stores a lot of event and incident information that can be relevant in Incident response carried out after the device is taken out of use. The device is a very important part of the BCD context. If information from the device is lost, BCD incident analysis and potential IR (incident response) will become difficult. Very often incident investigation or evidence collection starts days or weeks after the fact. Already removed device could be root source or part of e.g. lateral movement activity detected in BCD and incident investigation. For this reason, the EDR portal keeps devices information after a device has been removed to enable full incident investigation.

Issue:

How can I activate Elements Endpoint Detection and Response for Business Suite Client Security or Server Security using Policy Manager?

Resolution:

The endpoint sensors are lightweight, discreet sensors, which are included in Client Security and Server Security clients.

These sensors collect behavioral data from endpoint devices and are specifically designed to withstand a wide range of attacks.

You need an activation keycode for registering the Elements Endpoint Detection and Response sensors. Contact your WithSecure partner or sales representative to get your Elements Endpoint Detection and Response for Business Suite keycode.

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab and select Windows > Endpoint Detection & Response
4. Enter your sensor activation keycode for the corresponding host type (workstations or servers).
5. Select Enable Endpoint Detection & Response
6. Select Activate Endpoint Detection & Response module
7. Distribute the policy (Ctrl + D)

Issue:

Endpoint Detection and Response (RDR) sensor in Business Suite Client Security or Server Security is unable to connect to the backend. 

User interface shows "Sensor is not activated" status and the device is not visible in the EDR Portal.

Resolution:

WithSecure recommends to add the following scope to whitelisted domains:

• *.f-secure.com
• *.fsapi.com
• *.digicert.com

For a broader exclusion you would need to whitelist full addresses for the RDR endpoints as follows:

The Security Cloud client needs to be enabled on the Policy Manager console to allow EDR sensors to submit data to F-Secure Cloud.
Steps to enable the Security Cloud client:

Issue:

There is a date / time mismatch between the Elements Endpoint Detection and Response (EDR) execution start and the detection. How is that possible?

Resolution:

The host needs to be turned ON and have an active internet connection for the host to upload the detection information to the EDR portal. If the host goes to sleep mode or loses internet connection, it is expected behavior for the execution start and the detection time / date to differ.