Issue:

WithSecure Elements Endpoint Detection and Response (EDR) detects a safe application (e.g. an in-house application). How to whitelist the detection?

Resolution:

You can close the Broad Context Detection (BCD) as "Accepted behavior", to create suppression rule that can accept the behavior of a user or a process. To do this, you need to follow these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Expand the EVENTS category on the left pane
3. Select the Broad Context Detections option
4. Click on the respective Broad Context Detection to open the details page for this detection
5. Click on the drop-down menu in the top left corner
6. Select Closed from the drop-down menu, then select the reason as Accepted behavior
7. Click on the Create rule button and follow the on-screen instructions

After this, you can review the suppression rule by following these steps:

1. Expand the Security Configurations category on the left pane
2. Select the Automated actions option
3. Select Suppression rules

You can find more information regarding this feature in the following community article:

https://community.withsecure.com/en/kb/articles/31324-elements-edr-new-feature-accepted-behavior

If you encounter any issue in creating the suppression rules (such as having more than 5 key detections in the BCD), you can close the BCD as "False positive" by following these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com.
2. Expand the EVENTS category on left pane
3. Select Broad Context Detections option.
4. Select the BCD ID that require whitelisting.
5. Click "Update status" option at bottom page.
6. Select "Closed" from drop down menu, then select reason as "False positive"
7. Click "Update" option.

Once you have at least 1 incident that is identical to the incident, and there is no identical incident where status is closed as confirmed, the false positive handling in WithSecure Elements Endpoint Detection and Response (EDR) will close the false-positive automatically.

Broad context detections can be closed as Auto false positive automatically when they are identical to previously closed false alarms. For WithSecure Elements Endpoint Detection and Response to close a broad context detection as Auto false positive, the following criteria must be met:

• Incident has to be New / Unconfirmed,
• you must have closed an identical incident in the same organization as False positive, and
• no identical incidents in the same organization have been Confirmed.

More information about automatic handling of incidents can be found here. 

In the event that this has been completed multiple times and the file still gets detected, make a whitelist request for the False Positive event in the Elements Security Center by doing the following:

1. Select Support
2. Select Request for allowlisting
3. Verify that the following fields are populated correctly: 
   • Problem Category -> Threat/Malware
   • Problem Subcategory -> False Positive
   • Product Name -> Elements Endpoint Detection & Response
   • Language -> English
4. Under Describe the problem in detail, provide 3-5 example Broad Context Detection ID (BCD-ID), a reason for why this content should be whitelisted and the scope (single host, company level, etc.)
5. Fill in the rest of the required case information. Correct and complete information helps us to identify you and provide you with the proper service level
6. Click Submit to open the support ticket

Issue:

EDR Sensor Disabled status is shown in the Elements Security Center for a device even after uninstall/re-installation.

Resolution:

If EDR sensor status is shown as disabled in the Elements portal's Devices page, make sure that the EDR Sensor is enabled in the profile that is in use on the device:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the device
4. Go to the General settings page 
5. In the Integrations section, make sure that EDR Sensor is set as enabled
6. Click Save profile

If the issue persists, check that the following registry entries have administrator permissions:

Registry

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\CA

Permission

“Local Service” and “Network Service”

 This is most probably caused by system roll back software. 

Issue:

Error "Failed to fetch remove operations data" when trying to load a certain BCD ID. Only that specific BCD ID is displaying the error. Other BCDs have no issue.

Resolution:

Do check if the device linked to the problematic BCD is still in the device list, or has not been removed. As the reason this error could occur is possibly due to the Device no longer being listed.