Issue:

How to create or add an Elements Endpoint Protection Application Control exclusion rule if an application has been blocked for example by a default rule.  

Resolution:

If an application has been blocked by an Application Control rule, you need to first check the block details from the Elements Endpoint Protection portal's Security Events page so that you can create an exclusion based on that information. How to view detection details:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Events > Security Events page

You can filter the Security Events page to only show Application Control events by adding a "Source equals Application control" filter. 

Open the Application Control block details by clicking the blue downwards arrow on the left side of the detection to view all the details. You can copy paste the details to a text editor to use them later when creating the exclusion rule. 

Note: If multiple applications are being blocked by the same application control rule, you need to create separate exclusion rules for each application. Do not add for example several condition paths to several applications in one rule.

How to create the Application control exclusion rule: 

1. Log in to the Elements Endpoint Protection portal
2. Go to the Security Configurations > Profiles page
3. Select the profile which is in use on the devices
4. Go to the Application Control settings page
5. Click Add a new top rule
   • Note: The rules in the table are applied in a priority order: rules are checked from top to bottom. So the exclusion needs to be up top.
6. Add the following:
   • Rule name, example: Exclusion for application x
   • Select the Event type to be the same as shown in the detection 
   • Select as Action Allow 
7. Add a condition. You can from the block details you saved to a text editor check what details need to be used. For example: Target path contains C:\Example\Example.exe
   • Note: If you add multiple conditions, the conditions are based on the AND principle. All conditions must apply for the rule to take effect. When adding multiple conditions, add each condition one by one an test between each added condition.
8. Click Save and publish

Issue:

Importing or exporting JSON file for Elements Endpoint Protection (EPP for Computers or for Servers) Browsing Protection configuration

Resolution:

You can follow the steps below to import or export JSON file in the Elements Endpoint Protection portal for Browsing Protection configuration:

1. Login to Elements Endpoint Protection Portal
2. Go to Profiles
3. Select the used profile 
4. Open Browsing Protection
5. Scroll down to Web Sites Exceptions (Ensure it is enabled)
6. The following steps are applicable for both Allowed sites and Denied sites
7. Select 

Issue:

How to disable Web Traffic Scanning (Advanced Network Protection) for Elements Endpoint Protection (EPP for Computers and EPP for Servers) in the portal?

Resolution:

The Advanced Network Protection feature is called Web Traffic Scanning in the Computer Protection PSB Portal profile. 

You can disable or enable it by following these steps:

1. Log in to the Elements Endpoint Protection Portal 
2. Go to the Profiles page
3. Select the profile you want to edit
4. Go to the Real-time scanning settings 
5. Disable or enable Web traffic scanning

NOTE: To enforce the setting, you will need to lock it. If the setting is not locked, local setting changes override the profile settings.

On the Real-time scanning settings page you will also find the Applications excluded from Web traffic scanning list where you can add a SHA-1 exclusion to exclude a single application from Web traffic scanning.

If it is a browser based application, you can instead exclude the address. This can be done in the Browsing protection settings by first enabling Web site exceptions and then adding the server address to the allowed sites list. 

Issue:

How to exclude a file, folder or application that is incorrectly blocked by Elements Endpoint Protection (EPP for Computers or EPP for Servers) DeepGuard feature?

Resolution:

If a file, that you are sure to be safe, is being blocked by DeepGuard, you can exclude a file or folder from all security measures by following these steps:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Server Configuration > Profiles page
3. Choose the profile which the device is using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

Note that you can use wildcards when creating the exclusions. For example: C:\Users\*\AppData\Local\test\ 

This would exclude the AppData\Local\test\ folder and all its sub folders for all users.

If you want to locally on the device itself create the exclusion:

1. Open the Elements Agent user interface on the device
2. Go to Settings 
3. Go to the Malware protection settings page
4. Click view quarantine (enter administrator username and password if needed)
5. Select the Excluded tab
6. Click Add new 
7. Add the file path or folder path
8. Click OK

DeepGuard can also be excluded using the SHA-1 of the process:

1. Log in to the Elements Security Center portal 
2. Go to the Events > Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Global exclusions from all security scans list
5. Click Save profile

The SHA-1 can also be added manually to the DeepGuard protection rules. Follow the steps below to manually add an SHA-1 exclusion in DeepGuard:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Select the profile you want to add the exclusion to
4. Go to the Real-time scanning page
5. Scroll down to DeepGuard settings
6. Click on Add rule
7. Fill in the SHA1-hash and a note about the application
8. Click Save profile

Note: If DeepGuard is blocking software that you see as trusted, it is recommended to report the executable to WithSecure Labs for potential whitelisting: Submitting a file sample | Welcome to WithSecure Elements | Latest | WithSecure User Guides 

Issue:

How to disable TLS versions 1.0 and 1.1 for Elements Connector?

Resolution:

You may refer the below steps to disable the TLS 1.0 and 1.1 encryption by using Windows registry editor:

1. Run Windows Registry Editor (Regedit) as administrator.
2. Create the following string registry key:
   • For Elements Connector (Windows) \HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector\additional_java_args
3. Set the value -DenableVistaInteroperability=false
4. Open a Command Prompt as an administrator and run commands "net stop wsconnector" and "net start wsconnector" to restart the services.

After service restart, TLS 1.0 and 1.1 is disabled on Elements Connector.

Issue:

• After installing Elements Agent (EPP for Computers or for Servers), VPN connection stopped working and is blocked by the Windows firewall.
• How to create a custom Elements Endpoint Protection profile to allow the VPN connection?
• Which ports need to be opened to allow PPTP, L2TP and IPSec VPN connection through the firewall?

Resolution:

In this case, you have to start by creating a custom profile that can be edited.

Creating a custom profile:

1. Log in to the Elements Security Center Portal
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the circular symbol with three dots in the middle next to the profile you want to clone
5. Press on the clone profile
6. Enter the name and label of the new custom profile

After creating a custom profile, you can start creating new firewall rules.

Creating a new VPN firewall rule:

1. Select the profile you want to use
2. Go to the Firewall settings page
3. Go to Firewall rules and select add rule
4. Enter a name and description of the rule, e.g Allow VPN

The ports and protocols that need to be allowed vary between each VPN connection type. Verify with your VPN provider the type of VPN connection you are using and which ports to open.

To allow common PPTP VPN traffic:

• Allow PPTP tunnel maintenance traffic, open outbound TCP port 1723
• Allow PPTP tunneled data to pass through the router, open outbound protocol 47 (GRE)

To allow common IPSec VPN traffic:

• Allow Internet Key Exchange (IKE), open UDP port 500 outbound
• Allow IPSec Network Address Translation (NAT-T), open UDP port 4500 outbound
• Allow Encapsulation Security Payload protocol (ESP), open protocol 50 outbound
• Allow Authentication Header protocol (AH), open protocol 51 outbound
• Allow  IP-in-IP Encapsulation, open protocol 4 outbound.

If IPSec IKEv2 VPN connection is not working after creating the above firewall rules, enable Allow unknown outbound connections from the profile and see if it helps. By default Windows firewall has unknown outbound connections allowed, while the WithSecure firewall profile will block them. 

To allow common L2TP VPN traffic: 

• Allow L2TP traffic, open UDP port 1701 outbound
• Allow protocol 115 outbound

Once the firewall rules have been created, the profile needs to be assigned to the target devices. 

Assigning a profile:

1. Go to the Devices page
2. Choose the device(s) to which you want to assign a profile to
3. Click on Assign > Assign profile 
4. Select the profile with the VPN firewall rules and click Assign

Issue:

How to create a custom email report for Elements Endpoint Protection? How to have an email report include specific information, such as:

• Device name
• Client version
• Assigned profile
• Status updated
• Malware protection status
• Software updates status 

Resolution:

Elements Endpoint Protection has the Email notification and report feature, which you can use to create a custom report that you can have automatically sent periodically (daily, weekly, monthly). 

You need to first create a custom view on the Devices page, which can then be used as a template for the email report:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Environment > Devices page
3. Click on the three vertical lines on the right side of the devices list 
4. In the Visible columns leave only Type, Name and Client version and then close the list by clicking X 
5. Save the custom view by opening the View drop-down menu in the top-right corner and then clicking Save as > enter name > Save
6. To have the view visible for all users in the organization, click on the three dots on the right side of the newly created view and then select Move to organization views

After you have created the custom view, you can create the email report:

1. Go to the Reports page
2. Go to the Email notification and report tab
3. Click Add email report 
4. Enter report name and choose Devices as the Data source
5. Select the template that you have created previously on the Devices view
6. Set you preferred report frequency and schedule
7. Enter recipients and click Save 

Issue:

How do I create my company account in the Elements Endpoint Protection Portal?

Resolution:

Follow the steps below to create your company account in the Elements Endpoint Protection Portal:

1. In your License certificate that was provided by your WithSecure Reseller, verify your Elements subscription key.
2. After verifying the subscription key, go to the WithSecure Elements self-registration page: https://elements.withsecure.com/self-register
3. Enter your subscription key and click submit
4. Follow the on-screen instructions to enter the information of the first administrator user:

• The User name is the login name, not your email address.
• The Account name* should be defined exactly same as the Licensee* name found in the License certificate.

Once the administrator account has been successfully created, you will receive a welcome email from which you can log in for the first time to the WithSecure Elements portal and set up your password and two-factor authentication method. 
 

Issue:

How can I export the infection report from the Elements Endpoint Protection portal?

Resolution:

You can export the report the following way:

1. Login to Elements Endpoint Protection portal
2. Go to the Reports page
3. Go to the Infections tab
4. Click on the Action menu next to Infections (3 dots)
5. Select Export Report (CSV)

Issue:

How to remotely change the subscription key of the Elements Endpoint Agent (EPP for Computers and EPP for Servers) via the Endpoint Protection Portal?

Resolution:

Follow these steps to remotely change a subscription key of a device using the Endpoint Protection Portal:  

1. Log into the Endpoint Security Center Portal: https://elements.withsecure.com
2. Open the Environment section from the menu on the left
3. Go to the Devices page
4. Select the devices (a menu will appear)
5. Click on Change subscription
6. Search for and select the subscription key from the drop-down list
7. Click Change subscription

Note:

• For company level users, both the old and new subscription keys have to be on the same Elements company account. You cannot change the subscription key if the keys belong to two different company accounts. 
• Users with SOP (Solution provider) or SEP(Service Partner) level access to the Elements Portal will be able to change subscription between company accounts if the accounts are both Partner Managed and listed under them. You need to have the Solution Provider/Service Partner level selected from the Scope-selector when you select the devices for Company A, so that the subscription for Company B is selectable in the Change subscription drop-down menu. (The listed subscription keys in the drop-down menu are based on the account you have selected from the scope-selector). A partner therefore needs to select their own Solution Provider/Service Partner account from the scope-selector drop-down menu and then go to the Devices page and add a Company name equals [customer name] filter to only show the one company's devices. After that you can select the devices and use the Change subscription operation.
• You cannot change subscriptions from Trial subscription key to another Trial subscription key.
• If an EPP subscription has been activated on the device, you cannot change to a stand-alone EDR or Stand-alone Vulnerability Management subscription using the Change subscription feature. You need to locally change the subscription key using ws_oneclient_logout.exe.

On Windows devices, the subscription key, which the Elements Agent uses, can also be changed locally on a client or server using our ws_oneclient_logout.exe tool.
The tool can be found in the products installation folder. 

1. Open a Command Prompt as an administrator
2. Navigate to C:\Program Files (x86)\F-Secure\PSB\
3. Run the following command: ws_oneclient_logout.exe –keycode <subscription-key>

(Enter the subscription key between < >and then remove them)

The WithSecure Elements Agent installation will then immediately start using the new subscription key and connect to the correct Elements account.

On Mac OSX devices, when the device is managed by WithSecure Elements Security Center (ESC), the local UI is intentionally locked. Therefore, the license cannot be changed locally on the device. The subscription/license key must be updated from the ESC portal, and the change will be pushed to the device automatically.

Environment > Devices > Change subscription