Issue:

How to create an exclusion for a certain software update with the WithSecure Software Updater feature in the Elements Security Center Portal for EPP for Computers or EPP for Servers devices? I do not want to have Software Updater installing updates automatically or have the user manually installing the update.

Resolution:

Prerequisite: You need to have a non-default profile before you can configure your software updater settings.

You can exclude specific software updates from automatic installation or you can include specific software updates in automatic installation by following these steps:

1. Log in to the Elements Portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile you want to modify
5. Go to Software updater settings tab
6. Under Exclude from automatic installation, click Add exclusion
7. Select from the Conditions drop-down menu one of the following:
   • Update name contains
   • Software name contains
   • Vendor name contains 
   • Severity equals to
   • Bulletin ID equals to
8. Then depending on the rule you've chosen, enter the value to the remaining field. Examples:
   • Update name contains: Google Chrome 89.0.4389.82 (Note: for Microsoft updates, do not include the version number. Use for example only the KB number)
   • Software name contains: Google Chrome
   • Vendor name contains: Google Inc.
   • Severity equals to: Critical Security / Important Security 
   • Bulletin ID equals to: FSPM-41-64283-4 (Note: Same update can have several different Bulletin IDs due to for example Operating system version)

You can view the update details from the Software Updater page in the Endpoint Protection Portal.

Note: 

• Only one software per exclusion is supported. If you need to add multiple software, click Add exclusion again.
• You can add several conditions in one rule, if you want to combine for example Software name contains and Severity equals to conditions, click Add condition in the Conditions column.

After the profile has been saved and published, the exclusion/ will be taken into use on the devices that have this profile assigned. 

If you would like to hide the update completely from being detected as missing by Software Updater, you need to exclude it via the following setting in the Endpoint Protection Portal profile editor:

1. Log in to the Elements Portal
2. Under Security Configurations, select Profiles on the sidebar.The Profiles page opens.
3. Select the For Windows Servers tab or For Windows Computers tab, and then select the profile that you want to edit. The Profile for Windows Servers or for Windows Computers opens
4. Select the profile you want to modify
5. Go to Software updater settings tab
6. Scroll down to the Exclude from scanning section
7. Click Add exclusion

When the update is hidden with this rule, the update will not be listed at all in the Software Updates Missing updates tab in the Endpoint Protection portal. It will also not be visible locally on the device for the user.

Issue:

I want to give a different device name to the computer on which I have installed Elements Agent (EPP for Computer or EPP for Servers), how to change the device name (alias) in the Element Security Center Portal?
 

Resolution:

Follow these steps to change device name in the Elements Security Center Portal:

1. Log in to the Elements Security Center Portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. Click on the device in the list
4. Click add alias on the right side of the device name
5. Enter the new name and click Save

Issue:

How do I generate WSDiag diagnostic logs on WithSecure Mac products?

Resolution:

Please follow the steps below on how you can create a WSDiag logfile on a Mac.
 

1. Click on the Withsecure icon on the Menu Bar (top right)
2. Select 3 horizontal lines.
3. Click on "Settings…"
4. On the new window, click on Support.
5. Select Open support tool.
6. Select Run diagnostic.
7. Enter your password.
8. If there is a prompt to allow, please select Allow.
9. Save the file on Desktop.
10. Attach the logfile to the reply email.

If the product installation has failed and you do not have the WithSecure Support Tool available in the product folder under Applications, you can use the stand alone support tool to gather a diagnostic file:

1. Download the stand alone Withsecure Support Tool for Mac.
2. Extract the Support Tool.app from Support Tool.zip.
3. Run the Support Tool.app.
4. Select Run Diagnostics on the Support Tool window.
5. Enter the administrator password for your computer.
   The support tool starts and displays the progress of the data collection.
6. When the data collection is complete, select where you want to save the resulting tar.gz archive and then select Save.
   The support tool opens a Finder window showing the saved file.
7. Attach the file to the support case.

Note: You need administrative rights to run the tool.

Issue:

How do I create a custom WithSecure Elements EPP for Computers or for Servers profile in the Elements Endpoint Protection Portal?

Resolution:

Here are instructions on how you can create a custom profile which can be edited in the Elements Endpoint Protection Portal:

Creating a custom profile:

1. Log in to the Elements Security Center portal
2. Go to the Security Configurations > Profiles page
3. Click Create a profile from the top of the page
4. Enter a name and label of the new custom profile
5. Edit the profile to your liking
6. Click Save and publish

If you want to use an existing profile as a starting point, you can Clone a profile:

1. Log in to the Elements Security Center portal
2. Go to the Security Configurations > Profiles page
3. Click the three dots next to the profile you want to use as the starting point
4. Select Clone profile
5. Enter a name and label of the new custom profile
6. Edit the profile to your liking
7. Click Save and publish

Assigning a profile:

1. Go to the Environment > Devices page
2. Choose a device to which you want to assign a profile (a menu will appear)
3. Click on assign profile 
4. Select the profile from the drop-down menu
5. Click Assign

Note: Depending on the internet connection, it can take a up to 30 seconds before the profile is assigned to the device.

Issue:

How can I block the download of a specific file type, for example MP4 or EXE, with Elements Endpoint Protection (EPP for Computers or EPP for Servers)? 

Resolution:

EPP for Computers and EPP for Servers have the Browsing Protection feature called Content Type Filtering, which can be used to block specific content types. 

Note: The content type filtering is only performed if Security Cloud does not recognize the website address (URL) the content originates from.

1. Log in to Elements Endpoint Protection Portal 
2. Go to the Profiles page
3. Select the Profile to modify
4. Go to the Browsing Protection settings
5. Click Add Content Type filter:
   • Content Type: application/*mp4*
   • Filename: *.mp4
   • Description: Block MP4 file
6. Click Save and Publish

Issue:

How to change an Elements (EPP, EDR, Collaboration Protection or Exposure Management) subscription type from Partner Managed to Company Managed or from Company Managed to Partner Managed.

This could apply to the following scenarios:

• You're a company buying the product from a reseller and you want to change subscription type
• You're a reseller partner and want to perform this change for one of your customers

Resolution:

If you are a customer company who has bought the subscription through a reseller partner, this request needs to be handled by the partner. Please contact the partner and they can then proceed with the request. 

If you are a reseller partner, you need to create a ticket to our Order Services team through the WithSecure Partner Portal. When creating the ticket, select as case type: "Order And Invoice Assistance". 

When creating the ticket to Order Services, please include license information as well as details about what change you want to be done to the subscription.

Changing a subscription from Company Managed to Partner Managed keeps the same subscription key, which means that no reinstallation is required after the change has been made.

If subscription is changed from Partner Managed to Company Managed, the account will lose access to any profile that is on the partner level. Before requesting for the change, clone any profile that is created by the partner so that the owner of the profile is the company itself and assign the newly cloned profile to the devices. This makes sure that the profile will still be in use on the devices after the change from Partner Managed to Company Managed. 

Issue:

I get a lot of email alerts regarding infections on the customer's computer which has Elements Endpoint Protection (EPP for Computers or EPP for Servers) installed on it. How can I change the infections alerting configuration settings so that I do not get many or none of this emails?

Resolution:

How to enable or disable email infections alerting settings:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Open the Events section from the menu on the left
3. Go to Security events page
4. Click on the three dots on the right side of Security Events title
5. Select Infections Alerting Configuration
6. Select the language from the drop-down list and enter the recipient email address
7. Click Save

Note: A WithSecure partner with Solution Provider (SOP) or Service Provider (SEP) access to the Endpoint Protection Portal can add their email address on their level, in which case the emails will include alerts for all the companies visible under them in the Endpoint Protection Portal.

This feature allows you to get notified by email when one of the following events happens:

• AMSI
• DeepGuard
• File scanning
• Scheduled or locally/remotely triggered scanning
• Web Traffic Scanning

Note: The Infections Alerting Configuration feature will be deprecated during summer 2026. It will be replaced by the Reports > Email notification and report feature, where you will be able to create custom email reports by using the Security Events page's views as the data source: Creating customized security alert reports | Elements Endpoint Protection | Latest | WithSecure User Guides 

Issue:

How to block or allow (exclude) websites with the Elements Endpoint Protection Browsing protection feature,

Can it also be done using the local WithSecure client user interface without having to do so from the Elements Endpoint Protection portal?

Resolution:

Follow the steps below to either block a website or allow it through the Endpoint Protection device profile:

1. Log in to the Elements Security Center Portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile you want to edit 
   • Note that default profiles owned by WithSecure cannot be edited. You need to clone or create your own profile which you can edit and assign to the devices
5. Go to the Browsing protection settings page
6. Scroll down to the Web site exceptions section and enable it
7. Click Add site under either Allowed sites or Denied sites depending on which you want to do
8. Add the website URL address
9. Click Save profile

Follow the steps below to either block a website or allow it through the local WithSecure Elements Agent user interface

Note: Make sure you have administrator privileges to the computer, since modifying settings requires administrator level access.

1. Open the WithSecure Elements Agent and go to Settings
2. Go to the Secure Browsing tab
3. Click View website exceptions (you will be prompted for the admin user name and password) 
4. Select the Allowed or Denied tab 
5. Click Add…
6. Enter the website's URL and click OK

Issue:

For how long does WithSecure  Elements Endpoint Protection (EPP for Computers and EPP for Servers) store files in quarantine and can this time period be adjusted or changed? 
Is it possible to empty the quarantine of a device remotely from the Elements Endpoint Protection Portal?

Resolution:

The quarantine storage is located locally on each device running the WithSecure  Elements Agent. The size of the quarantine storage space cannot be changed. The Administrator may manage the quarantine centrally via Elements Endpoint Protection Portal, and also configure for how long are items being stored.

By default, items are stored in the quarantine for 365 days. The Administrator may choose to modify this value:

1. Login to Elements Endpoint Protection Portal
2. Go to the Profiles page
3. Select the profile
4. Go to the General settings tab
5. In the Quarantine section, check and modify if necessary the value for Days to keep items in Quarantine

The Administrator may choose to release or remove (delete) files that were quarantined by Elements Endpoint Protection through the portal:

1. Log in to the Elements Endpoint Protection Portal
2. Go to the Devices tab
3. Select the device on which you wish to manage the quarantined files
4. Go to the Infections tab
5. Click on the actions menu icon, consisting of three horizontal dots, next to the file you wish to release from quarantine, or delete
6. Choose either Delete file to remove the file from the device, or Release file to release it from quarantine

Additionally, the administrator can choose what action is taken on infected files. To be able to do this, the admin will need to disable the "Decide action on infection automatically" setting to be able to decide for themselves what action to take on the quarantined files.

To set your own decision, do as follows:

1. Login to Elements Endpoint Protection Portal
2. Go to the Profiles page
3. Select the profile
4. Go to the Real-time scanning settings
5. Expand file scanning and disable Decide action on infection automatically

Now you can customize the option "Action on infection" to whatever action you require.

Example: If you wish to automatically delete infections, chose "Delete". This means when the infections are detected, they will be deleted automatically. If you set to quarantine, the infections are only quarantined, not deleted. 

Note: Since the quarantine is only local, if the end user chooses to release an item from the quarantine via WithSecure  Elements Agent user interface (GUI), trying to release the item afterwards via portal will cause no action to be handled, as the item will no longer be available in the quarantine.

Issue:

How to automatically remove Elements EPP for Computers or EPP for Servers devices from the Elements Endpoint Protection portal with the Manage automatic deletion feature? 

Resolution:

You can choose to automatically delete the devices which have been offline long enough. Once a device has been deleted and removed from the Devices list, the license will be available to be used on other devices. You can define the time period, how long the device is offline before deleted. Deleted devices will return to the management portal if they ever become active again, as long as there are free seats in the subscription. If the subscription is full the device will not reappear in the management portal and the computer will not be protected.

The automatic deletion feature is disabled by default.

How to setup the automatic deletion for Elements Endpoint Protection devices:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page
4. Click on the three dots on the right side of the devices title
5. Select Manage automatic deletion
6. Enable or disable the feature
7. If enabled, set the amount of days
8. Click Save

Note: The automatic deletion only supports devices which have Elements Agent installed on them. Elements Mobile Protection and Elements Connector devices will not be automatically removed from the portal even if they reach the set number of days of being offline.