Issue:

How can I create an XFENCE exclusion for Elements Endpoint Protection for Mac? 

I want to create an exception for a specific application in the XFENCE feature so that users will not get the notifications.

Resolution:

You can create exclusion rules to the Elements Agent for Mac profile in the Elements Security Center portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles > For Mac page
3. Click on the profile that is in use on the devices
4. Go to the Scanning settings page
5. In the Exclusions > Exclusion folders and files from all security scans section, click Add path
6. Enter the path
7. Click Save profile

From the local graphical user interface (GUI) you can create an exclusion by following these steps:

1. Click on the product icon in the menu bar area
2. Click on the hamburger menu (three lines)
3. Select Settings from the drop down menu
4. Navigate to "XFENCE" tab in the product preferences
5. Unlock it by clicking on the lock icon in the lower left
6. Click "Advanced…". This will open xfence rule editor
7. Select "New Policy Rule"
8. Fill in path to the application, the path ("Any path" can be selected) and hit "Save". This will create a new allow rule for the selected activity
9. Close rule editor to apply changes

Issue:

What are the recommended settings or best practices for Elements Endpoint Protection profile settings? 

Resolution:

We consider the default Elements profiles to be the recommended or best practice settings for Elements Endpoint Protection for Computers. 

As a basic rule of thumb; WithSecure default settings are mainly the best practice settings for the product, and further configuration needs to be done on case by case basis depending on your needs.

To avoid performance issues:

• Keep Security Cloud enabled
• Avoid Application Control rules that have SHA-1 as a condition. If SHA-1 is used, combine it with another condition. 

Issue:

When admin checks in the Elements Security Center on the Reports > My Report tab the Security Events template, there is no data available for 'Infection handled by real time scanning'. The graph is empty. 

Resolution:

Infection handled by real time scanning graph is creating with the information from the last 30 days. If there is no data or it is empty, then it means that in the last month no infection were detected by real-time scanning, so none were handled.

Issue:

Can the Elements Endpoint Proteciton Firewall Isolation profile be activated if there is a GPO rule to ignore locally defined rules?  What will happen if a firewall rule distributed by GPO to 'Ignore locally defined rules' and Elements Endpoint Protection tries to isolate the device from the network? 

Resolution:

Firewall rules configured via Elements Security Center Portal are considered local, hence if there is a GPO rule to ignore local rules it WithSecure rules or profiles will no longer work. 

Our general recommendation is to choose one – either manage Windows Firewall with GPO, or with WithSecure profiles (or with the smallest possible input from GPO), otherwise in case of any conflicting settings GPO will have a higher priority and override WithSecure firewall rules. Also, if there are conflicts, it might impact the host performance negatively

Issue:

Does Elements Endpoint Protection Browsing Protection feature protect against malicious or harmful Google Chrome, Microsoft Edge or Mozilla Firefox browser extensions / add-ons? Can it block the user from installing harmful or suspicious extensions?  

Resolution:

Elements Endpoint Protection's Browsing Protection feature is not able to interact with other browser extensions, so it cannot block them from being installed or activated in a browser. Elements Endpoint Protection does not have this particular feature to protect against malicious browser extension exactly by default. 

If a browser extension's files are rated as malicious, Potentially Unwanted Application or Spyware, then real-time scanning can block or quarantine the extension's files. 

For managing browser extensions in your organization, we recommend to use the built-in enterprise tools in the browser. 

Issue:

When Elements Mobile Protection is installed and opened for the first time, it shows the prompts:

• Permissions needed "File access – antivirus needs files access to scan for harmful items on this device"
• Notifications – Needed to keep protection running and to notify about important security events
• Diagnostic file – We need the following permission to be able to collect the diagnostic file remotely from your device. You can change this setting later in the app settings.
• Receive SMS – We need the following permission to be able analyze SMS as soon as it arrives.
• Connection request – WithSecure Elements Mobile Protection (com.fsecure.mp.ucf) want to set up a VPN connection that allows it to monitor network traffic. Only accept if you trust the source. 

Why does the application ask the user to allow the permissions and not automatically give itself these rights? 

Resolution:

This is a part of Android's privacy security. Applications which can access personal files on your device need to specifically ask user permission to do so. Since Elements Mobile Protection includes a file scanner for malicious files, permissions are needed to access the user's personal files on the device. 

This is explained in the following article: https://www.androidauthority.com/app-permissions-886758/

You can also read Google's instructions for developers: https://developer.android.com/guide/topics/permissions/overview

Issue:

How to customize message that Elements Endpoint Protection Browsing Protection feature shows in the user's browser when a harmful or malicious website has been blocked?  

Resolution:

The message itself on the Browsing Protection by WithSecure extension's block page cannot be modified, but the "Report a false positive here" link can be changed to forward the user to a different website or service:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Browsing Protection settings page 
5. In the Sample submission URL field you can enter the website address to which the user should be forwarded to
6. Click Save profile

Issue:

How to do silent install and activation of Elements Agent for MacOS? I want to install Elements Endpoint Protection Agent for Mac devices in a central way without local user interaction. 

Resolution:

You can find all the silent installation and activation instructions for Elements Agent for Mac from the Elements Endpoint Protection User Guide's Deployment methods for Mac devices section: Deployment methods for Mac devices | Elements Endpoint Protection | Latest | WithSecure User Guides 

It includes instructions such as: 

• Creating MDM profiles for Microsoft Intune and Jamf management system
• Installing the product automatically 

Issue:

Where does Server Share Protection backup the changed files and can a custom location be selected? 

Resolution:

The Server Share Protection feature detects malware activity on server shared folders and automatically restore them if they are broken or encrypted by malware.

Server Share Protection creates a session for every new connected user. For every session there is an associated backup folder inside the %ProgramData% \ WithSecure \ AmData folder. Server Share Protection analyzes the user session to check if the user is malicious or not.

You can change the default backup folder for Server Share Protection by following these steps:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the server 
4. Go to the Server share protection settings page
5. In the Backup files section, enter the path to the A custom folder to store backed-up files field
6. Click Save profile

The Server Share Protection "A custom folder to store backed-up files" folder path must be a path to a folder that already exists on the server locally. The SYSTEM account must have access rights to write to the folder. Otherwise, Server Share Protection is not able to protect shared folders and files.

Issue:

Elements Agent update downloads fail with error: "failed: 214 (operation incomplete)". What prevents Elements Endpoint Protection Agent from downloading and installing the updates?

Error shown in the AUA.log 

I: Downloading swup-win-db/1689330515 failed: 214 (operation incomplete)

Resolution:

Downloading of updates can fail with error "failed: 214 (operation incomplete)" if for example:

• You have a proxy somewhere that cuts off large zip file downloads.
• You have a component that cuts downloads or zip downloads over HTTP. Elements Agent malware definition and engine updates are downloaded by default using HTTP. You can try to enable downloading of updates over HTTPS and see if that helps:
  1. Log in to the Elements Security Center portal
  2. Navigate to the Security configurations > Profiles page
  3. Open the profile that is in use on the devices 
  4. Go to the Communication settings page
  5. Enable Use HTTPS to download updates 
  6. Click Save profile
• You have implemented SSL decryption that prevents updates from being downloaded.