Issue:

Can we hide Elements Agent user interface in Windows when it has been installed with stand-alone Exposure Management subscription key? We would want the user to not see any WithSecure icon in the system tray or have any visible pop-up windows.

Resolution:

Yes you can hide the Elements Agent user interface even if it has been installed with an Elements Exposure Management stand-alone subscription key. The Elements profiles still control the user interface even if the device wouldn't have any Endpoint Protection or Endpoint Detection and Response features enabled. 

Follow these steps to hide the Elements Agent user interface and tray icon:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security configurations > Profiles page
3. Click Create a profile
4. Give the profile a name
5. Go to the General settings page
6. Disable Show user interface to clients
7. Click Create profile
8. Go to the Environment > Devices page
9. Select the devices you want to assign the profile to (an Actions menu will appear)
10. Click Assign profile 
11. Select the profile 
12. Confirm by clicking Assign profile

Now the devices which you have assigned the profile to will have the user interface hidden and no tray icon will be shown.

Issue:

How to configure sending of Elements Exposure Management scan notification emails to multiple recipient email addresses? 

Resolution:

If you want to have the email notifications to be sent to multiple recipient email addresses when either a Discovery Scan or a Network Scan (System scan / Web Scan) has started or finished, you can follow the steps below. 

For Network scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans page
3. Select the Network scans tab
4. Click on the three dots for a scan group 
5. Select Edit scan group 
6. Go to the Notifications step
7. Enable notifications
8. Select if you want to send the notification when:
   1. Scan starts
   2. Scan ends 
   3. Scan starts or ends
9. Enter the recipient email addresses separated by a comma:
   1. user1@example.com, user2@example.com, user3@example.com
10. Finish the setup

For Discovery scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans page
3. Select the Discovery scans tab
4. Click on the three dots for a discovery scan
5. Click Edit scan settings 
6. Go to the Other settings step
7. Enable Notifications 
8. Select if you want to send the notification when:
   1. Scan starts
   2. Scan ends 
   3. Scan starts or ends
9. nter the recipient email addresses separated by a comma:
   1. user1@example.com, user2@example.com, user3@example.com
10. Click Save and close

Issue:

I receive the following error when trying to access the Exposure Management in the Elements Security Center:

No access rights.
You do not have rights to Exposure Management content of this organization.
No permission You don't have access to view this page. Please contact your organization administrator to receive access

Resolution:

Ensure that you have valid subscription for Elements Exposure Management. If you have an expired commercial or trial subscription for Elements Exposure Management but you still have Elements Exposure Management access rights, you will receive "No access rights – Failed to fetch" errors when you try to access pages meant for Elements Exposure Management.

You can check the validity of your Elements Exposure Management subscription from the Management > Subscriptions page in the Elements portal

If you have a valid Elements Exposure Management subscription, ensure that your user has the following access rights (roles):

• Exposure Management – Exposure (admin)
• Exposure Management – Vulnerabilities (role)

The access rights can be checked by following these steps:

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Management > Organization Settings > Security Administrators page
3. Click on the user's email address
4. Check that the user has both enabled:
   1. Exposure – Full Editing
   2. Vulnerabilities – Management or Team member
5. Click close 

If you are partner, check if the error only occurs when selecting a specific company from the scope-selector drop-down menu. 

Issue:

We have enabled Vulnerability Management scan (agent based scanning) on our devices which have Elements Agent installed, and the CPU usage is very high when the Vulnerability Management agent is scanning. What can we do to improve the performance? 

Resolution:

By default, Elements agent will run the vulnerability scan every 4 hours. You can change the vulnerability data refresh schedule on the endpoints to either 6 hours, 12 hours or 24 hours. This way any performance issues wouldn't happen as often.,

To change the setting on how often the Elements Agent scans for vulnerabilities:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Vulnerability Settings page
3. Go to teh General settings tab
4. Expand the Miscellaneous section
5. Select the desired time from the Vulnerability data refresh schedule on endpoints drop-down menu

Note: this setting affects all installed WithSecure Elements Agents, but it will not apply to the ones installed in future.

WithSecure Elements Agent is installed on the client device to scan for vulnerabilities. The first scan happens right after you enable scanning on a device in the management portal. Next scans happen after any major change on the list of installed software or in time interval chosen from the Vulnerability data refresh schedule on endpoints. 

If there are no changes in the scan results, the scan report is postponed to avoid processing the same results again. Regardless of the changes, a scan report with the up-to-date vulnerability status is sent to the management portal after 7 days. 

Issue:

When a customer's Elements Exposure Management subscription is terminated or has expired, is the customer's exposure / vulnerability related data (or part of it) immediately lost or will the data still be available if the licenses are renewed again later?

Resolution:

There is a 4 month period (120 days) when you are able to re-activate the license/company if needed, after that everything is deleted. A subscription key is automatically removed from the Elements Security Center portal after the subscription has been expired for 120 days. After a company account has no subscription keys, the account will be automatically removed from the Elements Security Center portal. 

Issue:

How to create reports for Elements Exposure Management? Can the reports be automatically sent to recipients over email? 

Resolution:

You can create your own report on the Reports page.

Issue:

How to remove or modify proxy configuration on an Elements Exposure Management Scan node? How to configure the proxy settings via the Elements VM Scan Node – Control Center? 

Resolution:

Open the Elements VM Scan Node – Control Center on the scan node server and go to the Settings tab

Then look for the following settings ids:

• 74
• 87
• 100
• 113

These are the proxy settings for the scan engines and the update service. Modify the settings to your liking and then restart the Scan node agent service after making the changes for the changes to take effect. 

Issue:

How to use Elements Exposure Management Discovery scan as an asset update source for a Network Scan (System Scan)? How to have assets (devices, computers, servers, IoT) automatically added to a Scan Group when they are discovered in a Discovery scan? 

Resolution:

Steps to adding a Discovery Scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Scans > Discovery Scans page 
3. Click Add Discovery scan 
4. Select Port Scan and add the IP range and give the scan a unique name
5. Select Scan node that has been installed to that environment (or use Cloud scan node)
6. Click Next
7. Select the Discovery scan template 
8. Click Next
9. Add any notification recipients and then finish adding the discovery scan

After scan has been added to the Discovery Scans page, click the start button on the Discovery scans page on the right side of that Discovery scan. The scan will be queued and initialized. 

After Discovery Scan has been completed, you can see the results by clicking the name of the Discovery Scan. 

To use that Discovery Scan as the automatic asset update source for a network scan:

1. Go to the Security configurations > Scans > Network Scans page
2. Click Add scan group
3. Add name to the Network scan 
4. Click Next 
5. Select scan node that should be used 
6. Enable "Asset update sources" -> click Add source -> in source instance select the recently created Discovery Scan (trigger can be "once a discovery scan is completed" 
7. Click Next
8. Do the same for Web Scans as you did for System Scans (or you can disable Web Scan altogether)
9. Click Next 
10. Finish creating the scan 

To run the created Network Scan, click on the box on the left side of the network scan name (a menu will appear) and click Start Scanning
 

Issue:

How to transfer an Elements Exposure Management scan target (asset) from one scan group to another on the Elements Security Center portal's Security configurations > Scans > Network scans page? Is it possible to move the scan target without losing the vulnerability history on the scan target/asset?

Does transferring scan targets create duplicates at next discovery scan and are not found existing scan targets removed?

Or is it just simply better to repopulate scan targets from new asset update sources (without "Avoid duplicates by cross-checking assets originating from any source." option selected) to new scan targets and remove old configuration for discovery and network scans?

Resolution:

To move a scan target to another scan group, follow these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans > Network scans page
3. Select the Group view from the top-right corner
4. Expand the scans group where the scan target is currently
5. Select the target by clicking the box on the left side of the target (a menu will appear)
6. Click Move scans and select the new scan group and click Move scans 

Moving the scan target to a different group will not affect its scan history, so you will not lose any vulnerability data. 

Issue:

Why is Security Cloud showing "not connected" status on the Elements Agent's Updates page when it has been installed with a stand-alone Elements Exposure Management subscription key?

Resolution:

The Security Cloud is only used by the Elements Endpoint Protection features, so it is only needed if the device has an Elements EPP for Computers or Elements EPP for Servers subscription.  

You can ignore the Security Cloud error because the Elements Exposure Management scanning agent only scans for vulnerabilities. It does not scan for malware, where Security Cloud is required.