Issue:

Is there any method to change the license.fsrl file on existing Elements Exposure Management scan node that has been installed on either a Windows or Linux Server? 

Resolution:

There is no option to change the license file of a scan node after it has been installed with a specific license file. If you want to change the license.fsrl file on the scan node, you need to uninstall the current scan node installation and during reinstallation you can select to use a new scan node license.fsrl file. 

Issue:

How do I install Elements Exposure Management scan node on Linux server?

Resolution:

You can find the step by step instructions on how to install Elements Exposure Management scan node on a Linux server from the Elements Exposure Management User Guide:

Install a scan node on Linux | Elements Exposure Management | Latest | WithSecure User Guides 

Issue:

Why is Security Cloud showing "not connected" status on the Elements Agent's Updates page when it has been installed with a stand-alone Elements Exposure Management subscription key?

Resolution:

The Security Cloud is only used by the Elements Endpoint Protection features, so it is only needed if the device has an Elements EPP for Computers or Elements EPP for Servers subscription.  

You can ignore the Security Cloud error because the Elements Exposure Management scanning agent only scans for vulnerabilities. It does not scan for malware, where Security Cloud is required.

Issue:

We have enabled Vulnerability Management scan (agent based scanning) on our devices which have Elements Agent installed, and the CPU usage is very high when the Vulnerability Management agent is scanning. What can we do to improve the performance? 

Resolution:

By default, Elements agent will run the vulnerability scan every 4 hours. You can change the vulnerability data refresh schedule on the endpoints to either 6 hours, 12 hours or 24 hours. This way any performance issues wouldn't happen as often.,

To change the setting on how often the Elements Agent scans for vulnerabilities:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Vulnerability Settings page
3. Go to teh General settings tab
4. Expand the Miscellaneous section
5. Select the desired time from the Vulnerability data refresh schedule on endpoints drop-down menu

Note: this setting affects all installed WithSecure Elements Agents, but it will not apply to the ones installed in future.

WithSecure Elements Agent is installed on the client device to scan for vulnerabilities. The first scan happens right after you enable scanning on a device in the management portal. Next scans happen after any major change on the list of installed software or in time interval chosen from the Vulnerability data refresh schedule on endpoints. 

If there are no changes in the scan results, the scan report is postponed to avoid processing the same results again. Regardless of the changes, a scan report with the up-to-date vulnerability status is sent to the management portal after 7 days. 

Issue:

How to create reports for Elements Exposure Management? Can the reports be automatically sent to recipients over email? 

Resolution:

You can create your own report on the Reports page.

Issue:

How to use Elements Exposure Management Discovery scan as an asset update source for a Network Scan (System Scan)? How to have assets (devices, computers, servers, IoT) automatically added to a Scan Group when they are discovered in a Discovery scan? 

Resolution:

Steps to adding a Discovery Scan:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Scans > Discovery Scans page 
3. Click Add Discovery scan 
4. Select Port Scan and add the IP range and give the scan a unique name
5. Select Scan node that has been installed to that environment (or use Cloud scan node)
6. Click Next
7. Select the Discovery scan template 
8. Click Next
9. Add any notification recipients and then finish adding the discovery scan

After scan has been added to the Discovery Scans page, click the start button on the Discovery scans page on the right side of that Discovery scan. The scan will be queued and initialized. 

After Discovery Scan has been completed, you can see the results by clicking the name of the Discovery Scan. 

To use that Discovery Scan as the automatic asset update source for a network scan:

1. Go to the Security configurations > Scans > Network Scans page
2. Click Add scan group
3. Add name to the Network scan 
4. Click Next 
5. Select scan node that should be used 
6. Enable "Asset update sources" -> click Add source -> in source instance select the recently created Discovery Scan (trigger can be "once a discovery scan is completed" 
7. Click Next
8. Do the same for Web Scans as you did for System Scans (or you can disable Web Scan altogether)
9. Click Next 
10. Finish creating the scan 

To run the created Network Scan, click on the box on the left side of the network scan name (a menu will appear) and click Start Scanning
 

Issue:

How to transfer an Elements Exposure Management scan target (asset) from one scan group to another on the Elements Security Center portal's Security configurations > Scans > Network scans page? Is it possible to move the scan target without losing the vulnerability history on the scan target/asset?

Does transferring scan targets create duplicates at next discovery scan and are not found existing scan targets removed?

Or is it just simply better to repopulate scan targets from new asset update sources (without "Avoid duplicates by cross-checking assets originating from any source." option selected) to new scan targets and remove old configuration for discovery and network scans?

Resolution:

To move a scan target to another scan group, follow these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Scans > Network scans page
3. Select the Group view from the top-right corner
4. Expand the scans group where the scan target is currently
5. Select the target by clicking the box on the left side of the target (a menu will appear)
6. Click Move scans and select the new scan group and click Move scans 

Moving the scan target to a different group will not affect its scan history, so you will not lose any vulnerability data. 

Issue:

Can we hide Elements Agent user interface in Windows when it has been installed with stand-alone Exposure Management subscription key? We would want the user to not see any WithSecure icon in the system tray or have any visible pop-up windows.

Resolution:

Yes you can hide the Elements Agent user interface even if it has been installed with an Elements Exposure Management stand-alone subscription key. The Elements profiles still control the user interface even if the device wouldn't have any Endpoint Protection or Endpoint Detection and Response features enabled. 

Follow these steps to hide the Elements Agent user interface and tray icon:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security configurations > Profiles page
3. Click Create a profile
4. Give the profile a name
5. Go to the General settings page
6. Disable Show user interface to clients
7. Click Create profile
8. Go to the Environment > Devices page
9. Select the devices you want to assign the profile to (an Actions menu will appear)
10. Click Assign profile 
11. Select the profile 
12. Confirm by clicking Assign profile

Now the devices which you have assigned the profile to will have the user interface hidden and no tray icon will be shown.

Issue:

When a customer's Elements Exposure Management subscription is terminated or has expired, is the customer's exposure / vulnerability related data (or part of it) immediately lost or will the data still be available if the licenses are renewed again later?

Resolution:

There is a 4 month period (120 days) when you are able to re-activate the license/company if needed, after that everything is deleted. A subscription key is automatically removed from the Elements Security Center portal after the subscription has been expired for 120 days. After a company account has no subscription keys, the account will be automatically removed from the Elements Security Center portal. 

Issue:

How to remove or modify proxy configuration on an Elements Exposure Management Scan node? How to configure the proxy settings via the Elements VM Scan Node – Control Center? 

Resolution:

Open the Elements VM Scan Node – Control Center on the scan node server and go to the Settings tab

Then look for the following settings ids:

• 74
• 87
• 100
• 113

These are the proxy settings for the scan engines and the update service. Modify the settings to your liking and then restart the Scan node agent service after making the changes for the changes to take effect.