Issue:

What is the maximum simultaneous scan limit for Elements Vulnerability Management scan node?

Resolution:

These are the default values for the maximum number of simultaneous scans that a scan node is allowed to run:

• Discovery Scan: 10 
• System Scan: 30 
• Web Scan: 5

These default values can be modified if required. See the following entries from our admin guide for more information:

Windows: 

• Configuring scan nodes: https://help.f-secure.com/product.html#business/radar/3.0/en/task_82B78C67199740B3A28EC7FDF9E16FC1-3.0-en

Linux: 

• Configuring scan nodes: https://help.f-secure.com/product.html#business/radar/3.0/en/task_EC1AA6BA87B549EEA34B3D370E149F9A-3.0-en
• Limiting maximum scans: https://help.f-secure.com/product.html#business/radar/3.0/en/task_B98C152AE41B49849B4A28CDEC1AA8A9-3.0-en

Issue:

When a user tries to access Elements Exposure Management related pages in the Elements Security Center portal, they get the errors:

This operation is forbidden – Please contact your EntraID administrator to perform this operation.

The organization you're trying to sign in requires two factor authentication. Go to Account settings to enable two factor authentication. 

Resolution:

Currently there is an issue with Multi-factor authentication (MFA) settings for new users which have been created after taking SSO (Single-Sign On) federation into use. Elements Exposure Management pages in the Elements portal have by default the MFA requirement legacy setting set as enabled on the portal level, but SSO users have the MFA included with the SSO. This means that MFA is shown to be disabled for the user on the portal level and therefore user cannot access Elements Exposure Management pages which require MFA. 

To resolve this issue, disable the legacy setting below which is a requirement for forced two-factor authentication for Exposure Management users and the relevant pages. The setting is located here:

• Management > Vulnerability Settings > Security Settings > Force two-factor authentication

After the setting has been disabled users should be able to access the Exposure management pages in the Element Security Center.   

Note: this does not lower overall security of the system as the two-factor requirement is still in place, just not handled by the relevant Exposure Management setting highlighted above.

If the steps above do not resolve the issue, alternatively an another administrator can temporarily disable SSO federation for the domain so that the user can enable the portal level MFA. After the user has enabled portal level MFA, the SSO federation can be re-enabled for the domain. To temporarily disable SSO federation for the domain, use this setting:

• Management > Organization settings > Security administrators > SSO Federation.

The user can then log in to enable portal level MFA. After MFA has been enabled, SSO federation can be re-enabled and then the user should be able to access Elements Exposure Management related pages in the portal. 

If possible, we recommend using the first option i.e. disabling the Force two-factor authentication setting for Elements Exposure Management. 

Issue:

There is an issue with scan nodes not being able to connect to F-Secure back-end servers. In short, the Last seen and Engine update indicators on https://portal.radar.f-secure.com/mmc/settings/scannodes.aspx show a delay of more than 3-4 minutes.

Resolution:

To troubleshoot the scan node connectivity:
1. Make sure that the F-Secure Radar Scan Node Agent (legacy name= Karhu.Scan.Daemon) service is running. Check this by using Windows Task Manager or Windows Local Service.

Issue:

Some scheduled system scan (network scans) end up with "Terminated" status.

Resolution:

We recommend to look into the scan log, which can be viewed by:

1. Log in to the Elements Vulnerability Management portal
2. Go to the Security Configuration > Scans > Network scans page
3. Open the scan group which is having issues with scans being terminated
4. Click on the Three dots on the right side of a target which scan status is Terminated
5. Select View scan logs

In case error similar to the following is logged, most likely the scan node is unable to reach the site, possibly due to network issue or blocked by security solution:

• ERROR|CoreGlobal|Error resolving target host ip: Name or service not known

• ERROR|CoreGlobal|Host could not be resolved to IPv4: 

• INFO|CoreGlobal|Target IP address: Cannot resolve/Invalid target
  

• INFO|CoreGlobal|STATUS CHANGED: Terminated DETAILS: ERROR_INVALID_TARGET

Issue:

No identity found and scan results do not show any details on Elements Exposure Management

Resolution:

Firstly, for the view which is not populated issue, we would suggest to check if the API permissions has been granted in Azure portal.
which may refer from the User guide:: Onboarding Azure cloud accounts | Elements Exposure Management | null | WithSecure User Guides . 

In order to achieve this, open the Cloud scan results from Security Configurations → Scan Templates → All Accounts, All rules scan and click on “Show errors“ button and see if there are “Insufficient permissions“ errors on AD (Active Directory) resource types.

For the missing scan results, ensure that the necessary permissions have been granted in Azure and verify that all statuses show a green checkmark (indicating a working state).

• If a company is newly onboarded, it may take up to 24h to populate identities and breach data info
• If a company is existing, it may take up to 36h for new identities and updates to EntraID and breach data to appear on the UI.

In addition, if you navigate to the cloud scan templates via Security Configurations (left tab) → Scan Templates → Cloud Scan Templates (tab on top of the page), you will see a scan called All Accounts, All Rules. If you click on that scan template and then click the blue Scan Now button, it will trigger a scan that, once complete, will populate the findings page.
 

Issue:

I would like to use third-party application with Elements Vulnerability Management portal using the API, but how do I start?

Resolution:

The quick introduction and best practice guide to the Elements Vulnerability Management API are available here. You can find the full reference manual for Elements Vulnerability Management API here.

Issue:

How to create WithSecure Elements Vulnerability Management API keys for authentication

Resolution:

An API key consists of an access key (for example, PA3IAKNANLM9) and a secret key (for example, UO9mkDEHFGa1Vau6o#1AfxwRmBQW@!qV). Note that the sample requests in this documentation show access and secret keys enclosed in braces, which must be omitted when you submit requests.

Follow the steps below to create an API key:

1. Log in to the Elements Vulnerability Management / Elements Security Center portal (https://elements.withsecure.com).
2. Click the MANAGEMENT > Vulnerability Settings tab.
3. Click on API keys tab.
4. Under Configure API keys, click Add API key.
5. Add a new API key and store it safely.
   • Apply the created API key to the HTTP header of every API request that requires authentication.
6. Run a simple request to check the authentication:

curl -X GET https://api.radar.f-secure.com/api/integration/authenticationcheck
-H 'Content-Type: application/json'
-H 'ApiAccessKey: {ApiAccessKey}'
-H 'ApiSecretKey: {ApiSecretKey}'

If authentication was successful, you will get a HTTP response with status code 200 Authenticated.

Reference:https://www.withsecure.com/userguides/product.html#business/radar/4.0/en/task_E974D4465373492480A62E0D65BAD5E2-4.0-en

Issue:

How to migrate the Elements Vulnerability Management scan node from an old server to a new server?
 

Resolution:

To migrate the scan node from an old server to a new one:

1. Uninstall Scan Node Agent from the current server by following the instructions in this link: 
2. On the new server, install Scan Node Agent using the installer and the same license file.
3. Verify that the scanning node can connect to the Elements Vulnerability Management portal:

• Log in to the Elements Vulnerability Management portal.
• Go to Scan nodes tab.

Note:
When uninstalling some Scan Node Agent, please keep the "license.fsrl" file and do not deregister it from Elements Vulnerability Management portal, so that it can be reused in future.

It should always be less than a minute since the scanning node attempted to connect to Elements Security Center. If Last Seen is longer, see the section for Troubleshooting Scan Node Issues: Troubleshooting scan nodes issues | Elements Vulnerability Management | 4.0 | WithSecure User Guides

Issue:

How to remove / add / change / modify user in the Elements Vulnerability Management portal

Resolution:

The Users page in the Elements Vulnerability Management portal allows to manage user access using Role Based Access Control (RBAC) principles. Users with administrator role have full access rights to user management. 

Steps to edit / modify an existing user:

1. Login to the Elements Vulnerability Management portal
2. Go to the Users tab
3. Click the List view button to view list of the users
4. Click on three dots (…) on the right side of the user
5. Select Edit
6. Make the required change and save your settings

Steps to delete a user:

1. Login to the Elements Vulnerability Management portal
2. Go to the Users tab
3. Click on List view button to view list of the users
4. Click on the checkbox next to the user
5. Click the Delete users button at the bottom of the screen to delete user

Steps to add a new user:

1. Login to the Elements Vulnerability Management portal
2. Go to the Users tab
3. Click the circle with 3 dots (…)next to the title "Users"
4. Select Add user
5. Fill in the user details and click Finish when done. An invitation email is sent to the user

Note: Administrators also have other options available including activating and deactivating users and adding users to groups.

To activate / deactivate or add a user to a group:

1. Login to the Elements Vulnerability Management portal
2. Go to the Users tab
3. Click on the checkbox next to the user, repeat the step if needed to select all relevant users
4. Click the button Activate users, Deactivate users or Add to user groups

Note: If the ADMIN user is no longer available (e.g. user has left the company) and your request is about adding (or changing) another user to the ADMIN role, contact Withsecure Support with your request. 
 

Issue:

How does WithSecure Elements Vulnerability Management count scanned unique IP addresses (license usage)?

Resolution:

Elements Vulnerability Management calculates a total number of unique IPs scanned for vulnerabilities in each and every Elements Vulnerability Management organization.

In general:

• Only vulnerability scans, in other words System Scans and Web Scans are taken into account. Discovery Scan and Internet Discovery searches in theory do not cost anything.
• 1 unique IP address scanned for vulnerabilities consumes 1 license from your subscription.
• You can re-scan the same IP without any additional costs, within the given billing period (monthly  / yearly subscription).
• Scanning an offline IP address using System or Web Scan still utilizes one IP address slot from the subscription. To avoid the issue, always start with a Discovery Scan and use it as the automatic asset source for the Network Scan (System scan and Web Scan).

You can view the license usage in the Elements Vulnerability Management portal by:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Open the Vulnerability Management section from the menu on the left 
3. Go to the Settings page
4. Go to the General settings tab
5. Open the Subscription details section
6. Check the In use column. For historical data, check the Subscription utilization list