Issue:

Elements Exposure Management vulnerability scans on Linux contain false positive detection for backported software. Any recommendation for scanning backported software?

Resolution:

For any host with backported software. we would suggest performing authenticated scan to get more accurate result. If the "Skip backported software" option is enabled in the vulnerability scan template, vulnerabilities of backported software are not reported in the scan result. For example, Ubuntu often backports security patches, so scanners may skip checks if they detect an Ubuntu OS and the “skip backported” option is enabled.

Skip backported software
Backporting takes selected parts of a newer version of the software and ports them to an older version of the same software. This is usually part of the maintenance to patch security issues and is hard to detect in unauthenticated scans. This may cause a number of false positives. To get more accurate results and to also check backported software, use authenticated scans. By selecting this option, the scanner attempts to detect backported software and does not report their vulnerabilities to avoid false positives. More information on authenticated scans can be found from this link.

Issue:

How can a partner or end-customer company get administrator rights so that they can access all Elements Exposure Management pages and settings in the Elements Security Center portal. 
 

Resolution:

The Exposure Management – Exposure rights are not granted automatically for neither partners nor end-customer companies even if a customer has Exposure Management – Users and Cloud products. For partners the intention is that when you sell Exposure Management for the first time, the partner can contact our Order Services team via email and ask them to add Exposure Management – Exposure rights to one partner admin. The Order Services email address can be found in the WithSecure Partner Portal home page at the right side of the page. 

The partner admin who has received the Exposure Management access rights, can then grant those same rights to other partner and customer users from the Elements portal under Management > Organization Settings > Security administrators page.

In the Elements portal, the Exposure Management rights are divided into two different permissions:

• Exposure Management – Vulnerabilities
• Exposure Management – Exposure

The Vulnerabilities rights are the same as for the Vulnerability Management product, so if a user had them, they have been automatically updated to be Exposure Management – Vulnerabilities rights.

The Exposure Management – Exposure rights are the new ones that are required to access for example the Environment > Exposure > Cloud Coverage or Environment > Identities pages in the Elements portal. 

Issue:

Using the following API endpoints to enable or disable vulnerability agent scanning:
"https://portal.radar.elements.withsecure.com/api/latest/things/enable"
"https://portal.radar.elements.withsecure.com/api/latest/things/disable".

Getting the error when trying to enable scanning.
Error: Request header field X-Forwarded-For is not allowed.
 

Resolution:

Make sure that you have switched to the new API endpoint https://api.radar-prd.fsapi.com/

Example (use POST method):
curl 'https://api.radar-prd.fsapi.com/api/latest/things/enable ' \
  -X POST
  –data-raw '{"CcrIds":["x

Issue:

I am unable to install the Elements Vulnerability Management scan node agent on Ubuntu 18.04 LTS

Error message:

user@host:~$ sudo apt install ./f-secure-radar-scannodeagent-installer_1.0.0-1_amd64.deb
Reading package lists… Done
Building dependency tree
Reading state information… Done
Note, selecting 'f-secure-radar-scannodeagent-installer' instead of './f-secure-radar-scannodeagent-installer_1.0.0-1_amd64.deb'
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:
The following packages have unmet dependencies:
f-secure-radar-scannodeagent-installer : Depends: aspnetcore-runtime-2.2 but it is not going to be installed
Depends: powershell but it is not going to be installed
Depends: dialog but it is not installable
Recommends: libx11-xcb1 but it is not going to be installed
Recommends: libxrandr2 but it is not going to be installed
Recommends: libasound2 but it is not going to be installed
Recommends: libpangocairo-1.0-0 but it is not going to be installed
Recommends: libatk1.0-0 but it is not going to be installed
Recommends: libatk-bridge2.0-0 but it is not going to be installed
Recommends: libgtk-3-0 but it is not going to be installed
Recommends: libnss3 but it is not going to be installed
Recommends: libxss1 but it is not going to be installed
E: Unable to correct problems, you have held broken packages.

Following installation sources were configured for Ubuntu via /etc/apt/sources.list:

deb http://archive.ubuntu.com/ubuntu bionic main
deb http://archive.ubuntu.com/ubuntu bionic-security main
deb http://archive.ubuntu.com/ubuntu bionic-updates main

Resolution:

One of the packages required by the scan node (dotnet-runtime-deps-2.2) requires liblttng-ust0 which is only available in the universe ATP-repository. You can execute the following commands resolved the issue:

• $ sudo add-apt-repository universe
• $ sudo apt-get update

If the step above does not resolve the issue, proceed to run the following command:

1. Install Powershell:

• # Update the list of packages

• # Install pre-requisite packages.

• # Download the Microsoft repository GPG keys

• # Register the Microsoft repository GPG keys

• # Update the list of products

• # Enable the "universe" repositories

• # Install PowerShell

• # Start PowerShell

2. Install .net:

•  wget -qO- https://packages.microsoft.com/keys/microsoft.asc | gpg –dearmor > microsoft.asc.gpg
• sudo mv microsoft.asc.gpg /etc/apt/trusted.gpg.d/
• wget -q https://packages.microsoft.com/config/ubuntu/18.04/prod.list
• sudo mv prod.list /etc/apt/sources.list.d/microsoft-prod.list
• sudo apt-get install apt-transport-https
• sudo apt-get update
• sudo apt-get install aspnetcore-runtime-2.2

Issue:

Why is Elements Vulnerability Management product view missing or not visible on the menu on the left in the Elements Security Center? 

Resolution:

The navigation for Elements Vulnerability Management has been changed on the 30th of August 2024 after the introduction of the new Elements Exposure Management product. There is no longer a separate section for Vulnerability Management, it is instead integrated with the existing Endpoint Protection and Endpoint Detection and Response view.

You can view this WithSecure Community article to see exactly how pages were moved around in the Elements Security Center: Upcoming changes to Navigation in Elements Security Center – WithSecure Community

If you do not see the Vulnerability Management related pages in the portal, make sure that the account you are logging with to the Elements Security Center has Vulnerability Management access rights.

If you are a partner user, you should ask one of your colleagues who has the rights to:

1. Login to the Elements Security Center
2. Navigate to the Management > Organization Settings page from the menu on the left
3. Go to the Vulnerability users tab
4. Click on the three dots on the right side of the Users title 
5. Click Add user

Once the user rights have been added, you should also see the Vulnerability Management related pages in your Elements Security Center. 

If you are an end-customer company user, you should be in contact with your WithSecure reseller partner. They can add Vulnerability Management access rights for you. 

Issue:

Scan results shows the wrong installed Windows OS with 87% certainty, stating that a closed port is required for better accuracy. Apart from that is there any other setting that we can tweak in the scan options to increase the accuracy of OS detection?

Resolution:

If scanner was unable to determine operating system version with 100% certainty. We recommend to scan the host again with an authenticated scan.

For steps on Configuring the WinRM service to use HTTP on individual hosts for Authenticated Scans;

For steps on Configuring the WinRM service to use HTTP through GPO;

For more configuring alternatives such as using HTTPS, the full guide can be viewed here: https://www.withsecure.com/userguides/product.html#business/radar/4.0/en/concept_AB45C3CF1EE74D0699BB8BCFFA1C3BA1-4.0-en

Issue:

After onboarding a new Elements Exposure Management, the Identities view in the Elements Security Center does not populate data. I followed the steps documented in the help guide:

https://www.withsecure.com/userguides/product.html#business/xm/latest/en/concept_hvd_jcy_bbc-latest-en

How soon can I expect the data to be ready?

Resolution:

The scanning process could take up to 36 hours to complete. We are working on a change to reduce the scanning duration.

Issue:

When going to the Environment > Devices page in the Elements Security Center portal and clicking a device to see the device details, the Findings tab for Exposure Management findings is missing for a device. 

Resolution:

Make sure that Vulnerability Management Scanning has been enabled for the device and that the scan has been ran on the device. You can see the Vulnerability Management scanning status by clicking on a device and then on the Protection status tab the second row is the VM Scanning status information.

If it is disabled, to enable Vulnerability Management Scanning, select the devices from the Devices list and an Actions menu will appear from the bottom of the page. There you will find a Vulnerability Management scan button. Click it and then confirm the action by clicking the blue button called Enable scanning.

After scanning has been enabled, it usually takes approximately 2-3 hours for the results to show on the Findings tab.