Issue:

Is it possible to see a device's serial number from the Elements Security Center portal if a device has Elements Agent installed on it?

Resolution:

The serial number for a device can be viewed in the Elements Security Center portal if you navigate to the Environment > Devices page and then click on a device to open the device details view. On the left side of the device details view you can find the Device details section which includes the serial number of a device. 

Issue:

Is possible to remotely restart a computer with an operation from the Elements Security Center Portal?

Resolution:

Yes, you can remotely restart a Windows device with an operation from the Elements Security Center portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Select a device from the list (a menu will appear)
4. Click Restart > Restart System

Issue:

The following error is shown after clicking Export Security events (JSON) button on the Elements Security Center portal's Events > Security Events page: "Error exporting security events. Please try again later."

Resolution:

The error you are seeing when exporting Security Events from the Elements portal is typically triggered when the export query covers too many events at once. The platform has a practical limit of around 10,000 events per export request, and larger datasets can cause the operation to time out.

To resolve this, please try the following steps:

1. Break the export into smaller time ranges — for example, export 14-day periods rather than a wider date span.
2. Use the date filters (before/after) available in the Security Events tab to narrow the result set before triggering the export.
3. If the error persists even on a small date range, please clear your browser cache and cookies, then retry. You can also try in incognito/private browsing mode or with a different admin account to rule out a browser-side issue.
 

Issue:

If I create in the Elements Endpoint Protection device profile a Real-time scanning > Excluded objects exclusion, will it also exclude that file or path from the DeepGuard feaure? 
 

Resolution:

The Excluded objects exclusion on the Elements profile's Real-time scanning settings page excludes the file or folder only from real-time scanning and not DeepGuard. 

To create a DeepGuard exclusion, you need to add the file or folder path to the Scanning settings > Global exclusions list or to Real-time scanning > DeepGuard settings > Protection rules list. 

Issue:

We want to change the language of the Elements Agent graphical user interface. Is it possible to change the language either from the local settings or from the Elements Security Center portal?  

Resolution:

It is not possible to change the language of the Elements Agent after it has been installed on a computer. During installation it by default uses the system language as the language for the Elements Agent user interface.

To change the language you will need to reinstall Elements Agent on the computer. When you run the Elements Agent installer .exe on a Windows computer, the language can either be chosen from a drop-down menu during the installation or with the –language <id> </id> parameter if you run the installer from a Command Prompt. 

The parameter "id" must be a valid language identifier in IETF-format.

The ID value can be one of the following: en, cs, da, de, el, en, es-MX, es, et, fi, fr-CA, fr, hu, it, ja, ko, nl, no, pl, pt-BR, pt, ro, ru, sl, sv, tr, zh-HK, zh-TW, zh.

For example:
C:\Users\<username>\\Downloads>installer.exe –language en

Issue:

Can end-customer users receive access to the WithSecure Academy portal (Learning Management System / LMS)? 

Resolution:

The WithSecure Academy is meant for WithSecure reseller partners. For end-customer users, ee have publicly available training courses for Elements Extended Detection and Response (XDR) and Elements Exposure Management: https://www.withsecure.com/en/support/technical-training

There are available trainings for the following products: 

• Elements Endpoint Protection (EPP) 
• Elements Endpoint Detection and Response (EDR)
• Elements Collaboration Protection (ECP)
• Elements Exposure Management (XM)

Issue:

What log files are included in the Elements Endpoint Detection and Response forensics package archive (.zip) if it has been collected from a device?

Resolution:

The forensics package is a zip archive that contains the following information about device.

Issue:

Can Elements Connector be installed in a non-default / custom installation path / directory?  

Resolution:

Elements Connector MSI installation package supports TARGERDIR parameter, so you can use it.

For example:

• msiexec /i <name of the installation package> TARGETDIR=D:\<path and name of the wanted location> 
   

Issue:

If a device has been isolated from the network due to a high or severe risk level EDR Broad Context Detection, can a device be released locally from network isolation if the automated actions feature has isolated it? 

Resolution:

If a device has been isolated from the network by the Automated actions rule, the device cannot be released from isolation locally. You need to release it from the Elements Security Center:

1. Log in to the Elements Security Center portal 
2. Navigate to the Environment > Devices page
3. Select the device which has been isolated from the network (a menu will appear) 
4. Click Network isolation > Release from network isolation

Issue:

When a user tries to access some websites with their internet browser, they are shown the following error depending on the browser in use:

• Google Chrome and Microsoft Edge: "The connection for this site is not secure – <website address> sent an invalid response – ERR_SSL_PROTOCOL_ERROR
• Firefox: "Secure Connection Failed – The page you are trying to view cannot be shown because the authenticity of the received data could not be verified – Error code: SSL_ERROR_ACCESS_DENIED_ALERT" 

Why are these errors shown only on specific sites and how can we fix these errors from appearing?  

Resolution:

This error is shown because the Browsing Protection feature has blocked the website and the Browsing Protection by WithSecure browser extension / add-on is either not installed or activated in the browser. The extension / add-on is required to be able to show the Browsing Protection block page on HTTPS websites. On HTTP sites the block page can be shown even when the extension / add-on is not installed or active in the browser. 

A website can be blocked for example if:

• Website is rated as harmful or suspicious by Browsing Protection
• Website category has been blocked by the Web Content Control feature
• Connection Control is active and the website is not rated as safe for banking

You need to make sure that the Browsing Protection by WithSecure browser extension / add-on is installed and active in your browser. 

How to install the extension / add-on: 

1. Right-click the Elements Agent or Client Security icon in Windows the system tray
2. Click Open settings 
3. Go to the Browser extensions settings page
4. Follow the instructions to install the browser extension