Issue:

Is it possible to reset, delete or remove all or some events from the Events > Security Events page in the Elements Security Center Portal?

Resolution:

It is not possible to reset, delete or remove events from the Events > Security Events list in the Elements Security Center portal. The info alerts are stored for 7 days, warning alerts for 6 months and critical alerts for 13 months.

Once the event has been automatically removed from the portal, it cannot be recovered. 

Issue:

How long is the data retention period for Security Events in the Elements Security Center portal? For how long are the security events stored on the Events > Security Events page's list?  

Resolution:

Security Events retention period in Elements Security Center portal depends on the Severity level. The info alerts are stored for 7 days, warning alerts for 6 months and critical alerts for 13 months. 

Issue:

When will a device that is shown on the Elements Security Center portal's Environment > Devices > Manage removed devices  list be automatically removed from the list?

Resolution:

If the Elements Agent is uninstalled, then the device will be removed from portal after 6 months from the date it was uninstalled. 

If the device is manually removed from the portal (but not uninstalled), then the device will be removed from the list after 12 months from the date it was removed.

Issue:

Elements endpoint devices have suddenly disappeared from the Elements Security Center portal's Environment > Devices page and fewer licenses are in use. What might have happened to the devices? 

Resolution:

The most common reason for a visible drop in the endpoint count in the Elements Security Center is the "Manage automatic deletion" feature. If this feature is enabled on the company account, devices that have been offline for longer than the configured threshold are automatically removed from the portal.

You can check the Manage automatic deletion value by following these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Navigate to the Environment > Devices page
3. Click on the three dots 
4. Select Manage automatic deletion
5. View the amount shown in the days field
6. Click Save

You can also from the Elements Security Center portal check when devices have been uninstalled or removed from the portal. Navigate to the Environment > Devices > three dots > Manage removed devices page. Here you can from the Device state column check if the reason for the removal was either uninstallation or if it was simply removed. 

From the Management > Audit Log page you can check who has issued the removal operation if it was done manually by an administrator. 

Issue:

Elements Endpoint Protection doesn't scan a USB drive when "Action when USB storage device is plugged in" is set to:

• "scan USB and show results to user" 
• "Silently scan USB" 
• "Force scan USB and show result to user" 
• "Ask user to scan USB" 

Resolution:

Make sure that the USB drive that you have connected to the computer is a USB thumb drive or an SD card. If it is an external HDD, it will not be scanned even if it would use a USB connection.

This is expected behavior since the "Action when USB storage device is plugged in" feature uses internal Windows device flags which tells Windows which type of device is connected. It's not using device ID or hardware ID.

Issue:

How to send Elements Endpoint Detection and Response (EDR) scheduled reports via email?

Resolution:

You can on the Elements Security Center portal's Reports > My Report page create a custom template which can then be used on the Email notification and report tab as a source for a scheduled email report. 

Follow these steps:

1. Log in to the Elements Security Center portal 
2. Navigate to the Reports > My reports page 
3. Click New view template and enter a name for the template
4. Click Add widget
5. Enter a name for the chart 
6. Select from the Data Source drop-down menu Broad Context Detections
7. Select from the Data drop-down menu the Broad Context Detections information you want to add as a widget
8. Click Create 

You can repeat steps 4. through 8. to add multiple widgets.

Once you have created the template, you can create the scheduled email report that uses the template as the data source:

1. Go to the Email notification and report tab
2. Click Add email report
3. Enter a name for the report
4. As Data source, select My report
5. From the Template drop-down menu select the EDR template that you created earlier
6. Enable Include list of EDR Broad Context Detections 
7. Select the language
8. Choose the Schedule
9. Enable Send only when report has content
   1. Note: If you want to send a test report with the Send test report button, temporarily disable the Send only when report has content setting before sending the test report. This because if report has no content, the test report will not be sent. 
10. Enter the recipients
11. Click Save

Issue:

Error "Failed to save profile TX-ID: 0000-XXXXXXXX" when trying to edit or modify a setting with the profile editor in the Elements Security Center portal. 

Resolution:

If you receive a "Failed to save profile" error when saving an Elements profile, the issue is most of the time caused by a invalid setting in the Elements profile. Try to clone the profile and then make your modification and then try to save the newly cloned profile. If you receive the same error, you can either try to create a completely new profile or try to fix the original profile.

If you want to try to fix the original profile, check in the profile's navigation menu on the left side if there is a red stripe on the left side of any of the settings pages. That red stripe indicates that there is an invalid setting that you need to either remove or modify. 

If no red stripe is shown, then the issue is very likely due to a custom Application Control or Automated Tasks rule. Try to remove Application Control rules and Automated Tasks one by one and try to save each time you have removed a rule. Once you have found out which rule is causing the issue, you can remove or modify it and then save the profile. 

Issue:

Usage time of the Android mobile is reduced by 80% as long as Elements Mobile Protection is installed.

Resolution:

Elements Mobile Protection will always do a full scan of the system when the Android mobile device is restarted. If you restart the device daily or very often, the Elements Mobile Protection application can drain a significant amount of battery. 

Also check that you do not have scheduled scanning set to do a daily scan:

1. Log in to the Elements Security Center portal
2. Navigate to Security configurations > Profiles page
3. Go to the for Mobile tab
4. Click on the profile that is in use on the device
5. Go to the Malware protection settings page
6. Scroll down to the Scheduled scanning section
7. Make sure that the Scan frequency is not set to Daily
8. Click Save profile

If battery usage is still very high after checking the scanning settings, you can try to see if reinstallation of the app fixes the issue. 

Issue:

Elements Endpoint Protection Software updater (patch management) feature shows updates to be available for software which have already been uninstalled from a device. Why does Software Updater detect updates for software which no longer are present on a device? 

Resolution:

If Elements Endpoint Protection Software Updater feature would list updates to be available for software which no longer are installed on a device, we recommend to check that the software has been successfully uninstalled. In some instances, traces of registry entries of the uninstalled software can be still left on the system and that is the reason why Software Updater feature detects it and offers updates for it. 

Also check that there is no entry for the software on the Windows "Installed Apps" list. 

Issue:

How to collect the diagnostic file from Elements Mobile Protection?

Resolution:

If you have technical problems with your product, you can create and send a diagnostic file (wsdiag) to our technical support. The file contains information that can be used for troubleshooting and solving problems specific to your device.

To generate a log file with your smartphone:

1. Open the Elements Mobile Protection app.
2. Tap the main menu in the top-left corner, and select About. The About MOBILE PROTECTION page opens.
3. Tap seven times on the version number. The SEND LOG FILE button is displayed at the bottom of the screen.
4. Tap the SEND LOG FILE button and select your email sending method. If you need to provide the file to Withsecure support, send the file to your own email address initially and attach it to the support-ticket. The email message opens with the log file attached to it.
5. Describe the problem in the email.
6. Send the email.

To generate logs in case of problems with Mobile Protection activation, when About view is not available:

1. Open the Elements Mobile Protection app.
2. Tap ten times on the description text (This software requires a valid license for Endpoint Protection to work…) . The SEND LOG FILE button is displayed at the bottom of the screen.
3. Tap the SEND LOG FILE button and select your email sending method. The email message opens with the log file attached to it.
4. Describe the problem in the email.
5. Send the email.

A diagnostic file can also be requested remotely from the Elements Security Center portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. Open the Mobile devices tab
4. Click on a device (An Actions menu will appear)
5. Click Request diagnostic file 

Once a diagnostic file has been uploaded to the Elements portal it will be available for download on the device's Operations tab or if you on the Devices page click on the three dots and go to the Manage Operations page.