Issue:

There are two detections which description in breach details and time of breach are same on Elements Collaboration Protection(ECP).
But Time of detection is different. Time of detections are14.04.2023 and 04.07.2023.

Does it mean that ECP detected same information about the breach twice? 
Are those breaches considered as identical incident?

Resolution:

Yes, these two detections refer to the same incident. The breach only occurred once, but because our breach detection engine have a significant breach information modification, it caused a new detection to be triggered as well.

Issue:

Unable to delete, modify or edit Elements Collaboration Protection policy due to it being read-only or having public visibility. 

Resolution:

If a Elements Collaboration Protection policy has the Read-only tag or Public visibility. it means that it either has been created on the partner level or it is a default WithSecure policy, in which case a user on the company level will be unable to delete or modify the policy (settings are grayed out). The Owner column will show you on which account the policy was created on. 

If the policy is a default policy that has been created by WithSecure, you will not be able to modify it or delete it. 

To delete the policy:

• If you are an end-customer, please ask your WithSecure partner to delete the policy. 
• If you are an WithSecure partner, make sure you are logged in with your partner level user account and that you have selected the partner level from the scope drop-down menu.

To edit a policy:

• If you are an end-customer, you cannot edit policies which are not created by you (settings are greyed out). You can click on the three dots on the right side of the policy to copy it and then assign that newly created policy on your cloud services.
• If you are a WithSecure partner, select the solution provider level from the scope down-down menu (located on the top of the page) to be able to edit the policy.

Issue:

When Windows Endpoint client is installed, in C:\Windows\Temp\, the folder fs-capricorn fills up hard disk with files named AV-malware-names until there is no free space left.

Resolution:

The files in the fs-capricorn folder are normally deleted when the computer is shut down. Unexpected system crashes can cause a situation where the files are not automatically removed. 

You can safely go ahead and manually remove the AV-malware-names files in the fs-capricorn folder. Take note that some of the files can be in use and locked and therefore they cannot be removed. You can skip the removal of those files.

Issue:

The "Save profile" button in an Endpoint Protection profile is grayed out hence unable to save the profile in the Elements Security Center Portal. 

Resolution:

There can be different scenarios that could cause the problem. Check the following:

• The active firewall profile is set to Automatic selection but no automatic selection rules have been set. You will not be able to save the profile until you have either set rules for the automatic selection, or switched to using a single firewall profile.
• There are duplicate firewall rules (same rule name) in the firewall profile. As it can be both, active and inactive rules causing this, enable the Show inactive rules in order to verify this. The affected rules should be marked with a red line on the left side of the rule so that they can be easily identified.
• There are duplicate entries in the existing denied sites list. You should remove these duplicate entries.
• There is an incorrect value configured for a setting in the profile.

There should be red and yellow highlights shown for the settings that have invalid values. Fix these invalid values and check if the "save profile" button can be clicked. 

Issue:

Trying to reset user account password for the Elements Portal/Business Account but no email is sent

Resolution:

If you don't get an email message when using the forgot password function in the Elements portal/Business Account try the following:

• Check that you are using the correct username or email address.
• Clear web browser cache and cookies. 
• Check your spam and junk email folders. If you have automatic sorting to different folders, check if the password reset email is found in one of them.
• If all login and password reset attempts fail, contact WithSecure Customer Service and they can investigate the issue.

Issue:

Elements Endpoint Protection portal's Security Events page shows Trojan:W32/GenInflated.B infection name for: 

• C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Cache\6b9a4d43-a587-4b92-882f-398e6d291cb5\content.bin\[50] PowerAutomateDesktop-11.2401.31.0-x64.msix\[1] AdaptiveCards.dll

Alert type on_demand_scanner.file_infection.nothing

Example SHA-1: 

• 2dcf073e1c252d0b6106aa9e98ff7ee335fb29ac
• afc450c794c05185440a39076e7d766d25b31b7b
• c9612dd52736928d64c0c6c4a52f80f394752fea
• 52f4251fac3d15ce318a5ee7f963cbdece1c5c0e

Is this a false positive or not? 

Resolution:

This Trojan:W32/GenInflated.B detection for adaptivecards.dll detection occurs because the AdaptiveCards.dll  is over 800MB in size. We have released F-Secure Hydra Engine (64-bit) 2024-02-26_01) which should fix the issue. If you are still seeing this detection appearing on one or more devices, make sure you have the latest Hydra Engine version installed on the device.  You can check the version by right-clicking the Elements Agent icon in the taskbar and then selecting Check for updates.  

If you do not want to receive further security alerts about this detection, you can exclude the SHA-1 from the Elements profile:

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile that is in use on your devices
   • Note that only custom profiles can be edited. You can create a custom profile either by clicking "Create a profile" or cloning an existing profile
5. Go to the General settings page in the profile
6. Click Add exclusion in the Exclude folders and files from all security scans section 
7. Enter the SHA-1 value from the detection (Detections can be viewed from the Events > Security Events page)
   • If you want to add multiple SHA-1 values, create separate exclusions for them by clicking Add exclusion again
8. Click Save and publish

Issue:

• Unable to install Elements Agent (Elements Endpoint Protection Agent) due to .NET Framework 4.7.2 dependency. This affects multiple operating-systems, including Windows 7, 8 and Windows 10 and Windows Server.
• This can trigger the error: NET Framework of version 4.7.2 or greater is not installed – msi error 1603 during installation.

Resolution:

During the channel upgrade, the client requires .NET Framework 4.7.2 and installs it automatically if it is missing. This does not apply for the offline-installer, which assumes the depending .NET packages are installed.

In the event that .NET Framework fails to install, does not automatically install or requires manual installation, proceed with the manual installation of .NET Framework. It is highly recommended to ensure Windows Updates are fully updated to ensure successful installation of .NET Framework 4.7.2. Some Windows updates include the .NET Framework 4.7.2 update (example: KB4054530, KB4054542 etc.)

Note: Windows 10 versions before Windows 10 Anniversary Update (version 1607) do not support .NET Framework 4.7.2.

For more information refer to links below

• https://help.f-secure.com/product.html#business/computer-protection-windows/latest/en
• https://blogs.msdn.microsoft.com/astebner/2007/03/14/mailbag-what-version-of-the-net-framework-is-included-in-what-version-of-the-os/ 
• https://en.wikipedia.org/wiki/Windows_10_version_history 

Issue:

When multiple devices have been selected in the Elements Endpoint Protection Portal Devices list, only Move to blocklist can be selected while Remove permanently has been grayed out.

Resolution:

This is by design. The Move to blocklist will remove the device from the list, release the license and move the device to the blocklist. If the blocklist is emptied, the device will automatically take the license back into use and reappear on the devices list.

If the Remove permanently is used, the device will be immediately removed permanently without going through the blocklist. This feature should be used when the software needs to be reinstalled on the same device. 

Remove permanently is grayed out, to avoid anyone from mistakenly removing many or all devices permanently from the Elements Endpoint Protection Portal, which would require a manual reinitialization of the Elements Agent using the fs_oneclient_logout tool.

Issue:

Resolution:

If the detection found except neither Inbox nor Sent, it might cause when the mail was moved directory.
The suspicious emails are automatically scanned depending on the action defined in the security policy.

Issue:

Software Updater is unable to download Java updates.

Trying to use the same download link that is written in the logs leads to an error, so it can't be used manually.

Resolution:

Oracle has changed the way Java is licensed. A side effect of this is that Java updates can be downloaded only from the vendor's server with authentication. This stops Software Updater from downloading the Java update. 

We have published a change to Computer Protection to stop showing Java update as a missing update in Software Updater. After this, you will need to install Java update manually (not via F-Secure Software Updater). 

At the same time, we are not going to change the Software Updater behavior for the rest of the products. 

To stop Software Updater from trying to install the problematic Java update automatically, you can exclude the Java Update from the automatic installation by following these steps: 

If you have a Business Suite product (Client Security or Server Security) 

1. Log in to Policy Manager Console
2. Select the target group from the Domain Tree
3. Go to the Settings tab
4. Select Software Updater 
5. Click on Add from the right side of the Exclude software from automatic installation list
6. Use Java as the software name to exclude it

If you have an Elements Endpoint Protection product (EPP for Computers or EPP for Servers) 

1. Log in to the Elements Endpoint Protection Portal
2. Go to the Profiles page
3. Click the profile you want to edit
4. Select Software updater 
5. Click Add software below Exclude software from automatic installation 
6. Write Product=Java to exclude Java software from automatic installation

After the change, you will need to install the Java update manually.