Issue:

Several devices become slow if both Box application and EPP for Computers are installed.

The issue has started since 1/28, when Box new version 2.25.304 were applied.
If Box application is stopped, the issue is solved.
If EPP for Computers is uninstalled or disabled, the issue doesn't happen.
OS restart doesn't solve it.
 

Resolution:

Please do below to collect dump(Article Number 000028877)

#In some cases there's something preventing us from optimally scanning file I/O (our bugs, 3rd party intervention, hardware issues, etc.), scanning may become too slow and eventually some files are just timing out and cannot be scanned. Driver writes a message about this situation in event log : "event ID 1" from "F-Secure Gatekeeper" (with file name in content). To investigate those issues, R&D sometimes asks customer to provide a "crash-on-hang" dump. It might be unwelcome to some customers, as a) creating the dump is critical failure for the system, meaning that some data might be lost, and b) generated dump contains all memory contents of the machine at the time of event, including personal data.
Still, in case we're allowed to proceed with collecting the dump, instructions are:

• In HKLM\SYSTEM\CurrentControlSet\Services\F-Secure Gatekeeper\Parameters, create a DWORD value 'BreakOnHang" with value 1.
• In "advanced system properties" ("my computer", right click – "properties", "advanced system settings" on the left) pick "startup and recovery" and make sure "write debugging information" is enabled with "complete memory dump" option). Exact instructions could be different depending on exact OS.
• Make sure there's enough memory on boot partition (20Gb+)
• With all this, restart scanning platform including Gatekeeper driver (or just reboot)
• Reproduce the problem
• When the "hang" happens, computer would bluescreen instead of writing event log messages. 
• memory.dmp (usually in c:\windows) has to be collected; note that it's usually protected so that only elevated administrator can copy the file.

As a workaround so far. 

– Stop Box application and OS restart.
– Disable or uninstall EPP for Computers.
– Upgrade Box version to 2.25.306

Issue:

It appears that WithSecure Software Updater does not check if Zoom Client product is up to date.

Resolution:

The exe installer for Zoom is unsupported since it is a user-specific installation instead of machine-wide (it runs out of AppData within the user profile, does not lay down reg keys in HKEY_LOCAL_MACHINE). 

In order to be patched by our engine, the installation on the computer needs to be done using the msi installer. This installer is available on Zoom's website and it is named "Zoom Client for Meetings – MSI Installer": 

https://support.zoom.us/hc/en-us/articles/207373866-Zoom-Installers

Issue:

Why is spam / bulk / advertising / phishing email getting through even if Elements Collaboration Protection is in use? Shouldn't spam email be filtered by the spam filter? 

Resolution:

Elements Collaboration Protection does not include a spam filter. Microsoft Office 365 has its own anti-spam policies, of which you can learn more from here: https://learn.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-your-spam-filter-policies?view=o365-worldwide

All the Security Features available in Elements Collaboration Protection are listed in the Help Guide: https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/concept_A2F2B7767CA646668F86D4A6D6C7BB01-latest-en

Issue:

When looking at an forwarded Windows system event from the Events > Security Events page in the Elements portal, the reported user name shown in the Details drop-down does not match what is reported in the file downloaded using the Event XML: Download XML link or the system event itself when looked locally from the Windows Event Viewer

For example, in a Event ID: 4625 "An account failed to log on" event, The User Name and Principal User Name do not match with the actual account which failed to log on. Why is the wrong username listed in the detection details? 

Other Event ID:s which have the same issue: 

• A user account was locked out. Event ID: 4740, event source: Microsoft-Windows-Security-Auditing.

Resolution:

The User name and Principal User Name in the Details section in the Security Alert do not refer to the affected user of the alert, they are just information taken from the Device details page in the portal of the last successfully logged in user. 

You need to click on the Event XML: Download XML link to view the details of the actual user for this system event. 

Issue:

Is it possible to use wildcards with the Device name search in the Elements portal's Enviroment > Devices page? For exampe to search a device (e.g. EXAMPLE-PC123) in the Elements Security Center portal by using characters in the start, end or inside of the string (e.g. PC123)?

Resolution:

The search functionality on the Elements Security Center portal's Environment > Devices page will do a "contains" search, so you can search with any string that the device name might contain. You do not need to use an asterisk as a wildcard, simply enter the characters that the device name contains. 

Issue:

Elements portal's Security Events page shows that "OfficeClickToRun.exe" was blocked from changing the "fshoster64.exe" process , whereas "fshoster64.exe" can be any WithSecure service is generated.

Will selecting acknowledge allow the specific process to run? Or we still need to do manual whitelisting or exclusion?

Resolution:

We are aware of this issue and the alert is triggered because OfficeClickToRun.exe attempts to change WithSecure processes and the product therefore blocks the action, this is why the alert is expected. When this alert is shown, it means that we have only blocked the process from touching WithSecure processes, all other actions of the detected process can continue as normal. If the alert is triggered for example for an installer, the installer will still be able to complete its installation or update without issue.

You can manually suppress the alerts by following these instructions:

How to suppress the alerts

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Go to the Events -page
3. Choose Security Events
4. Locate the alert where DeepGuard has blocked "OfficeClickToRun.exe" from changing WithSecure processes
5. Click on the three dots under "Menu"
6. Click on Show similar events
7. Click on Acknowledge all

This will acknowledge and clear all alerts regarding OfficeClickToRun.exe. 

Note – Acknowledge will not allow the specific process to run. It is just about managing which items are handled and which are not.
 

If needed, you can also exclude the file or folder from scanning and DeepGuard monitoring:

How to exclude a file or folder from Real-Time Scanning or DeepGuard

1. Log in to the Elements Security Center: https://elements.withsecure.com
2. Navigate to the Security Configurations > Profiles page
3. Choose the profile which the devices are using
4. Go to the Scanning settings page
5. Scroll down to the Global exclusions from all security scans section and click Add exclusion
6. In the Path field add the:
   • Full path for the application if you want to exclude a specific application
   • Folder path if you want to exclude a folder and its sub folders
7. Click Save profile

How to exclude a process from DeepGuard monitoring using the SHA-1

1. Log in to the Elements Endpoint Protection portal 
2. Go to the Security events page
3. Click on the three dots on the right side of the DeepGuard detection
4. Select Exclude file by SHA1 
   • The file SHA1 is automatically added to the Global exclusions from all security scans list
5. Click Save profile

Issue:

Protection for OneDrive assets are always Unprotected. If we try to enable it manually, after a short time it will goes back to Unprotected status.
This happens a few tenant accounts

Resolution:

In relation to the issue of OneDrive assets losing protection over time, you might want to review the Elements Collaboration Protection permissions in Microsoft Azure for OneDrive. There's possibility permission for the OneDrive assets were revoked and that's why it keeps reverting back to 'Unprotected' status.

In that case, the solution would be to manually disconnect the affected OneDrive service on affected tenant accounts and once it's disconnected, reconnect it and configure protection if needed according to the instruction in this product admin guide:

https://www.withsecure.com/userguides/product.html#business/fse4ms365/latest/en/task_81C9FFE13F4F41C6A0BD117DDA07AE41-latest-en

In order to reconnect the OneDrive service, you will need to use Microsoft admin account for given tenants.

If the issue continues, provide the following information for further assistance.

• Microsoft Azure Active Directory (tenant) ID 
• WithSecure (tenant) ID
• License keys

Follow this guide on how to obtain aforementioned information:

1. Log on to the Elements Security Center https://elements.withsecure.com/
2. Go to Collaboration Protection > Cloud services
3. Select the tenant cloud services
4. The information will be displayed under the Summary tab

Issue:

No company listed in the Organizations drop-down list after clicking Add rule on the Automated actions page in the Elements portal's Security Configurations > Automated actions page. The list is blank or empty.

Resolution:

This issue is most likely caused by the browser cache.

To fix the issue, you can try these steps:

1. Reset your browser cache for the address elements.withsecure.com
2. Clear your browser cache.
3. Use Incognito or In-Private browser window.

After this all the companies on the chosen scope should be listed in the Organizations drop-down list. 

Issue:

When user has set the report data source to be "Security Events" for the Elements Endpoint Protection portal's "Reports > Email notification and report" feature, no email is sent at all when user clicks the Send test report button. 

Resolution:

The reason why Send test report doesn't send an email when Security Events is used as the data source is because of the "Send only when report has content" setting, which is configured when creating the report. This setting can be a bit misleading, because it works more like "Send only when report has new content".

The report is sent only when an alert appears on the Elements portal's Security Events page that hasn't already been emailed before and is less than 24 hours old. Whenever an alert has been included in a sent email, it will be marked as sent. The report automatically uses the "Frequency = Continuous" setting, which means that precisely every ten minutes (e.g. 13:40 and 13:50, etc.) an email is automatically sent if Security Events contains unsent information.

This means that when you press the Send test report button, it is very likely that the Security Events list does not contain any new alerts and therefore no test email will be sent either. For the Send test report to work, the alert should have to arrive to the Security Events page for example at 10:51 and the Send test report button would be needed to be clicked before 11:00, when the report is automatically sent as per the continuous schedule.

As a workaround, you can temporarily disable the "Send only when report has content" setting in the report and then click on the Send test report button. This will send a report that still includes the link that will forward you to the Elements portal's Security Events page which the correct view automatically open. Remember to re-enable the "Send only when report has content" after you are done testing. 

Issue:

Licensing and activation in Office 365/Microsoft 365 are being blocked by Browsing protection/Web content control.  

Resolution:

Following domains/URL are necessary for Microsoft365/ Office365. Browsing protection category sometimes consider those as Webmail/SNS/Entertainment/etc depending on the site reputation report. Please allow those URL in your profile by adding Web site exceptions.
 

https://officecdn.microsoft.com
https://ols.officeapps.live.com/olsc
https://activation.sls.microsoft.com
https://odc.officeapps.live.com
https://crl.microsoft.com/pki/crl/products/MicrosoftProductSecureServer.crl
https://crl.microsoft.com/pki/crl/products/MicrosoftRootAuthority.crl
https://crl.microsoft.com/pki/crl/products/MicrosoftProductSecureCommunicationsPCA.crl
https://www.microsoft.com/pki/crl/products/MicrosoftProductSecureCommunicationsPCA.crl
go.microsoft.com
office15client.microsoft.com

#Wrongly categorized url can be corrected via SAS(submit-a-sample) request. 
https://www.withsecure.com/en/support/contact-support/submit-a-sample

All the domains for Office/Microsoft 365 licensing can be found in this article step3.
https://docs.microsoft.com/en-my/office/troubleshoot/activation/issue-when-activate-office-from-office-365

#Those domains can be changing anytime and Withsecure cannot provide latest information. By allowing root domain can be workaround for that. This may cause lower security.
 

*microsoft.com
*live.com