Issue:

• User wants to move already existing Elements Agent (EPP for Computers or for Servers) installations from one Elements company account to another
• How to change the subscription key that is in use in the Elements Agent locally so that the devices would move to another Elements company account?
• I have setup the Elements Agent on a device using an incorrect subscription key and this device is showing up under the Devices view in the incorrect customer account now. How can I move this device back to the correct customer account?

Resolution:

If the Elements Company account is in the same Elements portal (EMEA1, EMEA2, APAC, AMER, SMIEU), you can use the Change subscription feature to change the subscription key of a device:

1. Login to the Elements Endpoint Protection Portal with your Solution Provider user account
2. Select the Solution Provider level from the scope-selector
3. Go to the Environment > Devices page
4. Filter the devices with the Company name filter
5. Select the device(s) to be transferred (a menu will appear)
6. Click on Change Subscription
7. Select from the available subscription keys and click on Change Subscription again

Note: Switching to a different Company can only be done on SOP level. If performed on company level, the function "Change Subscription" can be used to change a device's subscription key internally within the company

If the Elements Company accounts are in a different Elements portals, you can use the local ws_onclient_logout tool to change the subscription key and the portal the device is connected to. The ws_oneclient_logout tool allows you to log out from the Elements Agent, so that you can re-enter the subscription key to connect a device to the correct company in the Elements Endpoint Protection management portal. This command-line tool removes the current subscription from the Elements Agent and returns the software to its initial state, before a subscription key was used. The tool can be found and run from the Elements Agent installation folder:

1. Open a command prompt with administrator privileges
2. Navigate to the Elements Agent installation folder: %ProgramFiles(x86)%\F-Secure\PSB
3. Run the tool in the command prompt:

• To log out and register to WithSecure Elements Endpoint Protection Portal automatically, run \ws_oneclient_logout.exe –keycode <subscription-key> . Elements Agent will log out and start using the subscription key that you entered immediately.
• To remove the current subscription key, run \ws_oneclient_logout.exe –nokeycode. Elements Agent will stop working and asks you to enter a new subscription key manually when you open the main view of the application.
• You can switch registered clients between the different Elements portals by specifying one more command line parameter based on the portal name, for example, “–psb1”, “–psb2”, “–psb3”, “–psb4”, “–psbsmieu”. Do not use these parameters if you are not moving clients between portals. 

If the tool runs successfully, it returns 0 as the result. In other cases, for example if the network is unavailable or you enter an incorrect subscription key, Elements Agent will stay in the "expired" state and asks you enter the new subscription key manually.

Issue:

How to test if EDR sensors on Windows, Mac and Linux are working and reporting detections to the Elements Endpoint Detection and Response portal?

Resolution:

For Windows sensors there are a few tests outlined in the product Simple test with Windows system tools | Elements Endpoint Detection and Response | Latest | WithSecure User Guides

Mac sensors can be tested by running the following Terminal commands for different detection event types:

file event test:
uuid=$(uuidgen) && touch "$uuid" $(printf this_is_%s_test_file f_secure)

socket event test:
python -m SimpleHTTPServer

Linux sensors can be tested by running the following Terminal commands for different detection event types:

file event test:
touch this_is_f_secure_test_file

socket event test:
python -m SimpleHTTPServer

Issue:

How to migrate Business Suite Server Security to Elements EPP for Servers for Windows using Policy Manager?
Does the server need to be restarted to finish the migration? 
how to migrate computers from WithSecure Client Security to WithSecure Elements EPP for Computers and from Server Security to WithSecure Elements EPP for Servers

Resolution:

Instructions on migrating computers from WithSecure Client Security to WithSecure Elements EPP for Computers and from Server Security to WithSecure Elements EPP for Servers for Windows can be found in our help guide, accessible here: Migrating computers | Elements Endpoint Protection | Latest | WithSecure User Guides

The migration may require the server to be restarted to finish the installation, so perform the migration during a time when the server can be restarted. 

Issue:

How to transfer or move an Elements Endpoint Protection (EPP for Computers or EPP for Servers) subscription from an old device to a new device? 

Resolution:

To transfer a license from an old device to a new device, you will need to remove the old device from the Elements Endpoint Protection portal to release the license. After releasing the license, you can install the product on the new device. 

Follow the steps below to transfer an Elements Endpoint Protection license from an old device to a new device: 

1. Log in to Elements Security Center: https://elements.withsecure.com
2. Expand the Environment category on the left pane
3. Click on Devices page.
4. Select the old device by selecting it from the list (an actions menu will appear)
5. Click Remove device > Remove device

After the old device has been removed from the Devices list, install Elements Agent on a new device by downloading the installer from the Management > Downloads page.

Issue:

How to remove an Elements EPP for Computers or EPP for Servers device in the Elements Security Center? How to release a license? 

Resolution:

You can remove devices from the Elements Security Center by following the steps below. Once a device has been removed from the Elements Security Center, the license it was using can be used on another device. 

Note: Removing a device from the Endpoint Security Center's Devices page does not uninstall Elements Agent from the device. If you want to uninstall Elements Agent remotely and at the same time release the license, you can follow the instructions at the end of this article.

How to remove a device and blocks the device to register back:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page 
4. Click on the white box on the left side of the device name, a menu will pop-up from the bottom
5. Click on the Remove device button
   • Leave the "Block device from returning" checkbox empty if you plan to reinstall Elements Agent to the device
   • Tick the "Block device from returning" checkbox if you don't want the device to be able to reconnect to the portal
6. Click Remove device

If you have ticked the "Block device from returning"  and want to re-install Elements Agent on that device, you will need to restore the device from the block list.

To restore devices from block list:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page
4. Click on the three dots on the right side of the Devices title
5. Click Manage removed devices
6. Click on the three dots on the right side of the device that has Device State as blocked 
7. Click Activate device

How to remotely uninstall Elements Agent:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page 
4. Select the device (a menu will appear from the bottom of the page)
5. Click Uninstall > Uninstall device

Note: Remote uninstall operation is only available for Windows devices 

Once the operation has gone through, Elements Agent will be uninstalled from the device and the device will be automatically removed from the Devices page and the license will be released. 

Issue:

When configuring compromised accounts in Cloud Protection for Office 365, I would like only the administrator to receive notification if an account is found compromised.

Resolution:

You have the option under Compromised accounts in your policies to notify the administrator and the users. These both options are selected by default. You can uncheck the Notify the user option under Compromised accounts and users will not be notified anymore.

Issue:

I have uninstalled the sensor, how to remove the device from the Elements Endpoint Detection and Response portal?

Resolution:

The devices cannot be manually removed from the Elements Endpoint Detection and Response portal. Inactive devices will remain in the Elements Endpoint Detection and Response (EDR) portal Devices view for 90 days before the removal. If a device becomes active after removal, it will appear back in the list.

Here is a list of the different possible statuses:

EDR Status and color code:
Active   | Green = seen in last 24 hours 
Inactive | Yellow = seen in last 7 days 
Inactive | Red = not seen in 7 days

The device details are not removed from the EDR portal immediately after e.g. device is deleted from the EPP side or the client is uninstalled. The reason for this is that EDR stores a lot of event and incident information that can be relevant in Incident response carried out after the device is taken out of use. The device is a very important part of the BCD context. If information from the device is lost, BCD incident analysis and potential IR (incident response) will become difficult. Very often incident investigation or evidence collection starts days or weeks after the fact. Already removed device could be root source or part of e.g. lateral movement activity detected in BCD and incident investigation. For this reason, the EDR portal keeps devices information after a device has been removed to enable full incident investigation.

Issue:

How to create or add an Elements Endpoint Protection Application Control exclusion rule if an application has been blocked for example by a default rule.  

Resolution:

If an application has been blocked by an Application Control rule, you need to first check the block details from the Elements Endpoint Protection portal's Security Events page so that you can create an exclusion based on that information. How to view detection details:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Events > Security Events page

You can filter the Security Events page to only show Application Control events by adding a "Source equals Application control" filter. 

Open the Application Control block details by clicking the blue downwards arrow on the left side of the detection to view all the details. You can copy paste the details to a text editor to use them later when creating the exclusion rule. 

Note: If multiple applications are being blocked by the same application control rule, you need to create separate exclusion rules for each application. Do not add for example several condition paths to several applications in one rule.

How to create the Application control exclusion rule: 

1. Log in to the Elements Endpoint Protection portal
2. Go to the Security Configurations > Profiles page
3. Select the profile which is in use on the devices
4. Go to the Application Control settings page
5. Click Add a new top rule
   • Note: The rules in the table are applied in a priority order: rules are checked from top to bottom. So the exclusion needs to be up top.
6. Add the following:
   • Rule name, example: Exclusion for application x
   • Select the Event type to be the same as shown in the detection 
   • Select as Action Allow 
7. Add a condition. You can from the block details you saved to a text editor check what details need to be used. For example: Target path contains C:\Example\Example.exe
   • Note: If you add multiple conditions, the conditions are based on the AND principle. All conditions must apply for the rule to take effect. When adding multiple conditions, add each condition one by one an test between each added condition.
8. Click Save and publish

Issue:

How to releasing quarantined items on Elements Collaboration Protection

Resolution:

To release quarantined items:

1. Select Quarantine on the sidebar.
2. On the Quarantine page, select the items that you want to release from the quarantine.
     Note: You can release up to 200 items at a time.
3. At the bottom of the page, select Release. The selected items are gradually released from the quarantine.

Documentation here Releasing quarantined items | Elements Collaboration Protection | Latest | WithSecure User Guides

Issue:

Importing or exporting JSON file for Elements Endpoint Protection (EPP for Computers or for Servers) Browsing Protection configuration

Resolution:

You can follow the steps below to import or export JSON file in the Elements Endpoint Protection portal for Browsing Protection configuration:

1. Login to Elements Endpoint Protection Portal
2. Go to Profiles
3. Select the used profile 
4. Open Browsing Protection
5. Scroll down to Web Sites Exceptions (Ensure it is enabled)
6. The following steps are applicable for both Allowed sites and Denied sites
7. Select