Issue:

How to block or allow (exclude) websites with the Elements Endpoint Protection Browsing protection feature,

Can it also be done using the local WithSecure client user interface without having to do so from the Elements Endpoint Protection portal?

Resolution:

Follow the steps below to either block a website or allow it through the Endpoint Protection device profile:

1. Log in to the Elements Security Center Portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile you want to edit 
   • Note that default profiles owned by WithSecure cannot be edited. You need to clone or create your own profile which you can edit and assign to the devices
5. Go to the Browsing protection settings page
6. Scroll down to the Web site exceptions section and enable it
7. Click Add site under either Allowed sites or Denied sites depending on which you want to do
8. Add the website URL address
9. Click Save profile

Follow the steps below to either block a website or allow it through the local WithSecure Elements Agent user interface

Note: Make sure you have administrator privileges to the computer, since modifying settings requires administrator level access.

1. Open the WithSecure Elements Agent and go to Settings
2. Go to the Secure Browsing tab
3. Click View website exceptions (you will be prompted for the admin user name and password) 
4. Select the Allowed or Denied tab 
5. Click Add…
6. Enter the website's URL and click OK

Issue:

How does Elements Collaboration Protection subscription usage work? How does Collaboration Protection allocate licenses when there are more mailboxes than licenses available?

Resolution:

How license allocation works

Initial setup or protection settings change

Protect all mailboxes

When "Protect all mailboxes" is enabled, the system attempts to protect every mailbox in the tenant. If the number of mailboxes exceeds the available licenses — including licenses already consumed by other tenants sharing the same subscription — mailboxes are protected in alphabetical order by email address until no licenses remain. Any mailboxes that do not fit are automatically switched off.

Customize protection for mailboxes

When "Customize protection for mailboxes" is enabled, the customer manually selects which mailboxes to protect from the mailbox list. Licenses are assigned only to the mailboxes explicitly selected. If the number of selected mailboxes exceeds the available licenses, the selection cannot be completed until enough licenses are free. Optionally, the "Automatically protect newly-added mailboxes" toggle can be turned on to automatically protect newly discovered mailboxes without manual selection — see daily operations below.

Daily operations

When new mailboxes are discovered

• Protect all mailboxes: Newly discovered mailboxes are assigned any available licenses in alphabetical order. If the subscription is already at its limit, newly discovered mailboxes are switched off immediately — existing protected mailboxes are never displaced to make room for new ones.

• Customize protection for mailboxes: Newly discovered mailboxes are not protected automatically unless the "Automatically protect newly-added mailboxes" toggle is enabled. If it is enabled, newly discovered mailboxes are assigned available licenses in alphabetical order. If the limit is already reached, new mailboxes are switched off and must be enabled manually once a license becomes free.

When licenses are freed

• Protect all mailboxes: When a license is freed, it is automatically assigned to the first alphabetically available mailbox that was previously switched off due to license limits within the same tenant. Already protected mailboxes remain protected. Note that freed licenses are not redistributed across other tenants sharing the same subscription — only the tenant being scanned benefits from the newly available license.

• Customize protection for mailboxes: When a license is freed, it must be manually assigned to a mailbox. Existing unprotected mailboxes are not treated as newly discovered and will not be automatically protected even if the "Automatically protect newly-added mailboxes" toggle is enabled — that toggle only applies to mailboxes added for the first time.

Viewing license usage

1. Log in to the Elements Collaboration Protection portal

2. Go to the Cloud services page

3. Select the Subscription view tab from the top right corner

4. View the subscription usage column for each subscription key (expand the drop-down to see which Cloud Service tenants are consuming licenses)

Configuring which mailboxes to protect

1. Log in to the Elements Collaboration Protection portal

2. Select Cloud services on the sidebar

3. Select Configure protection in the row of the relevant connection in the Exchange column (or click on the protected/unprotected count)

4. In the page that opens:

   • Select Protect all mailboxes to protect all existing mailboxes in your Microsoft Exchange account.

   • Select Customize protection for mailboxes to manually choose which mailboxes to protect from the mailbox list.

   • Enable the Automatically protect newly-added mailboxes toggle if you want newly discovered mailboxes to be automatically added to protection. If this toggle is off, new mailboxes must be added manually.

5. To protect a specific unprotected mailbox, select it from the mailbox list and choose Turn on protection at the bottom of the page. Its status will change to "Protected".

Issue:

For how long does WithSecure  Elements Endpoint Protection (EPP for Computers and EPP for Servers) store files in quarantine and can this time period be adjusted or changed? 
Is it possible to empty the quarantine of a device remotely from the Elements Endpoint Protection Portal?

Resolution:

The quarantine storage is located locally on each device running the WithSecure  Elements Agent. The size of the quarantine storage space cannot be changed. The Administrator may manage the quarantine centrally via Elements Endpoint Protection Portal, and also configure for how long are items being stored.

By default, items are stored in the quarantine for 365 days. The Administrator may choose to modify this value:

1. Login to Elements Endpoint Protection Portal
2. Go to the Profiles page
3. Select the profile
4. Go to the General settings tab
5. In the Quarantine section, check and modify if necessary the value for Days to keep items in Quarantine

The Administrator may choose to release or remove (delete) files that were quarantined by Elements Endpoint Protection through the portal:

1. Log in to the Elements Endpoint Protection Portal
2. Go to the Devices tab
3. Select the device on which you wish to manage the quarantined files
4. Go to the Infections tab
5. Click on the actions menu icon, consisting of three horizontal dots, next to the file you wish to release from quarantine, or delete
6. Choose either Delete file to remove the file from the device, or Release file to release it from quarantine

Additionally, the administrator can choose what action is taken on infected files. To be able to do this, the admin will need to disable the "Decide action on infection automatically" setting to be able to decide for themselves what action to take on the quarantined files.

To set your own decision, do as follows:

1. Login to Elements Endpoint Protection Portal
2. Go to the Profiles page
3. Select the profile
4. Go to the Real-time scanning settings
5. Expand file scanning and disable Decide action on infection automatically

Now you can customize the option "Action on infection" to whatever action you require.

Example: If you wish to automatically delete infections, chose "Delete". This means when the infections are detected, they will be deleted automatically. If you set to quarantine, the infections are only quarantined, not deleted. 

Note: Since the quarantine is only local, if the end user chooses to release an item from the quarantine via WithSecure  Elements Agent user interface (GUI), trying to release the item afterwards via portal will cause no action to be handled, as the item will no longer be available in the quarantine.

Issue:

How to automatically remove Elements EPP for Computers or EPP for Servers devices from the Elements Endpoint Protection portal with the Manage automatic deletion feature? 

Resolution:

You can choose to automatically delete the devices which have been offline long enough. Once a device has been deleted and removed from the Devices list, the license will be available to be used on other devices. You can define the time period, how long the device is offline before deleted. Deleted devices will return to the management portal if they ever become active again, as long as there are free seats in the subscription. If the subscription is full the device will not reappear in the management portal and the computer will not be protected.

The automatic deletion feature is disabled by default.

How to setup the automatic deletion for Elements Endpoint Protection devices:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Select Environment
3. Go to the Devices page
4. Click on the three dots on the right side of the devices title
5. Select Manage automatic deletion
6. Enable or disable the feature
7. If enabled, set the amount of days
8. Click Save

Note: The automatic deletion only supports devices which have Elements Agent installed on them. Elements Mobile Protection and Elements Connector devices will not be automatically removed from the portal even if they reach the set number of days of being offline. 

Issue:

 Unable to login to the Elements Security Center portal. Error message: "Missing Authentication Token"

Resolution:

This notification can appear if you use any of the old URL addresses to try to access the portal. Try to login using the following updated URL : https://elements.withsecure.com/

Issue:

SharePoint Protection not all sites are listed on the portal. 

Resolution:

Typically, the Updates to the list of SharePoint sites might take around 6h to be reflected in portal.

Issue:

What rule do I need to configure to scan my computer on startup or reboot ?

Resolution:

On Elements Security Center profile, navigate to Automated Tasks :

1. Navigate to Security Configurations > Profiles on the sidebar
2. Select the desired profile
3. Go to Automated tasks
4. Make sure to enable automated tasks
5. Click Add task
6. In the Type column, select either:

1. "Quick Scan for Malware" which will scan the all folders except for compressed files
2. or "Scan for Malware in Folder" which you will have to specify a folder such as C:\
3. Set "Schedule" to "Reboot"

Issue:

After upgrading Elements Endpoint Protection Agent client to version 22.7, a user or monitoring software is unable to find F-Secure Hoster and F-Secure Hoster (restricted) service on the device. On device(s) with Elements Agent version 22.6 or earlier installed, these services are still there. Hence, monitoring tool shows that the product seems to have stopped working.

F-Secure Ultralight hosters, such as F-Secure Ultralight Hoster, F-Secure Ultralight Network Hoster, F-Secure Ultralight Protected Hoster can still be found on the device with Elements EPP client 22.7 in place.

What has happened to the service names?

Resolution:

The display name for these two services has been changed into "WithSecure Hoster" and "WithSecure Hoster (Restricted)".

In case you are using the display name to do the monitoring, you need to tweak the monitoring logic.

The display name for the rest of the product's services are subject to change in the near future too. We recommend to consider using the short name for the product service. For example, fshoster, fsnethoster, fsulhoster, etc, when monitoring the product's services. 

Issue:

Error "Cannot load the page" during logon to the WithSecure Elements Security Center portal at https://elements.withsecure.com

Resolution:

If you are getting this error page, perform the browser reload using the "Ctrl + F5" keys. Ctrl + F5 is a keyboard shortcut to reloads the web page including the browser cache. It retrieves the fresh web content. This will help to refresh the Elements Security Center portal page.

Check if any of steps below help:    

• Switch to different web browser
• Clear the web browser cache 
• Start the Chrome/Edge browser in Incognito/InPrivate mode without any extensions enabled

If the above-mentioned does not help, you can try logging in to the portal on a different device, connecting through a different network, and see how it goes. Sometimes, the connectivity is blocked by the proxy/firewall in the network.

In case issue remains, then the issue could be a temporary problem on the portal side. Please wait for 1 hour and try again. If issue remains after 1 hour you can open a support request. 

Issue:

When a user goes to a HTTPS website with their web browser, they get an ERR_SSL_PROTOCOL_ERROR and a message that says the site is not secure.
 

Resolution:

The ERR_SSL_PROTOCOL_ERROR occurs because the WithSecure Elements Browsing Protection or Connection Control feature has blocked access to the site, but you do not have the Browsing Protection by WithSecure browser extension installed or activated in your browser, so it can only give that error.

You need to make sure that the Browsing Protection by WithSecure browser extension is installed and enabled on all the browsers you are using (Google Chrome, Microsoft Edge, Mozilla Firefox).

To install the Browsing Protection by WithSecure browser extension / add-on, you will need to follow these steps:

1. Close all browsers open on your computer (e.g., Edge, Chrome, Firefox).
   • All browsers need to be closed because when the site/tab that activated the banking protection is closed, the banking protection will turn off automatically.
2. Right-click the Elements Agent icon in the bottom right corner of the screen and select Open Settings.
3. Go to the Secure Browsing tab and scroll to the bottom of the page.
4. Click on one of the following links:
   • Open Chrome Web Store
   • Open Edge Add-ons
   • Open Firefox Add-ons
5. Click to install the extension / add-on to your browser
6. Once the browser extension / add-on has been installed, make sure that it is enabled 

Now you can restart the browser and make sure that the extension works. You can make sure that the extension works by going with the browser to the following test domain: https://unsafe.fstestdomain[.]com (remove the brackets to make the link work). You should now receive a block page informing that the site has been blocked by WithSecure Browsing Protection.