Issue:

Elements Endpoint Protection portal's Security Events-tab shows a new event found during Manual / Scheduled scanning flagged for "Action required", but the threat description shows that no action was taken. 

Resolution:

If the detection shows that a harmful / malicious file has been located inside an archive file (for example a ZIP,RAR,7z,tar.gz, Chrome browser cache etc.), then it means you will have to remove the infected item from the archive manually, or delete the whole archive completely. 

Elements Endpoint Protection products cannot open an archive, remove an infected file and then re-archive the files, thus manual action is needed by the administrator. Note that a malicious file is harmless until you extract it from the archive. 

Try the following instructions to manually remove the detected item(s):

• Make sure you have the administrator right or permission to delete the file
• Some files may be hidden, so set your folder option to show hidden files, folders and drives

1. Open File Explorer
2. Copy the filepath (without the item filenames) where the detected item is located
3. Paste the copied path into the Address Bar in File Explorer
4. Delete the detected file / the whole archive manually

Note: If the file path indicates that the file is placed inside an email folder (Outlook, Thunderbird etc.) file, then you can delete all your emails with attachments and empty the trash, deleted and spam emails folders. It is possible to locate the file, but that process is complicated. The file is not dangerous, because the Elements Endpoint Protection program has identified the file, and will not allow the file to run on the computer. 

Issue:

When the DataGuard features Access control and Discover trusted applications automatically are enabled for Elements EPP for Computers/Servers, DataGuard blocks Windows processes and applications installed in the Windows Users, AppData or System32 folder.

The Security Events tab in the Elements Security Center shows an alert with the Source as DataGuard and the Description "DataGuard has blocked an attempt to access"

Elements Agent Event History on the device shows "Application was blocked from accessing your files" and the Reason as Ransomware:AccessControl.
 

Resolution:

If the blocked application (OneDrive.exe, Firefox.exe, Chrome.exe, WhatsApp.exe etc.) is in the Windows Users or AppData directory, it is not by default a trusted application location and therefore it will be blocked if it tries to modify a file that is located in a protected path. You can view the currently trusted application paths in the Elements Security Center:

1. Select Environment from the left side bar
2. Go to the Devices page
3. Click the device that has DataGuard enabled
4. Under the Protection status tab, click on the DataGuard (Premium) section

This will show you the currently protected paths and the currently trusted application paths.

To prevent DataGuard from blocking an application, you can either:

• Install the application to a trusted path, such as C:\Program Files (x86)\
• Add the application path to the Manually added trusted applications and folders list

How to add the application path to the Manually added trusted applications and folders list in the Elements Security Center:

1. Select Security Configurations from the left side bar
2. Go to the Profiles page
3. Select the profile the device is using
4. Go to the DataGuard settings page
5. In the Access Control section, click Add path below Manually added trusted applications and folders
6. Add the full path of the application, example C:\Users\Username\Documents\exampleprogram\example.exe
7. Click Save and publish the profile

Note:  You can use system environment variables when you want to create an exclusion for many users. The supported environment variables are: %USERPROFILE%, %HOMEDRIVE%, %HOMEPATH%, %APPDATA%, %ProgramFIles%, %ProgramFiles(x86)% %ProgramData%, %windir%, %SystemRoot%, %SystemDrive%

Example: %USERPROFILE%\AppData\Local\Mozilla Firefox\firefox.exe

If you need to find out more about the detection (detection path, target path etc.), you can view it from the Security events page in the Elements Security Center:

1. Select Events from the left side bar
2. Go to the Security Events page
3. Click on the arrow on the left side of the DataGuard detection

From the Security Events page you can also add the application to the Manually added trusted applications and folders list:

1. Click on the Three dots on the right side of the DataGuard detection
2. Select Add the application to the Dataguard's trusted list
3. Click Save and publish

Issue:

The device status in the Elements Endpoint Protection Portal shows that the Malware protection status as Malfunction on the Mac device and Overall protection is shown with Malware issue status. How to get this fixed?

Resolution:

If the MacOS device's malware protection status is shown to be in malfunction status, the most likely reason is that Elements Agent has not been granted Full Disk Access and the WithSecure System extension hasn't been enabled. You can from the Elements portal check the status of both of these by opening the device details and then from the Protection status tab you expand the Security parameters drop-down list. From there you can make sure that both Full Disk Access and System extension are shown as Enabled. The software needs both of these to function as intended.

Normally after product installation there would appear a notification pop-up on the right side of the screen which would forward the user to the correct MacOS settings page where the user can allow Full Disk Access and the WithSecure System Extension for the Elements Agent. If the user did not click on the notification pop-up after product installation, they need to manually allow these from the MacOS settings.

You need to do the following:

1. Go to System Preferences (Apple logo menu from top left corner)
2. Click Security and Privacy
3. Click Privacy
4. Select Full Disk Access on the left pane
5. Click the lock in the bottom-left corner to make changes, and login with your Mac password (if prompted)
6. Tick the box next to WithSecure Elements Agent and WithSecure System Extension on the list
7. Click the lock again to prevent further changes

If for some reason the Full disk access list would be empty, try restarting the computer and try again. If all else fails, uninstall and reinstall Elements Agent and allow the Full Disk Access and the WithSecure System Extension immediately after installation.  

Full disk access and WithSecure System Extension installation can also be automated using MDM: https://community.withsecure.com/en/kb/articles/31284-pre-announcement-new-withsecure-client-for-macos

If issue is not caused by the extensions, it is also recommended to check your firewall and proxy (if applicable) settings to make sure that the software can download all the required updates and connect to the Elements portal:

Port 443 (HTTPS)
Port 80 (HTTP)

*.f-secure.com
*.fsapi.com
*.digicert

ocsp.rootca1.amazontrust.com
crl.sca1b.amazontrust.com
ocsp.rootg2.amazontrust.com
ocsp.sca1b.amazontrust.com
crl3.digicert.com
crl4.digicert.com
ocsp.digicert.com

Issue:

When looking at the Malware protection column on the Elements Endpoint Protection portal's Devices page, the status for one or more devices is shown as Broken ACS. Overall protection shows "Malware issue" status when the device's details are viewed.   

Locally in the Elements Agent user interface, status is shown as "Your computer is at risk due to missing Windows patch".
 

Resolution:

Broken ACS refers to missing Azure Code Signing support on the device. The device's Windows installation must support Azure Code Signing for the product to function. You will need to install the required Windows update, which brings Azure Code Signing support: https://support.microsoft.com/en-gb/topic/kb5022661-windows-support-for-the-azure-code-signing-program-4b505a31-fa1e-4ea6-85dd-6630229e8ef4

After installing the required Windows update, restart the device and then the Elements Agent will be able able to install updates. 

You can read more about the ACS support requirement from this WithSecure Community article: https://community.withsecure.com/en/kb/articles/29714-changes-in-support-on-microsoft-windows-minimum-patch-level

Issue:

Elements Endpoint Protection infections email alerts are delayed or do not arrive to the recipients. The email alerts recipients are configured correctly from the Alerting configuration page in the Elements Endpoint Protection Portal. 
 

Resolution:

If you are using HTTP proxy in your environment, you need to configure your HTTP proxy from the Elements Endpoint Protection Portal for email alerting to work. How to configure EPP for Computers or EPP for Servers:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Profiles page and select the modify that is used the your devices
3. Go to the General settings page and scroll down to the Automatic Updates section
4. Enter the proxy address to the Manually defined proxy address field, for example: http://10.100.4.1:8080
5. For the option Use HTTP proxy, select Remotely managed from the drop-down list
6. Click Save and publish

Once the proxy address has been configured to the device profile and the profile has been taken into use by the devices, wait for a few hours and check with an eicar file if an email alert is now sent to the recipients. 

Email alerting configuration instructions can be found in this Help Guide.
 

Issue:

Endpoint Detection and Response (RDR) sensor in Business Suite Client Security or Server Security is unable to connect to the backend. 

User interface shows "Sensor is not activated" status and the device is not visible in the EDR Portal.

Resolution:

WithSecure recommends to add the following scope to whitelisted domains:

• *.f-secure.com
• *.fsapi.com
• *.digicert.com

For a broader exclusion you would need to whitelist full addresses for the RDR endpoints as follows:

The Security Cloud client needs to be enabled on the Policy Manager console to allow EDR sensors to submit data to F-Secure Cloud.
Steps to enable the Security Cloud client:

Issue:

Elements Mobile Protection received suddenly the following push notification on Android devices:

• "Test push msg android" "Hello Android MP in P3" 

This notification wasn't sent by any admin user from the portal and it isn't visible in the Notifications page in the application. 

What is this about? 

Resolution:

On 24th of September 2024, this push notification was sent by mistake by WithSecure to Android devices. We have identified the source internally and we are reviewing our processes to ensure such mistakes don't happen again. We apologize for the inconvenience. 

Issue:

Mobile Protection Network Protection (VPN) functionality shown as OFF in the user interface and is no longer be available to be enabled or turned on. 

Resolution:

It is by design that the Network Protection feature is greyed out and cannot be enabled in the Elements Mobile Protection user interface. VPN functionality was removed from version 24.1 for iOS and Android, since it will be replaced with the Network Gateway feature. 

Note: On Apple iOS devices, the VPN icon will still be visible in iOS user interface even if the Network Protection feature is disabled

Network Gateway component on the device will replace the current VPN functionality, with the introduction of Network Gateway will acts as a “device VPN”, intercepting all mobile application traffic and is used to validate any URLs visited with our reputation service, just the same as used in other WithSecure products.

This involves checking the domain names against a list of known URLs If the Network Gateway detects a malicious or phishing request, it will block it and notify the mobile phone app.

If the URL is categorized as Adult, Gambling, or one of many other categories, this information is returned to the Mobile Protection application, and can be used to block traffic based on profile settings set by the Security Administrator.

To check the full details of Network Gateway component and new version of Mobile Protection check our community release article: 

New Elements Mobile Protection Release – WithSecure Community

On 1st of April 2024 VPN will stop working on the devices, check that device is running the latest version of Mobile Protection.

For iOS devices Network Protection will be working as soon as Mobile Protection is up to date, currently under Apple review. 

And as of 2024-04-08, we have now released a version of Elements Mobile Security for Android, which enables the Network Gateway functionality. 
 

Issue:

The number of drives protected from the Elements Collaboration Protection (ECP) portal is different from the number of drives that can be confirmed from the usage status of the Microsoft Management Center. How to check if all OneDrive are actually protected?

Resolution:

Usually, all active drives that exist on the organization should be shown on ECP portal. In some cases, when new drive is created and the user has not yet access the drive, there is a possibility that the drive is not fully setup, therefore will not be shown in ECP portal.

Issue:

How to manually relase a quarantined file after failed to release using the [Release] button? 
 

Resolution:

In case that qurantined file was not being released even after performing release using the [Release] button, 
the user can manually release a quarantined file following these steps: 

1. Log to your Micrososft account as an administrator

2. Find the Sharepoint site URL of the original file location.
e.g.
https://example.sharepoint.com/sites/

3. Add Microsoft Azure Active Directory tenant ID to the URL as following: FS_QUARANTINE_
If tenant ID is 00111222-3333-4444-5555-666677778888 the string will be
FS_QUARANTINE_00111222333344445555666677778888

therefore the full URL should be
e.g.
https://example.sharepoint.com/sites/FS_QUARANTINE_00111222333344445555666677778888

4. All the quarantined files should be there assuming you logged with Admin user. 
The file name will be the Quarantine ID. Take the needed file and copy it anywhere you wish.
USE THIS AT YOUR OWN RISK