Issue:

Mobile Protection Network Protection (VPN) functionality shown as OFF in the user interface and is no longer be available to be enabled or turned on. 

Resolution:

It is by design that the Network Protection feature is greyed out and cannot be enabled in the Elements Mobile Protection user interface. VPN functionality was removed from version 24.1 for iOS and Android, since it will be replaced with the Network Gateway feature. 

Note: On Apple iOS devices, the VPN icon will still be visible in iOS user interface even if the Network Protection feature is disabled

Network Gateway component on the device will replace the current VPN functionality, with the introduction of Network Gateway will acts as a “device VPN”, intercepting all mobile application traffic and is used to validate any URLs visited with our reputation service, just the same as used in other WithSecure products.

This involves checking the domain names against a list of known URLs If the Network Gateway detects a malicious or phishing request, it will block it and notify the mobile phone app.

If the URL is categorized as Adult, Gambling, or one of many other categories, this information is returned to the Mobile Protection application, and can be used to block traffic based on profile settings set by the Security Administrator.

To check the full details of Network Gateway component and new version of Mobile Protection check our community release article: 

New Elements Mobile Protection Release – WithSecure Community

On 1st of April 2024 VPN will stop working on the devices, check that device is running the latest version of Mobile Protection.

For iOS devices Network Protection will be working as soon as Mobile Protection is up to date, currently under Apple review. 

And as of 2024-04-08, we have now released a version of Elements Mobile Security for Android, which enables the Network Gateway functionality. 
 

Issue:

Does Elements Endpoint Protection support non-persistent VDI environments? 

Resolution:

We do have the installation steps documented to support persistent deployment on Citrix and WMWare Horizon: 
 
Installation in persistent mode on Virtual Desktop Infrastructure (VDI) systems | Elements Endpoint Protection | Latest | WithSecure User Guides

For non-persistent VDI that does not keep the SMBIOS GUID, subscription need to be freed up every time that a VDI shuts down. Potential workaround is to use the automatic removal feature to delete the inactive devices, to free up the subscription usage. 

Automatically removing computers | Elements Endpoint Protection | Latest | WithSecure User Guides

Issue:

There is a date / time mismatch between the Elements Endpoint Detection and Response (EDR) execution start and the detection. How is that possible?

Resolution:

The host needs to be turned ON and have an active internet connection for the host to upload the detection information to the EDR portal. If the host goes to sleep mode or loses internet connection, it is expected behavior for the execution start and the detection time / date to differ.

Issue:

Breach detected time is recorded differently with actual occurred time in portal.

Resolution:

Breach occurred shows when a breach happened. Breach detected is the date when our solution received an information about the breach. Depending on the case, it can take some time for breach database to realize they were breached, or for malicious actors to try to sell stolen information online etc. so it's not unusual to see these two dates differ by a lot.

Issue:

• We've disabled DataGuard in the Endpoint Protection profile using the Elements Endpoint Protection Portal, but devices using the profile are still getting applications blocked by DataGuard.
• Devices using another profile where DeepGuard is disabled entirely are not experiencing this issue.
• We've tried disabling DataGuard by turning off the DataGuard advanced behavioral blocking-setting from the DataGuard-settings in the Endpoint Protection profile.

Resolution:

For DataGuard to be completely disabled, two different settings need to be turned off in the profile:

1. Log in to the Elements Security Center
2. Go to Profiles
3. Select the profile you want to modify
4. Click on Dataguard
5. Turn on the setting DataGuard advanced behavioral blocking, if it is off
6. Turn off the setting Access control
7. Turn off the setting DataGuard advanced behavioral blocking
8. Save and Publish the profile

NOTE: To ensure policy enforcement, we recommend locking the settings in the profile too:

• End User Rights > DataGuard > DataGuard Advanced Behavioral Blocking
• End User Rights > DataGuard > Access Control

  To verify that both settings are disabled:

1. Open the Elements Agent user interface on the device
2. Go to settings
3. Select the Malware Protection page
4. Scroll down to the DataGuard section
5. Verify that both DataGuard switches are set to Off

Issue:

We are getting lot of Ransomware access control alerts caused by Elements Endpoint Protection feature DataGuard,  which is blocking C:\Windows\System32\svchost.exe
What is the root cause of this?

Resolution:

Ransomware access control is a DataGuard feature, which provides the user the ability to safeguard important data from ransomware. More info are provided in this article and in this Help Guide.

In this particular case, where DataGuard is enabled for specific folders to safeguard against ransomware. As from this, svchost.exe (a legit Windows application) might try to access the file that is available in those folders, which is immediately blocked by DataGuard. By Default svchost.exe is not a trusted application by DataGuard.

You can find more details about this detection from the Elements Endpoint Protection Portal:

1. Log in to the Elements Endpoint Protection Portal 
2. From the menu on the left, click Security Events PILOT
3. Click on the detection and you will see similar details:

This means that svchost.exe has tried to modify examplematerial.xlsx which is saved on the users Desktop protected by DataGuard.

DataGuard works differently from our other engines, as it tries to be as paranoid as possible (even detecting Microsoft Windows files). This is because some malwares will inject into legitimate Microsoft files, which explains why DataGuard is more paranoid compared to other engines. DataGuard only allows trusted applications to modify protected files. By default svchost.exe is not a trusted application. 

So, this leaves you with one choice, which is to either leave it as it is (Which we recommend) or add svchost.exe as a trusted application. If you want to do the latter, then you can follow the steps in the Help Guide.

You can also use Windows process monitor to figure out which svchost process exactly has tried to modify the file.
It can also be some windows or 3rd party feature using this process, and in case you don't need it, you can disable it, but it has nothing to do with our product – we just block write access to these files as we should
 

Issue:

WithSecure Elements Endpoint Detection and Response (EDR) detects a safe application (e.g. an in-house application). How to whitelist the detection?

Resolution:

You can close the Broad Context Detection (BCD) as "Accepted behavior", to create suppression rule that can accept the behavior of a user or a process. To do this, you need to follow these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com
2. Expand the EVENTS category on the left pane
3. Select the Broad Context Detections option
4. Click on the respective Broad Context Detection to open the details page for this detection
5. Click on the drop-down menu in the top left corner
6. Select Closed from the drop-down menu, then select the reason as Accepted behavior
7. Click on the Create rule button and follow the on-screen instructions

After this, you can review the suppression rule by following these steps:

1. Expand the Security Configurations category on the left pane
2. Select the Automated actions option
3. Select Suppression rules

You can find more information regarding this feature in the following community article:

https://community.withsecure.com/en/kb/articles/31324-elements-edr-new-feature-accepted-behavior

If you encounter any issue in creating the suppression rules (such as having more than 5 key detections in the BCD), you can close the BCD as "False positive" by following these steps:

1. Log in to the Elements Security Center at https://elements.withsecure.com.
2. Expand the EVENTS category on left pane
3. Select Broad Context Detections option.
4. Select the BCD ID that require whitelisting.
5. Click "Update status" option at bottom page.
6. Select "Closed" from drop down menu, then select reason as "False positive"
7. Click "Update" option.

Once you have at least 1 incident that is identical to the incident, and there is no identical incident where status is closed as confirmed, the false positive handling in WithSecure Elements Endpoint Detection and Response (EDR) will close the false-positive automatically.

Broad context detections can be closed as Auto false positive automatically when they are identical to previously closed false alarms. For WithSecure Elements Endpoint Detection and Response to close a broad context detection as Auto false positive, the following criteria must be met:

• Incident has to be New / Unconfirmed,
• you must have closed an identical incident in the same organization as False positive, and
• no identical incidents in the same organization have been Confirmed.

More information about automatic handling of incidents can be found here. 

In the event that this has been completed multiple times and the file still gets detected, make a whitelist request for the False Positive event in the Elements Security Center by doing the following:

1. Select Support
2. Select Request for allowlisting
3. Verify that the following fields are populated correctly: 
   • Problem Category -> Threat/Malware
   • Problem Subcategory -> False Positive
   • Product Name -> Elements Endpoint Detection & Response
   • Language -> English
4. Under Describe the problem in detail, provide 3-5 example Broad Context Detection ID (BCD-ID), a reason for why this content should be whitelisted and the scope (single host, company level, etc.)
5. Fill in the rest of the required case information. Correct and complete information helps us to identify you and provide you with the proper service level
6. Click Submit to open the support ticket

Issue:

Quarantined emails goes back to quarantine immediately after released. 

Resolution:

If verified False Positive, do Report the detection as a False Positive. Or create an exclusion as per steps;
 

1. Under Policies go to Real Time Scanning
2. Go to Malware Scanning
3. At the Scan Files option select "All, except excluded"
4. Enter the filename to be excluded

Issue:

Does Elements Collaboration Protection(ECP) use generative AI?

Resolution:

ECP does not use Generative AI.

Issue:

Does Elements Agent have an "Early access to client software" feature to test upcoming features and product versions? 

Resolution:

We recommend assigning a small subset of endpoint devices to participate in the early access program. Selected workstations and servers receive updates approximately one week ahead of the general availability rollout.

You can from the profile set if a device should receive early access to client software.

Windows computers or Windows servers:

1. Log in to the Elements Endpoint Protection portal
2. Go to the Security Configurations page
3. Go to the Profiles page
4. Go to the For Windows Computers or For Windows Servers tab
5. Select a profile to edit
6. Go to the General Settings page
7. Enable the setting Early access to client software
8. Click Save and publish

MacOS:

1. Log in to the Elements Endpoint Protection portal
2. Navigate to the Security Configurations > Profiles page
3. Go to the For Mac tab
4. Select a profile to edit
5. Go to the General settings page
6. Enable Early access 
7. Click Save and publish

Linux: 

1. Log in to the Elements Endpoint Protection portal
2. Navigate to the Security Configurations > Profiles page
3. Open the For Linux tab
4. Select a profile to edit
5. Open the page General
6. Enable the setting Early access to client software
7. Click Save and publish

Now the devices with this profile assigned to it receives early access to client software. You can assign this profile to a small batch of devices to detect if there are any issues with a new release.