Issue:

Can we integrate Microsoft Sentinel (SIEM) with Elements Collaboration Protection?

Resolution:

WithSecure provides a “serverless” integration that Sentinel users can use to get Elements event data into Sentinel.

You can find further information about this at our dedicated Community article

Those not using serverless integration, please read the following Community article.

Issue:

Can I install and update Elements Agent (EPP for Computers and EPP for Servers) in an offline or isolated environment with no internet access?

Resolution:

Elements Agent does not support offline or isolated environments, and therefore cannot be installed or updated without an internet connection. Internet connectivity is required for Elements products. 

The Business Suite products Client Security and Server Security can be installed and updated in environments with no or limited internet access. You can read more from this Help Guide.
 

Issue:

An application's network connectivity is blocked once Connection Control session has been activated when user visits a banking website. How to create a Connection Control exclusion for Elements EPP for Computers or EPP for Servers devices, so that the network connection is not blocked when Connection Control is active? 

Resolution:

When Connection Control is active, the processes other than banking browser and its children are seriously limited in connectivity. 

• Signed non-banking processes can only connect to safe IPs. The unrated IPs will be blocked.
• Unsigned processes are disconnected on IP level

If an application is being blocked by Connection Control, to resolve the issue, you need to ensure that the blocked application's binaries are digitally signed. 

If you do not know which file exactly is getting blocked by Elements Endpoint Protection Connection Control, you can view the detection from Security Events page in the Elements Security Center:

1. Navigate to Events > Security events page
2. Click on the filter icon on the right side of the page title
3. Select as Filter: Source, and as Value: Connection control 

From the results you can now easily view all Connection control events. Click on the arrow on the left side of the detection to view more details. 

As a workaround, you can exclude the software executable or the software installation folder from all security features, so that it will not be blocked by Connection Control when it is active.

You can do this in the Elements Security Center:

1. Navigate to Security Configurations > Profiles page
2. Select the profile that is in use on your devices 
3. Go to the Scanning settings page
4. Scroll down to the Global exclusions from all security scans and click Add exclusion
5. Enter the either the full path of the application or the folder path to the application, for example:
   • Application path: C:\Program Files (x86)\Example\ExampleApplication.exe
   • Folder path: C:\Program Files (x86)\Example\
6. Click Save profile

Once the profile has been saved and published, it will be taken into use by the devices in 5-15 seconds. 

In case excluding the application's executable or folder from all security features is not acceptable workaround, you need to whitelist the IP address, using the following setting through the Profile Editor: Browsing Protection > Web Site exceptions > Allowed sites

Issue:

• After installation, Elements Agent (EPP for Computers and EPP for Servers) is in Protection malfunction state
• Status shows Computer is not protected
• Check for updates page shows the product to be unable to download malware definition updates from the update server
• Elements Agent does not communicate to Withsecure cloud environment. Withsecure Connectivity tool shows everything as "Green" and working.

Resolution:

First check the Updates page in the Elements Agent settings and check if it is the Ultralight Core (64-bit) installation which fails. If it is failing, make sure that you have the required Windows updates for Azure Code Signing (ACS) support: Changes in support on Microsoft Windows – Minimum patch level. – WithSecure Community

If you are pushing offline MSI through GPO every day, this can be a reason for failure, and uninstallation of Ultralight engine, leading to malfunction state.

If the product is unable to contact the update server, it will not be able to download any virus definition updates and will begin to show the protection malfunction error and ask the user to restart the computer. 

You can check the connectivity to the update server by clicking the view log file link in the product settings window > Updates.

If the connection to the update server fails, you need to ensure that your firewall or proxy is not blocking the connectivity. You can run the Connectivity Tool to check for connectivity issues: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

Just in case the product can reach the update server and download most of the updates but does not download only certain update(s) (for example, Capricorn update, etc.), we propose to remove the product using the uninstallation tool, and then re-install:

You can download the uninstallation tool here: https://download.sp.withsecure.com/uninstallationtool/WsUninstallationTool.exe

Issue:

Resolution:

This is an issue with an application Control (AC) rule (not DeepGuard nor DataGuard) "Block rare and unknown files in Temp folder". It belongs to a set of pre-defined AC rules that come with the product and this rule appears to be disabled by default. 

There is two below solutions to solve this at the moment:
1. Workaround the issue turn the rule "Block rare and unknown files in Temp folder" from Block to Allow and monitor it as follows:
Profile > (select profile to edit) > Application Control > Rule name: "Block rare and unknown files in Temp folder" = Allow and monitor.
2. Other way to workaround this would be to add Application control exclusion rule: Profile > (select profile to edit) > Application Control > Rule name: "Allow trusted signature" (please have a look at screenshot 'Allow trusted signature rule.png' for more information).

Issue:

Can I configure the Elements Endpoint Protection (EPP for Computers or EPP for Servers) profile to force the Windows Firewall to turn ON if the end-user has turned it OFF?

Resolution:

The ON/OFF state of the Windows Firewall can be fully controlled from the Elements Endpoint Protection profile settings in Elements Endpoint Protection portal..

To modify the state of the firewall, you can do the following:

1. Log in to the Elements Security Center
2. Click on See more details under Endpoint Protection
3. Go to the Profiles page
4. Click on the profile you want to edit (observe that profiles with the READ ONLY flag cannot be edited)
5. Select the Firewall page from the options on the left
6. Under General settings, set the Use Windows Firewall-setting to the desired mode (to prevent anyone from being able to modify the setting locally, click the lock icon on the extreme right side of the setting, so that the lock is closed)

The Windows Firewall will always follow the setting in Elements Endpoint Protection. Users with sufficient rights can turn the firewall on or off directly through the firewall settings in Windows, but it will be forced back again in a few seconds.

Leaving the setting unlocked in the settings profile will allow for local settings to override the value stated in the profile, see the following examples:

Profile setting: Firewall ON, setting unlocked
Setting in Computer Protection UI: OFF
Result: the Windows Firewall will be forced OFF

Profile setting: Firewall ON, setting unlocked
Setting in Computer Protection UI: ON
Result: the Windows Firewall will be forced ON

Profile setting: Firewall ON, setting locked
Setting in Computer Protection UI: Will be forced ON
Result: the Windows Firewall will be forced ON

Note: Windows Firewall settings and rules created via Group Policy Objects (GPO) can not be overridden by Elements Endpoint Protection profiles.

Issue:

Block the storage of mobile devices with a general ID that allows blocking for all from the same profile. We already had this option active, but it seems that in new versions of Android it is no longer working.

Resolution:

As for blocking of Android devices, the reason why the Samsung mobile phone for example is still able to access it's storage it is because Windows detects it under Portable Devices in Device Manager.
Unfortunately there is no one generic hardware ID that you can add for blocking all Android devices but below are the list of device ID for some brands.

For any other brand that I do not list above, here is how you can find out what is the Hardware ID to use.

1. Connect the Android phone to the computer with the USB data cable
2. Open Device Manager and look for the device under Portable Devices.
3. Double click on the device and go to the Details tab
4. On the Property drop down, choose Hardware Ids
5. Look for USB\VID_XXXX. it is usually longer as it will contain ID specific to that device. Then the hardware ID to block will be USB\VID_XXXX*
   • example for an LG phone: USB\VID_1004&PID_62CE&MI_00. The IDs after & are specific to the device hence when you want to block an LG phone, you put USB\VID_1004* as the Hardware ID.

For Apple device the hardware id to block is USB\VID_05AC*  

For example, iPhone 13, "USB\VID_05AC&PID_12A8" 

https://devicehunt.com/view/type/usb/vendor/05AC

Issue:

• I have added a site into the denied list for the Browsing Protection feature via the Elements Endpoint Protection portal Profile Editor. However, the site is not blocked with Browsing Protection enabled in the on the device using EPP for Computers or for Servers. Same goes to the allowed site. Why is this happening?
• Google's search results show the deny rating icon, but when user clicks the link it proceeds to the page.

Resolution:

Check from the Endpoint Protection profile you are using that the web site exceptions setting is enabled. If it is disabled the allowed sites and denied sites rules are not in use. 

Follow these steps to enable Web site exceptions:

1. Log in to the Elements portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile you want to edit
5. Go to the Browsing Protection tab
6. Scroll down until you see the Web site exceptions section and enable it
7. Click Save profile

Now the Web site exceptions in the allowed sites and denied sites lists are enabled.

If this does not fix the issue and you are certain that the correct exclusions have been created and the correct profile is in use on the device, try to reset the reputation cache from the local Elements Agent settings:

1. Right-click the Elements Agent icon
2. Click Open Settings 
3. Go to the Support tab
4. Click Reset reputation cache 

Note that resetting the reputation cache requires local administrator rights for the device. 

Issue:

Elements EPP for Servers or Linux Protection clients are showing a status of "Malware protection" as "No paths are protected" or "disabled" in the Elements Security Center portal's Environment > Devices page. 

Resolution:

Normally, this is "No paths are protected" Malware protection status is caused by the default policy with an empty configuration of "Files and folders to scan" being assigned to the WithSecure™ EPP Elements for Servers (Linux client) or Linux Protection clients.

In order to make the real-time scan work, there is a need to clone the default profile and add a path (for example, root directory of "/" for scanning all files) to that configuration in the profile.

You can perform the following steps to clone the default profile if it has not been done yet, change the configuration for real-time scanning, assign the cloned profile and trigger the full status update to solve this issue.

1. Log in to the Elements Security Center Portal 
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Click the three dots which are next to the profile you want to clone (WithSecure™ for Linux in this case)
5. Select Clone Profile
6. Enter a profile name (Label and description are optional)
7. Select Real-time scanning in the profile
8. Click on Add path under Files and folders to scan
9. Add root directory of "/" to scan all files 
10. Click Save profile

Once the profile has been created you can assign it to the Linux devices:

1. Go to the Devices tab
2. Select the affected Linux device
3. Click on Assign > Assign Profile
4. Select the cloned profile from the list
5. Click on Assign button

Now you can send a full status update:

1. On Devices tab, select the affected Linux device again
2. Choose Send full status update

If the default profile has been cloned before but the configurations for real time scanning are not changed yet, follow the steps below to solve the issue.

1. Log in to the Elements Security Center Portal 
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Open the assigned profile
5. Select Real-time scanning in the profile
6. Click on Add path under Files and folders to scan
7. Add root directory of "/" to scan all files 
8. Click Save and Publish
9. Go to the Devices tab
10. Select the affected Linux device
11. Choose Send full status update

Note: If setting this configuration does not fix the issue, try reinstalling Elements Linux Protection on the device. 

Issue:

Elements Connector unable to forward logs with error "Message too long".

Resolution:

This typically occurs when trying to send a UDP packet that exceeds the maximum allowed size.

UDP has a maximum payload size of 65,507 bytes (65,535 bytes total – 8 bytes for UDP header – 20 bytes for IP header). However, likely the SIEM system has some smaller limit. It’s recommended instead to use TCP protocol for the event forwarding. It’s overall more reliable. This can be configured in the Elements Connector’s profile.