Issue:

As a customer, we do not want the solution provider partner or service provider partner to be able to manage our Elements Exposure Management related devices and services. How can we restrict partner access to our Elements Exposure Management organization? How to isolate our organization from the partner? 

Resolution:

A customer company can restrict partner access to their Elements Exposure Management and Elements Collaboration Protection related affairs by following these steps:

1. Log in to the Elements Security Center portal
2. Navigate to the Management > Organization Settings > General page
3. Click on Access policies in the Organization information section
4. Enable Restrict Partner access 
5. Click Save

When Restrict Partner Access is enabled, the partner cannot access any pages in your organization that are related to Elements Exposure Management or Elements Collaboration Protection. 

Note that his feature is only available for Elements Exposure Management and Elements Collaboration Protection. If you have a partner managed subscription for Elements Endpoint Protection or Elements Endpoint Detection and Response, the partner will still be able to access those products in your organization. 

Issue:

We would like to add more licenses to our Elements Collaboration Protection subscription by adding a second subscription key to our existing cloud service. How to add an additional subscription key to a Elements Collaboration Protection cloud service? When configuring a cloud service, the Subscription Key drop-down menu only allows to select one subscription key for the cloud service tenant.

Resolution:

In Elements Collaboration Protection, one cloud service can only be assigned one subscription key. You cannot combine two subscription key's licenses to one single cloud service. If you have received two or more Elements Collaboration Protection subscription keys from your WithSecure reseller partner, we recommend to contact your WithSecure reseller partner so that they can cancel the second subscription key and increase the amount of licenses on the first subscription key. 

Issue:

When looking a security event on the Elements Security Center portal's Events > Security Events page, the Website URL address is not visible when the alert source is either:

• Browsing Protection
• Web Content Control 
• Connection Control 

Why is the website URL address not listed or shown in the security event? How can I find out what address was blocked?  

Resolution:

By default the website URL address is only shown in the security event if the website URL address has been blocked due to it being rated either harmful (malicious), suspicious or prohibited. This is due to regional privacy laws. 

This means that since if a website is blocked due to any of the following reasons, the website's URL address is not included in the security event alert:

• When the website has been blocked due to it being on the manually added Denied sites list
• When the website has been blocked due to the site being included in a blocked Web Content Control category 
• When a website has been blocked due to Connection Control being active when a user has entered a banking site and the site they are trying to access is not rated as safe for banking

Note that in each of these scenarios, the blocked website URLs are not inherently malicious or harmful. 

If you wish to show the website URL address in all security events, you can change the following setting in the Elements profile that is in use on the devices:

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > Profiles page
3. Open the profile that is in use on the devices
4. Navigate to the Browsing protection settings page
5. In the Common settings section, enable Include the blocked URLs in all security Events 
6. Click Save profile

Note that you need to make sure to check and follow regional laws before turning on this feature or that you have asked the permission from the users. 

Issue:

Elements Agent installation with ElementsAgentOfflineInstaller.msi using GPO fails with error "Conflicting Oneclient Product already installed"

Resolution:

Make sure a previous installation of WithSecure Elements Agent or other WithSecure product is not already installed when you run the installer.

The ElementsAgentOfflineInstaller.MSI installer does not include sidegrade, so it does not have any way of uninstalling any conflicting products. If there are conflicting products already installed on the devices, they need to be uninstalled first. 

Issue:

When Elements Endpoint Detection and Response (EDR) detected a high or severe level risk on a device, the automatic network isolation feature triggered a host isolation but it didn't isolate the computer. The network isolation state remains pending on the portal. 

What can cause the automated isolation action to fail? 

Resolution:

Ensure your Windows Defender firewall is controlled by WithSecure and that you do not have firewall rules or configurations via GPO. Rules and configurations created via GPO override any firewall rules created by the WithSecure firewall profile, even isolation rules. 

Issue:

How can I create an XFENCE exclusion for Elements Endpoint Protection for Mac? 

I want to create an exception for a specific application in the XFENCE feature so that users will not get the notifications.

Resolution:

You can create exclusion rules to the Elements Agent for Mac profile in the Elements Security Center portal:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles > For Mac page
3. Click on the profile that is in use on the devices
4. Go to the Scanning settings page
5. In the Exclusions > Exclusion folders and files from all security scans section, click Add path
6. Enter the path
7. Click Save profile

From the local graphical user interface (GUI) you can create an exclusion by following these steps:

1. Click on the product icon in the menu bar area
2. Click on the hamburger menu (three lines)
3. Select Settings from the drop down menu
4. Navigate to "XFENCE" tab in the product preferences
5. Unlock it by clicking on the lock icon in the lower left
6. Click "Advanced…". This will open xfence rule editor
7. Select "New Policy Rule"
8. Fill in path to the application, the path ("Any path" can be selected) and hit "Save". This will create a new allow rule for the selected activity
9. Close rule editor to apply changes

Issue:

What are the recommended settings or best practices for Elements Endpoint Protection profile settings? 

Resolution:

We consider the default Elements profiles to be the recommended or best practice settings for Elements Endpoint Protection for Computers. 

As a basic rule of thumb; WithSecure default settings are mainly the best practice settings for the product, and further configuration needs to be done on case by case basis depending on your needs.

To avoid performance issues:

• Keep Security Cloud enabled
• Avoid Application Control rules that have SHA-1 as a condition. If SHA-1 is used, combine it with another condition. 

Issue:

When admin checks in the Elements Security Center on the Reports > My Report tab the Security Events template, there is no data available for 'Infection handled by real time scanning'. The graph is empty. 

Resolution:

Infection handled by real time scanning graph is creating with the information from the last 30 days. If there is no data or it is empty, then it means that in the last month no infection were detected by real-time scanning, so none were handled.

Issue:

Can the Elements Endpoint Proteciton Firewall Isolation profile be activated if there is a GPO rule to ignore locally defined rules?  What will happen if a firewall rule distributed by GPO to 'Ignore locally defined rules' and Elements Endpoint Protection tries to isolate the device from the network? 

Resolution:

Firewall rules configured via Elements Security Center Portal are considered local, hence if there is a GPO rule to ignore local rules it WithSecure rules or profiles will no longer work. 

Our general recommendation is to choose one – either manage Windows Firewall with GPO, or with WithSecure profiles (or with the smallest possible input from GPO), otherwise in case of any conflicting settings GPO will have a higher priority and override WithSecure firewall rules. Also, if there are conflicts, it might impact the host performance negatively

Issue:

Does Elements Endpoint Protection Browsing Protection feature protect against malicious or harmful Google Chrome, Microsoft Edge or Mozilla Firefox browser extensions / add-ons? Can it block the user from installing harmful or suspicious extensions?  

Resolution:

Elements Endpoint Protection's Browsing Protection feature is not able to interact with other browser extensions, so it cannot block them from being installed or activated in a browser. Elements Endpoint Protection does not have this particular feature to protect against malicious browser extension exactly by default. 

If a browser extension's files are rated as malicious, Potentially Unwanted Application or Spyware, then real-time scanning can block or quarantine the extension's files. 

For managing browser extensions in your organization, we recommend to use the built-in enterprise tools in the browser.