Issue:

Do Elements Endpoint Detection and Response (EDR) and Elements Endpoint Protection (EPP) connect to the Amazon Web Services addresses (*.amazonaws.com)?

I notice that the connectivity to some *.amazonaws.com addresses on port 443 and 8883 are listed, when running the WithSecure Connectivity Tool.
 

Resolution:

Elements Endpoint Detection and Response feature (EDR) called "Advanced response actions" requires outbound access to specific AWS endpoints for your region.

You can see the required Amazon Web Services domains for each region in the EDR user guide: Turn on advanced response actions | Elements Endpoint Detection and Response | Latest | WithSecure User Guides 

Issue:

How to customize message that Elements Endpoint Protection Browsing Protection feature shows in the user's browser when a harmful or malicious website has been blocked?  

Resolution:

The message itself on the Browsing Protection by WithSecure extension's block page cannot be modified, but the "Report a false positive here" link can be changed to forward the user to a different website or service:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Browsing Protection settings page 
5. In the Sample submission URL field you can enter the website address to which the user should be forwarded to
6. Click Save profile

Issue:

How to do silent install and activation of Elements Agent for MacOS? I want to install Elements Endpoint Protection Agent for Mac devices in a central way without local user interaction. 

Resolution:

You can find all the silent installation and activation instructions for Elements Agent for Mac from the Elements Endpoint Protection User Guide's Deployment methods for Mac devices section: Deployment methods for Mac devices | Elements Endpoint Protection | Latest | WithSecure User Guides 

It includes instructions such as: 

• Creating MDM profiles for Microsoft Intune and Jamf management system
• Installing the product automatically 

Issue:

Where does Server Share Protection backup the changed files and can a custom location be selected? 

Resolution:

The Server Share Protection feature detects malware activity on server shared folders and automatically restore them if they are broken or encrypted by malware.

Server Share Protection creates a session for every new connected user. For every session there is an associated backup folder inside the %ProgramData% \ WithSecure \ AmData folder. Server Share Protection analyzes the user session to check if the user is malicious or not.

You can change the default backup folder for Server Share Protection by following these steps:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the server 
4. Go to the Server share protection settings page
5. In the Backup files section, enter the path to the A custom folder to store backed-up files field
6. Click Save profile

The Server Share Protection "A custom folder to store backed-up files" folder path must be a path to a folder that already exists on the server locally. The SYSTEM account must have access rights to write to the folder. Otherwise, Server Share Protection is not able to protect shared folders and files.

Issue:

Elements Agent update downloads fail with error: "failed: 214 (operation incomplete)". What prevents Elements Endpoint Protection Agent from downloading and installing the updates?

Error shown in the AUA.log 

I: Downloading swup-win-db/1689330515 failed: 214 (operation incomplete)

Resolution:

Downloading of updates can fail with error "failed: 214 (operation incomplete)" if for example:

• You have a proxy somewhere that cuts off large zip file downloads.
• You have a component that cuts downloads or zip downloads over HTTP. Elements Agent malware definition and engine updates are downloaded by default using HTTP. You can try to enable downloading of updates over HTTPS and see if that helps:
  1. Log in to the Elements Security Center portal
  2. Navigate to the Security configurations > Profiles page
  3. Open the profile that is in use on the devices 
  4. Go to the Communication settings page
  5. Enable Use HTTPS to download updates 
  6. Click Save profile
• You have implemented SSL decryption that prevents updates from being downloaded.

Issue:

When creating a firewall rules to Windows Defender firewall with the Elements Endpoint Protection profile's firewall feature, the firewall rule doesn't work if a Windows User environment variable is used in the application path field.

For example, the firewall rule doesn't work when trying to use %LOCALAPPDATA% %HOMEPATH% %TEMP% %USERPROFILE% %OneDrive% in the application path field. 

Resolution:

Issue:

Can we remove or delete specific or particular Elements Endpoint Detection and Response Broad Context Detections (BCDs) from the Elements Security Center portal's Events > Security Events page. 

Resolution:

Broad Context Detections cannot be fully deleted or removed from the Elements Security Center portal's Events > Broad Context Detections page, they can only be archived. 

To archive a Broad Context Detection:

1. Log in to the Elements Security Center portal
2. Navigate to the Events > Broad Context Detections page
3. Select a Broad Context Detection by clicking on the box on the left side of the detection (a menu will appear)
4. Click Archive / Unarchive items 

To view the archived Broad Context Detections, create an Archived – equals – True filter.

Issue:

Admin would like to receive an email alert or notification when Elements Endpoint Protection Malware Protection feature has been disabled on a device for any reason. 

Resolution:

To receive a daily email report if any Elements devices have their Malware Protection disabled, you need to first create a custom view on the Elements Security Center portal's Environment > Devices page and then use that custom view as the data source for an email notification and report. 

How to create a custom view that lists all the devices which do not have malware protection enabled:

1. Log in to the Elements Security Center portal
2. Navigate to the Environment > Devices page
3. From the View drop-down menu, select the Overall status view
4. Click Select field from the filter creator (top-left corner of table) and create the following filter:
   1. Malware Protection – Not equals – Enabled 
5. Click Apply

Then you need to save the new view and set it as an organization view so that it can be selected as a data source in an email notification and report:

1. Open the View drop-down menu in top-right corner 
2. Click Save as…
3. Enter a name 
4. Click Save
5. Open the View drop-down menu again
6. Click on the three dots on the right side of the newly saved view 
7. Click Copy to organization views

Now you can create an email notification and report using this view as a data source:

1. Go to the Reports > Email notification and report page
2. Click Add email report
3. Enter name and select Data source = Devices
4. From the Template drop-down, select the custom view which you just created
5. In the Schedule section, select Frequency as Daily 
6. Select the time
7. Enable Send only when report has content so that an empty report is not sent
8. Click Save

Issue:

How to make a custom view in the Environment > Devices page in the Elements Security Center portal? I want the Devices view always to open by default with the specific filters and info columns. The view should also be remembered when the browser window / tab is refreshed. 

Resolution:

You can create custom views with pre-defined filters and informational columns by following the steps below. 

Here is how you add, remove and sort informational columns: 

1. Log in to the Elements Security Center portal: https://elements.withsecure.com
2. Navigate to the Environment > Devices page in the Elements portal
3. Click on the three vertical lines on the top-right corner of the devices table and select the columns you want to have in your view from the Available columns section. Any selected columns will be added to the Visible columns section.
   1. Note: You can also drag the column names up and down in the Visible columns section. 

Here is how you add filters:

1. Click Clear all filters to remove currently selected filters
2. Open the Select field drop-down menu from the top-left corner of the devices table
3. Select the filter
4. Then select either Equals or Not equals 
5. Finally select the value and Click Apply
   1. Note: You can add several filters 

After you have the informational columns and filters to your liking, you can save the current view as the default custom view so that it will always show this view then you enter the Devices page:

1. Open the View drop-down menu in the top-right corner
2. Click Save as…
3. Enter a name for the view
4. Toggle Set as default 
5. Click Save

Note that when you create a view, it is by default a personal view for you and it wont be visible for other users. If you are a partner user, this view will be available for you under all customer organizations. 

If you wish to make the view visible to all users in your organization, you can follow these steps:

1. Open the Views drop-down menu
2. Hover your mouse on top of the view and click on the three dots
3. Select Move to organization views 

Issue:

Microsoft Windows DirectAccess connection disconnects / cuts off / drops intermittently when Elements Endpoint Protection firewall profile is enabled.
 

Resolution:

If you are using WithSecure firewall profile, it will by default block unknown outbound connections, so you will need to make sure that you have all the required firewall rules in place if you want to have the DirectAccess connection working. 

Please follow this Microsoft guide regarding Direct Access firewall rules: Step 1 Plan the Advanced DirectAccess Infrastructure | Microsoft Learn

Note that if you use GPO to configure the Windows Firewall, in most cases it is best to turn off the WithSecure firewall profiles to avoid conflicts, since GPO firewall rules will always override any WithSecure created firewall rules. To turn off the WithSecure firewall profile:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Firewall settings page
5. In the Global setting section, from the WithSecure firewall mode drop-down menu, select Do nothing
6. Click Save profile