Issue:

How to configure the automatic action on infection when Elements Endpoint Protection Agent detects a malicious file?

Resolution:

The action on infection for Elements Endpoint Protection is by default is set to 'Quarantine'. To modify this setting:

1. Log in to the Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Click on the profile that is in use on the device
4. Go to the Real-time scanning settings page
5. Scroll down to the File scanning section
6. Select desired action from the Action on infection drop-down menu: 
   1. Device action on infection automatically
   2. Rename
   3. Delete
   4. Disinfect
   5. Quarantine
   6. Ask after scan
   7. Block
7. Click Save profile

Note that riskware and spyware have their own separate "action on riskware" and "Action on spyware" settings. If a detected file is not following the action set for infection, please check from the Events > Security Events page if the detected file is classified as either riskware or spyware. 

Issue:

What is WithSecure Elements Mobile Protection? What features does it have and what security does it provide? 

Resolution:

WithSecure Elements Mobile Protection provides security on Android and Apple iOS mobile devices.

On both Android and Apple iOS it provides the following features:

• Browsing Protection (prevents users from visiting phishing and malicious sites )
• SMS Protection (automatically scans incoming SMS messages for unsafe links or malicious QR codes.)
• Network Gateway (check every website visited, and by using WithSecure Security Cloud, it can limit access to those sites.)

On Android it also has: 

• Virus and threat protection (malware scanning of files and apps)

Issue:

Can Elements Mobile Protection (Elements EPP for Mobiles) be used to remotely wipe data or lock a stolen phone?

Resolution:

Elements Mobile Protection does not include features to lock a phone or wipe the data from the phone if it has for example been stolen.
 

Issue:

Unable to install Linux Security 64 or Elements Linux Protection in a container (example: Docker, Proxmox, Google NFS, Kubernetes etc.) due to certain errors which are causing the installation failure.

Can I install Elements Linux Protection or Business Suite Linux Security 64 into a container?

Resolution:

Container environments are not supported by Linux Security 64 or Elements Linux Protection at the moment. 

The reason why our products currently do not work well with containers is that they consist of multiple services and depend heavily upon facilities coming with the system, such as systemd or FUSE.

Issue:

Is it possible do disable automatic updates and schedule them for specific times for Elements Agents? 

For example: If a network is bandwidth limited and we would want to schedule the Elements Agent clients to download the malware definition and engine updates at different times so that the wouldn't get congested. 

Resolution:

Automatic updates for Elements Agent clients cannot be turned off or scheduled for specific times. Only the Elements Agent version upgrade can be scheduled with the "Allow WithSecure Elements Agent update" scheduled task in the profile.  

If you have a network that is bandwidth limited, we would recommend to install an Elements Connector within the network and configure the Elements Agent clients to download the malware definition and engine updates through the Elements Connector. This way Elements Connector would download all the update from outside the network and you would save bandwidth. 

Instructions for deploying and configuring Elements Connector can be found in the user guide: Elements Connector overview | Elements Connector | Latest | WithSecure User Guides  

Issue:

How to disable the Windows pop-up toast notification what is shown to the local user when Elements Endpoint Protection Scheduled Scan starts or finishes? Can this be turned off?

Resolution:

The Scheduled Scan notification can be turned off from the profile settings:

1. Log in to the Elements Security Center portal 
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is being used by the devices
4. Go to the Manual Scanning settings page
5. In the Scheduled scanning section, disable Show notifications to user
6. Click Save profile

Now the start and finish notifications for scheduled scans will no longer be shown to the local users.

Issue:

When a user plugs in a USB storage device or thumb drive to a Windows computer, it prompts the user to scan the USB device. How to automatically scan a USB storage without having the Elements Agent ask the user to scan the USB drive? 

Resolution:

By default the Action when USB storage device is plugged in is set as "Ask user to scan USB". To change the default behaviour, you can modify the profile that is in use on the devices:

1. Log in to Elements Security Center portal
2. Navigate to the Security Configurations > Profiles page
3. Open the profile that is in use on the devices
4. Go to the Scanning settings page
5. On Action when USB storage device is plugged in, you can choose either Silently Scan USB if you want it to automatically scan the USB and not prompt the user for anything
   1. Note: You can select either Scan USB and show result to user or Force scan USB and show result to user if you still want to scan automatically but also show the results to the user
6. Click Save profile

Issue:

Can we find out which device has been blocked by the Elements Endpoint Protection Device Control feature in the Elements Security Center portal?

Resolution:

When Elements Endpoint Protection Device Control feature blocks a device that matches a Device access rule in the profile, an alert will be sent to the Elements Security Center portal's Events > Security Events page. By clicking on the arrow on the left side of the detection you can show all the details of the block, such as which rule caused the device to be blocked and the Device ID of the blocked device. 

If you want to allow the device which was blocked, you can copy the device id from the security event and follow these steps to create a device filtering rule:

1. Go to the Security Configurations > profiles page
2. Open the profile that is in use on the device
3. Go to the Device control settings page
4. Scroll down to the Device filtering rules list
5. Click Add rule
6. Enter the Device ID that was shown in the security event 
7. Click Save profile 

Now the device is which was shown in the security event will no longer be blocked by the Elements Endpoint Protection device control feature. 

Device Control can list all the devices which are connected to a computer in the Elements Security Center portal. To see the list of devices: 

1. Navigate to the Environment > Devices page
2. Click on a Device
3. Switch to the Connected Devices tab

Here you can see all the devices and their IDs.

Issue:

During a banking session, Elements Endpoint Protection Connection Control shows the following notification: 

"Warning! someone might be trying to scam you"

What should I do?

Resolution:

Elements Endpoint Protection includes a Banking Protection / Connection Control feature where remote access applications are disconnected during banking sessions. The feature prevents phone scammers from leveraging remote access software to perform online thefts when you are on banking pages. 

If you need remote access during banking sessions for your own legitimate use, there is a setting under Secure Browsing settings that can be used to disable the feature:

1. Open Elements Agent user interface on your computer
2. Go to Settings
3. Go to the Secure Browsing settings page
4. Select Edit settings on bottom left corner
5. Select Yes to allow changes
6. In the Connection Control section, unselect the box next to option to "Block remote access during banking session"

This setting can also be changed by the administrator from the Elements Security Center portal's device profiles: 

1. Log in to the Elements Security Center portal
2. Navigate to the Security configurations > profiles page
3. Open the profile that is in use on the devices
4. Go to the Browsing Protection settings page
5. In the Connection control section, disable Block remote access
6. Click Save profile

Issue:

How to remove an expired Elements subscription key from Elements Security Center portal's Management > Subscriptions page? We do not want to see expired keys in the portal. 

Resolution:

An expired subscription key will be removed automatically from Elements Security Center portal's Subscriptions page after 120 days (4 months).

If you wish to only see valid subscription keys on the Elements portal's Management > Subscriptions page, you can use an Expiration – Equals – Valid filter.