Issue:

Why is the OpenJDK Platform process from WithSecure consuming 90% (or high usage) of memory, causing the server to be slow?

Resolution:

The WithSecure Policy Manager uses the OpenJDK platform to run.

In Windows, you can check if the process belongs to the Policy Manager by checking the path of the executable (Right-click process > Open file location). The Policy Manager OpenJDK process is executed from the Policy Manager installation directory, <installation folder\F-Secure\Management Server 5\jre\bin.

If the issue occurs right after upgrading your Policy Manager to the latest version, or after migration of the H2DB database, the root cause can be related to the high number of alerts in your current H2DB database. You can make use of the WithSecure Policy Manager Database Maintenance tool to drop these alerts from your database as per guide (see: https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_E02887FA732B4D9686C82ADE63844464-16.00-en)

If this does not help, try using the recovery tool.

For Windows: https://community.withsecure.com/en/kb/articles/5639-using-the-policy-manager-for-windows-database-recovery-tool-version-10-00-and-later
For Linux: https://community.withsecure.com/en/kb/articles/5621-using-the-policy-manager-for-linux-database-recovery-tool-version-10-00-and-later

Issue:

New Linux Security(2024-03-18)  fails offline database update

Resolution:

New Linux Security(2024-03-18)  update includes changes which will affect the procedure to install future malware definition or product updates from ZIP archives.  Please continue reading if you are currently making use of ZIP archives to install updates using the offline-update program.

 After updating your product installation to the new version, follow these steps to prepare update ZIP archives in the future:

1. Log on to the endpoint on which you intend to install updates from a ZIP archive.
2. Run the command
   /opt/f-secure/fsbg/bin/withsecure-migrator status
3. Check the last line of output from the above command.
4. If the system reports that the command does not exist, or the command reports “not-performed” or “not-ready”, you can prepare a new f-secure-updates.zip archive for updates by using any version of fspm-definitions-update-tool and channels.json files you might already have available, and install the updates as before from the f-secure-updates.zip file using the offline-update program. Before starting to prepare another ZIP archive later, however, return to step 1 of these instructions.
5. If the command at step 2 reports "migrated", the procedure for installing the updates changes as follows:
   1. First, please verify that you are using a recent enough version of fspm-definitions-update-tool for creating update archives.
      • If you are using fspm-definitions-update-tool from a Policy Manager Server 16 installation, you are already at a new enough version.
      • If you are not using Policy Manager 16, or are unsure about the version of fspm-definitions-update-tool, download the latest version of fspm-definitions-update-tool from the product download page, and extract the files to a directory.
        Support – Linux Security
   2. Second, download the latest version of the channels.json file to use to configure fspm-definitions-update-tool:
      https://download.f-secure.com/corpro/ls64/current/channels.json
      As before, replace the channels.json file under fspm-definitions-update-tool's conf/ subdirectory with the downloaded file, remove the data/ directory if it exists.
   3. Run the fspm-definitions-update-tool program.  fspm-definitions-update-tool will create a fresh data/ subdirectory with two ZIP archives: f-secure-updates.zip and withsecure-updates.zip.  You must now use the withsecure-updates.zip file to install updates on the endpoint using the offline-update program.
      (The f-secure-updates.zip file should no longer be used for installing updates on that endpoint.  When run, fspm-definitions-update-tool will however continue to create this file to support packaging updates for endpoints which still need this file.)
   4. After installing the product updates for the first time from the withsecure-updates.zip file on an endpoint, it won't be necessary to verify the status of the installation again on that endpoint (step 2); all later product updates can be installed using the withsecure-updates.zip file.

If you still experience update error, please refer this knowledge as well.
https://community.withsecure.com/en/kb/articles/31302-the-latest-linux-security-64-update-fails-to-install

Issue:

WithSecure Policy Manager is warning on the Server events for the last 24H event list that the latest virus definition update is several days old. 

Resolution:

If the WithSecure Policy Manager Server is showing this event on the dashboard:

• Make sure that you have upgraded both the Policy Manager and the clients to a supported version. You need to have at least version 16 of both Policy Manager and the clients, since old versions will not be able to connect to the WithSecure Update servers.
• Verify that the server is able to connect to the WithSecure Update servers. You can download and run the WithSecure Connectivity Tool to make sure the client and servers can connect to all required addresses: https://download.withsecure.com/connectivitytool/ConnectionChecker.exe
• Verify that the server has more than 2GB of free disk space and that there are no low disk space alerts shown on the server events list. If the server has less than 2GB, the Policy Manager Server will automatically stop downloading new virus definition updates
• Verify there is no conflicting third party software (antivirus) blocking WithSecure's updates.

Issue:

I receive the PDF report sent from scheduled reporting in Policy Manager 15.x.

However, when I attempt to open the PDF report attached in the mail, the PDF report is empty and does not show any information.

Resolution:

To workaround the issue, we recommend importing the Policy Manager CA to the trusted root:

1. Run the following command to export Policy Manager CA certificate:
   • "c:\Program Files (x86)\F-Secure\Management Server 5\jre\bin\keytool.exe" -keystore "c:\Program Files (x86)\F-Secure\Management Server 5\data\fspms-ca.jks" -alias fspm-ca -exportcert -file fspms-ca.cer -rfc -protected
2. Run certlm.msc to bring up the Windows certificate store.
3. Import fspms-ca.cer (that you exported in step 1) to the Trusted Root Certification Authorities -> Certificates
4. Reboot the Policy Manager Server, to take the updated root CA in use for all services

Issue:

I installed Policy Manager Server for Linux v14.20 on CentOS v7.7. I have installed the same Policy Manager console version. I cannot connect to Policy Manager Server using Policy Manager console. The F-Secure Policy Manager Server service is running.

Resolution:

Issue:

• When user tries to access some specific web Sites, admin gets alerts in Policy Manager Console that a DNS query was blocked for a domain

• We get error from Policy Manager containing "309    2020-03-22  21:57:47+01:00  SERVER0X SYSTEM  F-Secure Network Filter  1.3.6.1.4.1.2213.11.1.12 Blocked a DNS query for the following unsafe domain:  www.test.com

Resolution:

Note: The notifications you get from F-Secure Policy Manager Server regarding the DNS Filter, are not errors. These are alerts/notifications send from Clients.F-Secure Policy Manager does not generate errors on behalf of clients. Clients generate errors locally, and they only send alerts to Policy Manager.
If the alert forwarding is enabled via Policy Manager, each time a query is blocked, admin will be notified according to that.

This is an expected behavior, and to understand it better, please read the explanation bellow:
DNS queries are based on ORSP rating, so ORSP needs to be activated from Policy Manager Console for all Clients.
How to enable Security Cloud using F-Secure Policy Manager Console:

1. Log in to WithSecure Policy Manager Console and navigate to Advanced view

2. Expand the F-Secure Security Cloud Client Settings and make sure the "allow deeper analyses" and "Client is enabled" is set to "yes" and distribute the policy.

ORSP stands for Object Reputation Service Protocol. When a new object, such as a file or URL, is encountered on one client, the product communicates with the Security Cloud using the strongly encrypted Object Reputation Service Protocol (ORSP) to query for the object's reputation details. Anonymous metadata about the object, such as file size and anonymized path, are sent to the Security Cloud. You may find more information about the Security Cloud here: https://www.f-secure.com/en/web/legal_global/privacy/security-cloud

Botnet blocker works on the level of DNS resolution and IP address filtering.
When DNS filtering is enabled, we don't allow to resolve DNS addresses if we know these DNS addresses are not safe.
When IP reputation filtering is enabled, we block connections to IP addresses for which we have reputation in ORSP.
When you allow all queries, it means you have disabled DNS filter, by doing this you are disabling DNS scanning on NIF (Network interception Framework) level.
If you set to example „Allow safe queries only „it might still block local DNS.
DNS record information is usually cached (stored on your local browser, computer or network forwarder) for a specific amount of time; anywhere from 5 minutes to 8 hours is normal.

• block unsafe => unknown, susp, safe will go thru.

• unsafe (malicious) are blocked Block unsafe, susp => unknown and safe go thru.

• unsafe (malicious) and suspicious are blocked allow safe only => only safe rated go thru. unknown, suspicious, unsafe (malicious) are blocked

Blocking botnet communication

Botnet Blocker is a security feature that aims to prevent botnet agents from communicating with their command and control servers.
The feature uses DNS reputation data to verify the security of queries when translating DNS requests to IP addresses.
To configure Botnet Blocker in Standard view:

1. On the Settings > Web traffic scanning page, go to Botnet blocker

2. Set the filtering to use for DNS queries.

By default, this set to Block unsafe queries.

1. Set the alert level to use for notifications of blocked DNS queries.

2. Distribute the policy:

You can choose what works for you best, you have different option in Policy Manager Console:

Issue:

By default, Linux distributions set a umask of 022. However, if this is modified e.g. to harden the underlying system, it can cause a problem where the Automatic Update Server process (bwserver) fails to start. This is due to the process bwserver not being able to read its own config-file /etc/opt/f-secure/fsaus/conf/server.cfg.

This will prevent legacy clients from downloading updates from the Policy Manager Server. Legacy clients include:

• Email and Server Security version 12.x and older 
• Server Security 12.x and older
• Client Security versions older than 13.x.

Resolution:

The workaround is to manually set the permission for server.cfg after installation and restart the fspms daemon.

As root execute the following commands:

# chown fspms.fspms /etc/opt/f-secure/fsaus/conf/server.cfg
# /etc/init.d/fspms restart

Issue:

Other Anti Virus is showing different result in Virus Total
　
Virus Total
https://www.virustotal.com/gui/home/upload

Resolution:

The criteria of maliciousness is different in each antivirus software.
If you really want to check the file, please submit the file to SAS.

https://www.f-secure.com/en/business/support-and-downloads/submit-a-sample

Issue:

Policy Manager Server upgrade to 16.00 fails if previous 15 version installation is not on default C:\ drive.

If for example Policy Manager Server has been installed on the E:\ drive, the upgrade fails and after launching Policy Manager Console, user in greeted with an empty policy Domain Tree. 

During the 15.x -> 16.00 upgrade, user is asked to enter TCP-ports, which should not happen when upgrading an existing Policy Manager Server installation. 

Resolution:

You may use 16.01 with the TARGETDIR msi parameter to install 16.01 to the alternative location using the guide https://www.withsecure.com/userguides/product.html#business/policy-manager/16.00/en/task_6124FC32495E494B9AE5352EBAB7E1A2-16.00-en

Note – Regarding the default data directory, it is always in %ProgramData% location. 

Issue:

MSI product code for WithSecure Client Security is generated each time differently when the installation package is created.

This is troublesome as I need to include a number of MSI product codes in the SCCM's detection method, to detect the existing installation of WithSecure Client Security.

Other than using the MSI product code, what's your recommendation to create the detection method in SCCM?

Resolution:

You can use the custom made type of detection method, based on the product registry. We recommend to use the following detection methods:

1. Using the product registry detection, whereby the product version is being kept at the following registry:

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\F-Secure\NS\default\OneClient\Version(REG_SZ)

For example, to detect the existing installation of F-Secure Client Security 15.20 installed on the device