Issue:

How to create a targeted scheduled scan in Policy Manager for WithSecure Client Security and Server Security clients?

Resolution:

You can create a targeted scheduled scan by following these steps:

1. Log in to Policy Manager Console
2. Select the host or domain from the Domain Tree 
3. Go to the Settings tab 
4. Go to the Windows > Manual scanning page 
5. Click Add on the right side of the Scheduled scanning list
6. Enter the Scheduling parameters (Example: /t08:30 /rweekly /s4 – this scan will be run each Thursday at 08:30)
7. Select Generic as the Task Type
8. Enter in the Task Type Specific Parameters: 
   • Client Security:"C:\Program Files (x86)\F-Secure\Client Security\fsscan.exe" -s  C:\Examplefolder 
   • Server Security: "C:\Program Files (x86)\F-Secure\Server Security\fsscan.exe" -s  D:\Examplefolder
9. Distribute the policy 

This will scan the target folder C:\Examplefolder and sub-folders within it with the current scan settings shown in Policy Manager Console in the File scanning section on the Manual scanning page. 

Fsscan.exe does not support several target folders. You will need to create a separate scheduled scan for each target. Several targeted scans can run concurrently. 

Issue:

How to increase the logging level (enable debug logging) of a Client Security or Server Security host via Policy Manager Console?

Resolution:

Note: These steps require Policy Manager Console 15.10 or later. 

You can increase the logging level via the following setting in the Policy Manager Console:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab (standard view)
4. Go to the Centralized management settings page
5. In the Logging section, change the Client logging level to Debug

Doing this will enable the following on the Windows endpoint client:

• Full debug logging in the product logs.
• Collect the API tracing log (fssua.opswat_api.log) and debug log (C:\Program Files (x86)\F-Secure\Client Security\swup\v4DebugInfo*.log) for the Software Updater feature.

After enabling debug logging, reproducing the issue and collecting the logs by running the Support Tool, you should lower the logging level by switching the client logging level back to "Info" and distribute the policy. When debug logging is enabled, the product will use more resources. 

Issue:

I made policy settings changes which I do not wish to save and distribute to the hosts. How can I discard changes to a policy in Policy Manager Console?

How to view the settings changes made to a certain policy before distribution? 

Resolution:

You can discard the settings changes with the following steps:

1. Open the Policy Manager Console
2. Click File > Discard policy changes in the top left corner

To view what settings had been changed in a policy, right-click on the host or policy domain from the domain tree and select Show Modified Settings.

Issue:

Following the guide at:

https://gallery.ecr.aws/withsecure/atlant

How to configure a persistent data storage/volume for downloaded signatures. Especially during development/testing phases it is quite useless to load signatures over and over again on every container restart?

Resolution:

To just map a local directory or a docker volume as the Atlant container's update directory with -v option to the docker run command.

Example:

# Create a Docker volume
docker volume create atlant_data

# Run the container with the volume

docker run –rm -v atlant_data:/opt/withsecure/atlant/updates -v /home/jaalsa/atlant-container/config:/etc/opt/withsecure/atlant/config:ro -p 8080:8080 -p 1344:1344 atlant:latest

So, the essential part is -v atlant_data:/opt/withsecure/atlant/updates.

This will prevent unnecessary downloads. Also, one must be careful to not run two containers with the same volume/path.

Issue:

How to disable TLS1.0 and TLS1.0 in Policy Manager Server ?

Resolution:

The Java system properties for Policy Manager Server (PMS) can be specified via the Windows registry:

1. Run Regedit as administrator.
2. Create the following string registry

   key: HKEY_LOCAL_MACHINE\SOFTWARE(Wow6432Node)\Data Fellows\F-Secure\Management Server 5\additional_java_args

3. Specify the Java system properties in the following format:

   -DenableVistaInteroperability=false

4. Restart the Policy Manager Server service to make the new configuration take effect.

Reference: https://community.withsecure.com/en/kb/articles/5631-policy-manager-advanced-configuration-settings
 

If issue persists , can try add -DenableVistaInteroperability=false – -DenableWindowsServer2012Interoperability=false and restart service.

For v16.00 value should be set at HKLM\SOFTWARE\WithSecure\Policy Manager\Policy Manager Server\additional_java_args

Usually, no need to touch httpsCipherSuites values

Issue:

How to stop Linux Security 64 scheduled scan? fsanalyze  command can be stopped by terminating that command/terminal. However, we cannot see the progress of scheduled scan in LS64.

Resolution:

Stop the LS64 service by using "master-switch" command.
 

/opt/f-secure/fsbg/bin/master-switch ( on | off | status )

For further information for this command.
https://www.withsecure.com/userguides/product.html#business/linux-security-64/latest/ja/concept_5BC18AEF5A524D158A7744035B4EE4E1-latest-ja

Issue:

How to export the Device Control hardware devices list in Policy Manager in CSV format?

Resolution:

Follow these instructions to export the Device Control hardware devices table as CSV:

1. Highlight the policy domain from the Domain Tree 
2. Go to the Settings tab and select Advanced View
3. Navigate to F-Secure Device Control >  Settings > Devices > Hardware Devices
4. Right click table and choose Export table content

Issue:

How to hide the real-time scanning exclusions or other exclusions from users in the local Client Security or Server Security user interface?

Resolution:

1. Log in to the Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to the Settings tab
4. Go to the Centralized management settings page
5. Under Local User Interface, enable or disable Hide exclusions from clients by clicking the checkbox.
6. Distribute the policy (Ctrl + D)

• Settings > Centralized management > Local user interface

Issue:

Where do you change the settings about alerts and when virus definition updates are considered outdated (old)?

Resolution:

In order to change these parameters, do the following:

1. Log in to your Policy Manager Console
2. Select a host or policy domain from the domain tree
3. Go to Settings tab 
4. Navigate to the Windows > Centralized management settings page
5. Scroll down to the Automatic updates section
6. Change the values for:
   • Time limit for considering update databases old (in days)
   • Time limit for considering update databases very old (in days)
7. Distribute the policy (Ctrl + D)

Issue:

How do I run a manual scan using the command line on WithSecure Server Security or Client Security?

Resolution:

The command line option to execute a manual scan can be either used to run a scan on-demand. Additionally the command and the arguments can be used to fill the "Generic" scheduled scan task specific parameters.

To run the task locally via command line:

1. Press the Windows button
2. Search for cmd.exe and press Enter
3. Navigate to the client's installation directory (for example: cd C:\Program Files (x86)\F-Secure\)
4. For Client Security, navigate further to the Client Security directory. For Server Security, navigate to the Server Security directory.
5. Type in fsscan.exe and add any of the below arguments/options, then press Enter
6. The scan will be executed and further details will be returned in the command window

Example 1
Retrieving information on available options:

C:\Program Files (x86)\F-Secure\Client Security>fsscan -?

Usage: fsscan [options]

Options:

Example 2
Scanning a specific directory (downloads directory of the user Foo):

C:\Program Files (x86)\F-Secure\Client Security>fsscan.exe -t C:\Users\Foo\Downloads\

Setting up a scheduled scan on a specific directory via Policy Manager Console:

1. Log on to your Policy Manager Console.
2. Select the Policy domain