Elements Security Center<\/h2>\nUninstalled devices are now shown in Managed Removed Devices view<\/strong><\/h4>\nThis view shows devices where Elements agent was uninstalled, currently supporting Windows agents only.<\/p>\n
Security posture new profile based assessments<\/strong><\/h4>\nA new form of security posture analysis points have been added. These analyse data from the profile settings to warn admins about potentially risky configuration.<\/p>\n![\"Picture1.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-11.png.webp\")
<\/img><\/a><\/figure>\nDevices assigned to the affected profile are shown under security posture<\/strong><\/h4>\n![\"Picture2.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-12.png.webp\")
<\/img><\/a><\/figure>\nDevice count and platform shown in Security Posture view<\/strong><\/h4>\nThe profile based assessments flyout now shows the device count for each affected profile together with a platform type icon that links to device view.<\/p>\n![\"Picture3.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-13.png.webp\")
<\/img><\/a><\/figure>\nMissing updates and installation logs now can now be filtered<\/strong><\/h4>\n![\"Picture4.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-13.png.webp\")
<\/img><\/a><\/figure>\nSecurity Events now includes Collaboration Protection events<\/strong><\/h4>\nInformation on the number of malicious URLs and attachments discovered by Collaboration Protection was added to Security Event details of the Collaboration Protection Email Scan Event.<\/p>\n
The \u201cOther Elements Solution view\u201d in Security Events now also contains all Collaboration Protection events.<\/p>\n
New profile based security posture<\/strong><\/h4>\nThe security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n![\"Picture5.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-14.png.webp\")
<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\nThe reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n![\"Picture6.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-12.png.webp\")
<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\nWe have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n![\"Picture7.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-11.png.webp\")
<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\nThis release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
Report info about all currently logged in users<\/strong><\/h4>\nYou can now search for all devices that a user has logged on to.<\/p>\n![\"Picture8.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-12.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture9.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-11.png.webp\")
<\/img><\/a><\/figure>\nWe also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n![\"Picture10.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-8.png.webp\")
<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n![\"Picture11.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture11-9.png.webp\")
<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\nElements Collaboration Protection<\/h2>\nAutomatic protection for new Teams channels<\/strong><\/h4>\nThe \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n
Elements Vulnerability Management<\/h2>\nEVM System Scan<\/strong><\/h3>\nThe following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n
\n- CVeritas InfoScale Operations Manager (VIOM)<\/li>\n
- Cisco Duo Authentication Proxy<\/li>\n
- IBM Aspera Cargo<\/li>\n
- IBM Aspera Connect<\/li>\n
- WireGuard client<\/li>\n
- Duo Authentication<\/li>\n
- Cisco Duo Device Health Application<\/li>\n
- IBM SPSS Statistics<\/li>\n
- Citrix ShareFile Storage Zones Controller<\/li>\n
- Dell Wyse Management Suite<\/li>\n
- Mattermost Desktop<\/li>\n
- Acronis Cyber Backup<\/li>\n
- Acronis Cyber Protect<\/li>\n
- Automox Agent<\/li>\n
- Kofax Power PDF<\/li>\n<\/ul>\n
Elements Vulnerability Management Portal<\/strong><\/h3>\nClarified usage calculation explanation<\/strong><\/h4>\nThe usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n![\"Picture12.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture12-6.png.webp\")
<\/img><\/a><\/figure>\nIntegrations<\/h2>\nElements API: cookbook and new filter for incidents<\/strong><\/h3>\nElements API Cookbook<\/strong><\/h4>\nTo help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\nChanges in the Incident endpoint<\/strong><\/h4>\nNew filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\nNew fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\nNew endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\nEndpoint Protection API is deprecated<\/strong><\/h3>\nWe kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n
– infections<\/p>\n
– security events<\/p>\n
– companies<\/p>\n
– computers<\/p>\n
The following endpoints are deprecated and soon end of life<\/p>\n
Invitations: End of Life : 3rd of November, 2023<\/p>\n
Subscriptions: End of Life: 11th of March, 2024<\/p>\n
WithSecure Elements Connector<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n![\"Picture13.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture13-5.png.webp\")
<\/img><\/a><\/figure>\nCorresponding warning is also shown in the Connector device view:<\/p>\n![\"Picture14.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture14-5.png.webp\")
<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\nOther items of interest<\/h2>\nMonthly Threat Highlights Report: August 2023<\/strong><\/h3>\nNew vulnerabilities in Ivanti products<\/strong><\/h4>\nSeveral vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\nOne of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\nAffiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n
Changing hacktivist landscape<\/strong><\/h4>\nAssessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n
Ransomware trends and statistics<\/strong><\/h4>\nRansomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n
Threat data highlights<\/strong><\/h4>\nOverview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n
Download report<\/strong><\/a><\/p>\nIn case you missed it<\/h2>\nShare your ideas with us<\/strong><\/h3>\nOur purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n![\"Picture15.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture15-4.png.webp\")
<\/img><\/a><\/figure>\nFurther information<\/h2>\n
This view shows devices where Elements agent was uninstalled, currently supporting Windows agents only.<\/p>\n
Security posture new profile based assessments<\/strong><\/h4>\nA new form of security posture analysis points have been added. These analyse data from the profile settings to warn admins about potentially risky configuration.<\/p>\n<\/img><\/a><\/figure>\nDevices assigned to the affected profile are shown under security posture<\/strong><\/h4>\n<\/img><\/a><\/figure>\nDevice count and platform shown in Security Posture view<\/strong><\/h4>\nThe profile based assessments flyout now shows the device count for each affected profile together with a platform type icon that links to device view.<\/p>\n<\/img><\/a><\/figure>\nMissing updates and installation logs now can now be filtered<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSecurity Events now includes Collaboration Protection events<\/strong><\/h4>\nInformation on the number of malicious URLs and attachments discovered by Collaboration Protection was added to Security Event details of the Collaboration Protection Email Scan Event.<\/p>\n
The \u201cOther Elements Solution view\u201d in Security Events now also contains all Collaboration Protection events.<\/p>\n
New profile based security posture<\/strong><\/h4>\nThe security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\nThe reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\nWe have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\nThis release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
Report info about all currently logged in users<\/strong><\/h4>\nYou can now search for all devices that a user has logged on to.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nWe also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\nElements Collaboration Protection<\/h2>\nAutomatic protection for new Teams channels<\/strong><\/h4>\nThe \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n
Elements Vulnerability Management<\/h2>\nEVM System Scan<\/strong><\/h3>\nThe following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n
\n- CVeritas InfoScale Operations Manager (VIOM)<\/li>\n
- Cisco Duo Authentication Proxy<\/li>\n
- IBM Aspera Cargo<\/li>\n
- IBM Aspera Connect<\/li>\n
- WireGuard client<\/li>\n
- Duo Authentication<\/li>\n
- Cisco Duo Device Health Application<\/li>\n
- IBM SPSS Statistics<\/li>\n
- Citrix ShareFile Storage Zones Controller<\/li>\n
- Dell Wyse Management Suite<\/li>\n
- Mattermost Desktop<\/li>\n
- Acronis Cyber Backup<\/li>\n
- Acronis Cyber Protect<\/li>\n
- Automox Agent<\/li>\n
- Kofax Power PDF<\/li>\n<\/ul>\n
Elements Vulnerability Management Portal<\/strong><\/h3>\nClarified usage calculation explanation<\/strong><\/h4>\nThe usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n<\/img><\/a><\/figure>\nIntegrations<\/h2>\nElements API: cookbook and new filter for incidents<\/strong><\/h3>\nElements API Cookbook<\/strong><\/h4>\nTo help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\nChanges in the Incident endpoint<\/strong><\/h4>\nNew filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\nNew fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\nNew endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\nEndpoint Protection API is deprecated<\/strong><\/h3>\nWe kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n
– infections<\/p>\n
– security events<\/p>\n
– companies<\/p>\n
– computers<\/p>\n
The following endpoints are deprecated and soon end of life<\/p>\n
Invitations: End of Life : 3rd of November, 2023<\/p>\n
Subscriptions: End of Life: 11th of March, 2024<\/p>\n
WithSecure Elements Connector<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nCorresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\nOther items of interest<\/h2>\nMonthly Threat Highlights Report: August 2023<\/strong><\/h3>\nNew vulnerabilities in Ivanti products<\/strong><\/h4>\nSeveral vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\nOne of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\nAffiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n
Changing hacktivist landscape<\/strong><\/h4>\nAssessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n
Ransomware trends and statistics<\/strong><\/h4>\nRansomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n
Threat data highlights<\/strong><\/h4>\nOverview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n
Download report<\/strong><\/a><\/p>\nIn case you missed it<\/h2>\nShare your ideas with us<\/strong><\/h3>\nOur purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nDevices assigned to the affected profile are shown under security posture<\/strong><\/h4>\n<\/img><\/a><\/figure>\nDevice count and platform shown in Security Posture view<\/strong><\/h4>\nThe profile based assessments flyout now shows the device count for each affected profile together with a platform type icon that links to device view.<\/p>\n<\/img><\/a><\/figure>\nMissing updates and installation logs now can now be filtered<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSecurity Events now includes Collaboration Protection events<\/strong><\/h4>\nInformation on the number of malicious URLs and attachments discovered by Collaboration Protection was added to Security Event details of the Collaboration Protection Email Scan Event.<\/p>\n
The \u201cOther Elements Solution view\u201d in Security Events now also contains all Collaboration Protection events.<\/p>\n
New profile based security posture<\/strong><\/h4>\nThe security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\nThe reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\nWe have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\nThis release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
Report info about all currently logged in users<\/strong><\/h4>\nYou can now search for all devices that a user has logged on to.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nWe also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\nElements Collaboration Protection<\/h2>\nAutomatic protection for new Teams channels<\/strong><\/h4>\nThe \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n
Elements Vulnerability Management<\/h2>\nEVM System Scan<\/strong><\/h3>\nThe following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n
\n- CVeritas InfoScale Operations Manager (VIOM)<\/li>\n
- Cisco Duo Authentication Proxy<\/li>\n
- IBM Aspera Cargo<\/li>\n
- IBM Aspera Connect<\/li>\n
- WireGuard client<\/li>\n
- Duo Authentication<\/li>\n
- Cisco Duo Device Health Application<\/li>\n
- IBM SPSS Statistics<\/li>\n
- Citrix ShareFile Storage Zones Controller<\/li>\n
- Dell Wyse Management Suite<\/li>\n
- Mattermost Desktop<\/li>\n
- Acronis Cyber Backup<\/li>\n
- Acronis Cyber Protect<\/li>\n
- Automox Agent<\/li>\n
- Kofax Power PDF<\/li>\n<\/ul>\n
Elements Vulnerability Management Portal<\/strong><\/h3>\nClarified usage calculation explanation<\/strong><\/h4>\nThe usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n<\/img><\/a><\/figure>\nIntegrations<\/h2>\nElements API: cookbook and new filter for incidents<\/strong><\/h3>\nElements API Cookbook<\/strong><\/h4>\nTo help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\nChanges in the Incident endpoint<\/strong><\/h4>\nNew filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\nNew fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\nNew endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\nEndpoint Protection API is deprecated<\/strong><\/h3>\nWe kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n
– infections<\/p>\n
– security events<\/p>\n
– companies<\/p>\n
– computers<\/p>\n
The following endpoints are deprecated and soon end of life<\/p>\n
Invitations: End of Life : 3rd of November, 2023<\/p>\n
Subscriptions: End of Life: 11th of March, 2024<\/p>\n
WithSecure Elements Connector<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nCorresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\nOther items of interest<\/h2>\nMonthly Threat Highlights Report: August 2023<\/strong><\/h3>\nNew vulnerabilities in Ivanti products<\/strong><\/h4>\nSeveral vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\nOne of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\nAffiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n
Changing hacktivist landscape<\/strong><\/h4>\nAssessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n
Ransomware trends and statistics<\/strong><\/h4>\nRansomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n
Threat data highlights<\/strong><\/h4>\nOverview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n
Download report<\/strong><\/a><\/p>\nIn case you missed it<\/h2>\nShare your ideas with us<\/strong><\/h3>\nOur purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nDevice count and platform shown in Security Posture view<\/strong><\/h4>\nThe profile based assessments flyout now shows the device count for each affected profile together with a platform type icon that links to device view.<\/p>\n<\/img><\/a><\/figure>\nMissing updates and installation logs now can now be filtered<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSecurity Events now includes Collaboration Protection events<\/strong><\/h4>\nInformation on the number of malicious URLs and attachments discovered by Collaboration Protection was added to Security Event details of the Collaboration Protection Email Scan Event.<\/p>\n
The \u201cOther Elements Solution view\u201d in Security Events now also contains all Collaboration Protection events.<\/p>\n
New profile based security posture<\/strong><\/h4>\nThe security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\nThe reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\nWe have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\nThis release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
Report info about all currently logged in users<\/strong><\/h4>\nYou can now search for all devices that a user has logged on to.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nWe also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\nElements Collaboration Protection<\/h2>\nAutomatic protection for new Teams channels<\/strong><\/h4>\nThe \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n
Elements Vulnerability Management<\/h2>\nEVM System Scan<\/strong><\/h3>\nThe following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n
\n- CVeritas InfoScale Operations Manager (VIOM)<\/li>\n
- Cisco Duo Authentication Proxy<\/li>\n
- IBM Aspera Cargo<\/li>\n
- IBM Aspera Connect<\/li>\n
- WireGuard client<\/li>\n
- Duo Authentication<\/li>\n
- Cisco Duo Device Health Application<\/li>\n
- IBM SPSS Statistics<\/li>\n
- Citrix ShareFile Storage Zones Controller<\/li>\n
- Dell Wyse Management Suite<\/li>\n
- Mattermost Desktop<\/li>\n
- Acronis Cyber Backup<\/li>\n
- Acronis Cyber Protect<\/li>\n
- Automox Agent<\/li>\n
- Kofax Power PDF<\/li>\n<\/ul>\n
Elements Vulnerability Management Portal<\/strong><\/h3>\nClarified usage calculation explanation<\/strong><\/h4>\nThe usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n<\/img><\/a><\/figure>\nIntegrations<\/h2>\nElements API: cookbook and new filter for incidents<\/strong><\/h3>\nElements API Cookbook<\/strong><\/h4>\nTo help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\nChanges in the Incident endpoint<\/strong><\/h4>\nNew filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\nNew fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\nNew endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\nEndpoint Protection API is deprecated<\/strong><\/h3>\nWe kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n
– infections<\/p>\n
– security events<\/p>\n
– companies<\/p>\n
– computers<\/p>\n
The following endpoints are deprecated and soon end of life<\/p>\n
Invitations: End of Life : 3rd of November, 2023<\/p>\n
Subscriptions: End of Life: 11th of March, 2024<\/p>\n
WithSecure Elements Connector<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nCorresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\nOther items of interest<\/h2>\nMonthly Threat Highlights Report: August 2023<\/strong><\/h3>\nNew vulnerabilities in Ivanti products<\/strong><\/h4>\nSeveral vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\nOne of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\nAffiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n
Changing hacktivist landscape<\/strong><\/h4>\nAssessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n
Ransomware trends and statistics<\/strong><\/h4>\nRansomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n
Threat data highlights<\/strong><\/h4>\nOverview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n
Download report<\/strong><\/a><\/p>\nIn case you missed it<\/h2>\nShare your ideas with us<\/strong><\/h3>\nOur purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nMissing updates and installation logs now can now be filtered<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSecurity Events now includes Collaboration Protection events<\/strong><\/h4>\nInformation on the number of malicious URLs and attachments discovered by Collaboration Protection was added to Security Event details of the Collaboration Protection Email Scan Event.<\/p>\n
The \u201cOther Elements Solution view\u201d in Security Events now also contains all Collaboration Protection events.<\/p>\n
New profile based security posture<\/strong><\/h4>\nThe security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\nThe reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\nWe have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\nThis release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
Report info about all currently logged in users<\/strong><\/h4>\nYou can now search for all devices that a user has logged on to.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nWe also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\nElements Collaboration Protection<\/h2>\nAutomatic protection for new Teams channels<\/strong><\/h4>\nThe \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n
Elements Vulnerability Management<\/h2>\nEVM System Scan<\/strong><\/h3>\nThe following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n
\n- CVeritas InfoScale Operations Manager (VIOM)<\/li>\n
- Cisco Duo Authentication Proxy<\/li>\n
- IBM Aspera Cargo<\/li>\n
- IBM Aspera Connect<\/li>\n
- WireGuard client<\/li>\n
- Duo Authentication<\/li>\n
- Cisco Duo Device Health Application<\/li>\n
- IBM SPSS Statistics<\/li>\n
- Citrix ShareFile Storage Zones Controller<\/li>\n
- Dell Wyse Management Suite<\/li>\n
- Mattermost Desktop<\/li>\n
- Acronis Cyber Backup<\/li>\n
- Acronis Cyber Protect<\/li>\n
- Automox Agent<\/li>\n
- Kofax Power PDF<\/li>\n<\/ul>\n
Elements Vulnerability Management Portal<\/strong><\/h3>\nClarified usage calculation explanation<\/strong><\/h4>\nThe usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n<\/img><\/a><\/figure>\nIntegrations<\/h2>\nElements API: cookbook and new filter for incidents<\/strong><\/h3>\nElements API Cookbook<\/strong><\/h4>\nTo help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\nChanges in the Incident endpoint<\/strong><\/h4>\nNew filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\nNew fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\nNew endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\nEndpoint Protection API is deprecated<\/strong><\/h3>\nWe kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n
– infections<\/p>\n
– security events<\/p>\n
– companies<\/p>\n
– computers<\/p>\n
The following endpoints are deprecated and soon end of life<\/p>\n
Invitations: End of Life : 3rd of November, 2023<\/p>\n
Subscriptions: End of Life: 11th of March, 2024<\/p>\n
WithSecure Elements Connector<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nCorresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\nOther items of interest<\/h2>\nMonthly Threat Highlights Report: August 2023<\/strong><\/h3>\nNew vulnerabilities in Ivanti products<\/strong><\/h4>\nSeveral vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\nOne of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\nAffiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n
Changing hacktivist landscape<\/strong><\/h4>\nAssessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n
Ransomware trends and statistics<\/strong><\/h4>\nRansomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n
Threat data highlights<\/strong><\/h4>\nOverview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n
Download report<\/strong><\/a><\/p>\nIn case you missed it<\/h2>\nShare your ideas with us<\/strong><\/h3>\nOur purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nSecurity Events now includes Collaboration Protection events<\/strong><\/h4>\nInformation on the number of malicious URLs and attachments discovered by Collaboration Protection was added to Security Event details of the Collaboration Protection Email Scan Event.<\/p>\n
The \u201cOther Elements Solution view\u201d in Security Events now also contains all Collaboration Protection events.<\/p>\n
New profile based security posture<\/strong><\/h4>\nThe security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\nThe reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\nWe have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\nThis release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
Report info about all currently logged in users<\/strong><\/h4>\nYou can now search for all devices that a user has logged on to.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nWe also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\nElements Collaboration Protection<\/h2>\nAutomatic protection for new Teams channels<\/strong><\/h4>\nThe \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n
Elements Vulnerability Management<\/h2>\nEVM System Scan<\/strong><\/h3>\nThe following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n
\n- CVeritas InfoScale Operations Manager (VIOM)<\/li>\n
- Cisco Duo Authentication Proxy<\/li>\n
- IBM Aspera Cargo<\/li>\n
- IBM Aspera Connect<\/li>\n
- WireGuard client<\/li>\n
- Duo Authentication<\/li>\n
- Cisco Duo Device Health Application<\/li>\n
- IBM SPSS Statistics<\/li>\n
- Citrix ShareFile Storage Zones Controller<\/li>\n
- Dell Wyse Management Suite<\/li>\n
- Mattermost Desktop<\/li>\n
- Acronis Cyber Backup<\/li>\n
- Acronis Cyber Protect<\/li>\n
- Automox Agent<\/li>\n
- Kofax Power PDF<\/li>\n<\/ul>\n
Elements Vulnerability Management Portal<\/strong><\/h3>\nClarified usage calculation explanation<\/strong><\/h4>\nThe usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n<\/img><\/a><\/figure>\nIntegrations<\/h2>\nElements API: cookbook and new filter for incidents<\/strong><\/h3>\nElements API Cookbook<\/strong><\/h4>\nTo help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\nChanges in the Incident endpoint<\/strong><\/h4>\nNew filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\nNew fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\nNew endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\nEndpoint Protection API is deprecated<\/strong><\/h3>\nWe kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n
– infections<\/p>\n
– security events<\/p>\n
– companies<\/p>\n
– computers<\/p>\n
The following endpoints are deprecated and soon end of life<\/p>\n
Invitations: End of Life : 3rd of November, 2023<\/p>\n
Subscriptions: End of Life: 11th of March, 2024<\/p>\n
WithSecure Elements Connector<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nCorresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\nOther items of interest<\/h2>\nMonthly Threat Highlights Report: August 2023<\/strong><\/h3>\nNew vulnerabilities in Ivanti products<\/strong><\/h4>\nSeveral vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\nOne of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\nAffiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n
Changing hacktivist landscape<\/strong><\/h4>\nAssessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n
Ransomware trends and statistics<\/strong><\/h4>\nRansomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n
Threat data highlights<\/strong><\/h4>\nOverview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n
Download report<\/strong><\/a><\/p>\nIn case you missed it<\/h2>\nShare your ideas with us<\/strong><\/h3>\nOur purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
The security posture now shows if the “User can tun off real-time scanning on the client as the setting is unlocked in the profile”.<\/p>\n The reason for triggering a profile assignment for a device are now visible in the device details operations table.<\/p>\n We have now added buttons for moving graphs to first and last places in the custom reports view. This can help administrators prioritize the information displayed, to suit their own needs.<\/p>\n This release makes the Elements Agent version 23.6 available (internal version 23.6.394).<\/p>\n The endpoints automatically upgrade, without a reboot.<\/p>\n You can now search for all devices that a user has logged on to.<\/p>\n We also report all recently logged in users so you can find devices where user was logged in recently.<\/p>\n We recently released some changes to the EDR Broad Context Detection views. You can find more information on this change in a separate article<\/a>.<\/p>\n The \u201cAutomatically protect newly-added assets\u201d setting for SharePoint tool is now covering onboarding of the newly-added Teams channels. If this setting is turned off, you need to manually select the asset that needs to be protected. Note, that after the new release the existing Teams channels would not be protected automatically, only the newly-added.<\/p>\n The following products were added to the detection component of the EVM Authenticated System Scan for Windows <\/p>\n The usage calculation was improved in the Subscription details section of the Settings page to address the inclusion of deleted scanned targets. The calculation considers deleted scanned targets to ensure accurate tracking.<\/p>\n To help our customers integrate with Elements API we created the\u00a0Elements API Cookbook<\/a>. It contains recipes with descriptions of common use cases and example solutions implemented as Python procedures.<\/p>\n New filters\u00a0<\/strong>: risk level, updatedTimestampStart\u00a0&\u00a0updatedTimestampEnd\u00a0to enhance incidents and detections polling as filtering by\u00a0updatedTimestamp\u00a0helps getting recent updates (seeCookbook – poll detections<\/a>).<\/p>\n New fields<\/strong>: RiskScore (number representing the incident’s risk) and categories (for example\u00a0CREDENTIAL_THEFT)<\/em><\/p>\n New endpoint to Add comment to an incident<\/strong>: This allows the addition of a ticket number or an explanation about the incident as a comment in the incident’s details view in Element Security Center.<\/p>\n We kindly remind you that the following endpoints have reached their end of life and should not be used anymore:<\/p>\n – infections<\/p>\n – security events<\/p>\n – companies<\/p>\n – computers<\/p>\n The following endpoints are deprecated and soon end of life<\/p>\n Invitations: End of Life : 3rd of November, 2023<\/p>\n Subscriptions: End of Life: 11th of March, 2024<\/p>\n In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n Corresponding warning is also shown in the Connector device view:<\/p>\n In order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the userguide<\/a>.<\/p>\n Several vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron, that have been identified and exploited by a highly sophisticated threat actor. These vulnerabilities include CVE-2023-35078 and CVE-2023-35081, which allow for arbitrary unauthenticated file writes and can be used to upload and execute files and deploy web shells.<\/p>\n One of two vulnerabilities in WinRAR is already being actively exploited, and the other is likely to be weaponized due to the prevalence of WinRAR.<\/p>\n Affiliate campaign that installs a malicious “Digital Pulse” proxy, which can be used to intercept and modify web traffic.<\/p>\n Assessment of the changing hacktivist landscape, including the emergence of new groups and the tactics they are using.<\/p>\n Ransomware landscape, including statistics from known attacks, and highlights newcomers “Cloak”, “Metaencryptor”, and “Ransomed”.<\/p>\n Overview of vulnerabilities that have been heavily discussed on social media, as well as VirusTotal trends and other threat data highlights.<\/p>\n Download report<\/strong><\/a><\/p>\n Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nExplanation of what caused a profile assignment shown in device details<\/strong><\/h4>\n
<\/img><\/a><\/figure>\nPossibility to organize graphs added to Custom Reports view<\/strong><\/h4>\n
<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\n
Elements Agent for Windows and Server – Version 23.6<\/strong><\/h3>\n
Report info about all currently logged in users<\/strong><\/h4>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nRollback feature sends alert when user restores Rollbacked files<\/strong><\/h4>\n
<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
Elements Collaboration Protection<\/h2>\n
Automatic protection for new Teams channels<\/strong><\/h4>\n
Elements Vulnerability Management<\/h2>\n
EVM System Scan<\/strong><\/h3>\n
\n
Elements Vulnerability Management Portal<\/strong><\/h3>\n
Clarified usage calculation explanation<\/strong><\/h4>\n
<\/img><\/a><\/figure>\nIntegrations<\/h2>\n
Elements API: cookbook and new filter for incidents<\/strong><\/h3>\n
Elements API Cookbook<\/strong><\/h4>\n
Changes in the Incident endpoint<\/strong><\/h4>\n
Endpoint Protection API is deprecated<\/strong><\/h3>\n
WithSecure Elements Connector<\/h3>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nOther items of interest<\/h2>\n
Monthly Threat Highlights Report: August 2023<\/strong><\/h3>\n
New vulnerabilities in Ivanti products<\/strong><\/h4>\n
Exploitation of WinRAR vulnerabilities<\/strong><\/h4>\n
Affiliate campaign installing a malicious “Digital Pulse” proxy<\/strong><\/h4>\n
Changing hacktivist landscape<\/strong><\/h4>\n
Ransomware trends and statistics<\/strong><\/h4>\n
Threat data highlights<\/strong><\/h4>\n
In case you missed it<\/h2>\n
Share your ideas with us<\/strong><\/h3>\n
<\/img><\/a><\/figure>\nFurther information<\/h2>\n