{"id":6850,"date":"2023-10-03T10:55:17","date_gmt":"2023-10-03T07:55:17","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&p=6850"},"modified":"2026-10-19T13:06:43","modified_gmt":"2026-10-19T10:06:43","slug":"network-addresses-for-withsecure-elements-cloud-managed-products","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/en\/announcements\/network-addresses-for-withsecure-elements-cloud-managed-products\/","title":{"rendered":"Network addresses for WithSecure Elements (cloud-managed products)"},"content":{"rendered":"

Update:<\/strong> accessory.radar-prd.fsapi.com replaced with cve.accessory.elements.withsecure.com<\/p>\n

Update:<\/strong> Removed information on SPI servers, as these are no longer in use. See this article<\/a> for the reason why. <\/p>\n

Update:<\/strong> Removed all F-Secure.com addresses. These are no longer available, and all customers and partners should use the new addresses.<\/p>\n

For most customers, WithSecure Elements products will function correctly without needing to know which servers the products connect to.<\/p>\n

However, some administrators tightly control which network addresses they allow their clients to connect to (\u201cEgress control\u201d or \u201coutbound connections\u201d), and it is mandatory<\/strong> that they allow connections to the following addresses. WithSecure cannot guarantee the functionality of the products if access to these addresses is blocked.<\/p>\n

The product may not function correctly if access to these network addresses is not allowed.<\/strong><\/p>\n

Please note that all the following require outbound connections to TCP\/443 unless otherwise stated.<\/p>\n

Recommendations<\/strong><\/h2>\n

WithSecure recommends, where possible, that administrators allow outbound access to all address under the withsecure.com and fsapi.com domains. We do appreciate that this is not always possible due to firewall configuration limitations, or even from an operational perspective, so we are publishing an explicit list of server addresses.<\/p>\n

In addition, there are some addresses from other domains (such as amazonaws.com), and these should be explicitly added as individual addresses, and never added as a wildcard firewall entry<\/p>\n

Please note that we do not guarantee<\/strong> this list of addresses is complete or will stay unchanged, so we strongly recommend bookmarking these articles for future reference. We will update these articles whenever needed.<\/p>\n

WithSecure Elements endpoint agents will be updated automatically, but administrators should prepare for this in advance by ensuring endpoints can reach the following addresses.<\/p>\n

Important notes<\/strong><\/h2>\n

Some service addresses are specific to geographical regions<\/h3>\n

For example, some servers are dedicated to customers in EMEA <\/strong>(Europe, Middle East, Africa), AMER<\/strong> (the Americas), and APAC<\/strong> (Asia Pacific). We indicate these where relevant, and administrators only need to grant access to the ones relevant to their installations.<\/p>\n

WithSecure Elements<\/strong><\/h2>\n

Remote fsdiag upload server<\/strong><\/p>\n

    \n
  • ane1-fsdiag-upload.s3.ap-northeast-1.amazonaws.com (APAC<\/strong>)<\/li>\n
  • ew1-fsdiag-upload.s3.eu-west-1.amazonaws.com (EMEA<\/strong>)<\/li>\n
  • ue1-fsdiag-upload.s3.amazonaws.com (AMER<\/strong>)<\/li>\n<\/ul>\n

    WithSecure COSMOS Server<\/strong><\/p>\n

      \n
    • client-api.public.prod.ew1.cosmos-prd.fsapi.com (EMEA<\/strong>)<\/li>\n
    • client-api.public.prod.ue1.cosmos-prd.fsapi.com (AMER<\/strong>)<\/li>\n
    • client-api.public.prod.ane1.cosmos-prd.fsapi.com (APAC<\/strong>)<\/li>\n
    • api.prd.ew1.cosmos-prd.fsapi.com (EMEA<\/strong>)<\/li>\n
    • api.prd.ue1.cosmos-prd.fsapi.com (AMER<\/strong>)<\/li>\n
    • api.prd.ane1.cosmos-prd.fsapi.com (APAC<\/strong>)<\/li>\n<\/ul>\n

      WithSecure Doorman server<\/strong><\/p>\n

        \n
      • psb-emea.doorman.fsapi.com (EMEA<\/strong>)<\/li>\n
      • psb-amer.doorman.fsapi.com (AMER<\/strong>)<\/li>\n
      • psb-apac.doorman.fsapi.com (APAC<\/strong>)<\/li>\n
      • baseguard.doorman.fsapi.com<\/li>\n
      • api.doorman.fsapi.com<\/li>\n
      • api.prd.glb.doorman.fsapi.com<\/li>\n
      • api.prd.ew1.doorman.fsapi.com<\/li>\n<\/ul>\n

        WithSecure Entitlements server<\/strong><\/p>\n

          \n
        • provisioning.ew1.entitlements.fsapi.com (EMEA<\/strong>)<\/li>\n
        • provisioning.ue1.entitlements.fsapi.com (AMER<\/strong>)<\/li>\n
        • provisioning.ane1.entitlements.fsapi.com (APAC<\/strong>)<\/li>\n
        • provisioning.global.entitlements.fsapi.com<\/li>\n<\/ul>\n

          WithSecure Download Servers<\/strong><\/p>\n

            \n
          • download.fsapi.com<\/li>\n<\/ul>\n

            WithSecure EDR response servers<\/strong><\/p>\n

              \n
            • ac3ujg1ortm4c-ats.iot.eu-west-1.amazonaws.com (also TCP\/8883) (EMEA<\/strong>)<\/li>\n
            • ac3ujg1ortm4c-ats.iot.us-east-1.amazonaws.com (also TCP\/8883) (AMER<\/strong>)<\/li>\n
            • ac3ujg1ortm4c-ats.iot.ap-northeast-1.amazonaws.com (also TCP\/8883) (APAC<\/strong>)<\/li>\n<\/ul>\n
                \n
              • c3hquxgihnj763.credentials.iot.eu-west-1.amazonaws.com (EMEA<\/strong>)<\/li>\n
              • c3hquxgihnj763.credentials.iot.us-east-1.amazonaws.com (AMER<\/strong>)<\/li>\n
              • c3hquxgihnj763.credentials.iot.ap-northeast-1.amazonaws.com (APAC<\/strong>)<\/li>\n<\/ul>\n
                  \n
                • ew1-famp-prd-system-transfer.s3.eu-west-1.amazonaws.com\u00a0(EMEA<\/strong>)<\/li>\n
                • ue1-famp-prd-system-transfer.s3.us-east-1.amazonaws.com\u00a0(AMER<\/strong>)<\/li>\n
                • ane1-famp-prd-system-transfer.s3.ap-northeast-1.amazonaws.com\u00a0(APAC<\/strong>)<\/li>\n<\/ul>\n
                    \n
                  • agent-api.ew1.famp.fsapi.com (EMEA<\/strong>)<\/li>\n
                  • agent-api.ue1.famp.fsapi.com (AMER<\/strong>)<\/li>\n
                  • agent-api.ane1.famp.fsapi.com (APAC<\/strong>)<\/li>\n<\/ul>\n

                    WithSecure GUTS2 Server<\/strong><\/p>\n

                      \n
                    • guts2.fsapi.com (also TCP\/80)<\/li>\n<\/ul>\n

                      WithSecure KARMA Server<\/strong><\/p>\n

                        \n
                      • a.karma.sc2.fsapi.com<\/li>\n<\/ul>\n

                        WithSecure Mind Server<\/strong><\/p>\n

                          \n
                        • restmc.mind.sc2.fsapi.com<\/li>\n<\/ul>\n

                          WithSecure Push Poll Server<\/strong><\/p>\n

                            \n
                          • poll.push.fsapi.com (EMEA<\/strong>)<\/li>\n
                          • poll.push-na.fsapi.com (AMER<\/strong>)<\/li>\n
                          • poll.push-apac.fsapi.com (APAC<\/strong>)<\/li>\n<\/ul>\n

                            Push Register Server<\/strong><\/p>\n

                              \n
                            • registrar.push.fsapi.com (EMEA<\/strong>)<\/li>\n
                            • registrar.push-na.fsapi.com (AMER<\/strong>)<\/li>\n
                            • registrar.push-apac.fsapi.com (APAC<\/strong>)<\/li>\n<\/ul>\n

                              WithSecure DIS Server<\/strong><\/p>\n

                                \n
                              • api.disobus.fsapi.com<\/li>\n<\/ul>\n

                                Update Service<\/strong><\/p>\n

                                  \n
                                • api.prd.glb.us-prd.fsapi.com<\/li>\n<\/ul>\n

                                  CCR Service<\/strong><\/p>\n

                                    \n
                                  • 692.psb.prd.gw.fsapi.com (APAC<\/strong>)<\/li>\n
                                  • apac.psb.prd.gw.fsapi.com (APAC<\/strong>)<\/li>\n
                                  • 691.psb.prd.gw.fsapi.com (EMEA<\/strong>)<\/li>\n
                                  • 6910.psb.prd.gw.fsapi.com (EMEA<\/strong>)<\/li>\n
                                  • 694.psb.prd.gw.fsapi.com (EMEA<\/strong>)<\/li>\n
                                  • emea.psb.prd.gw.fsapi.com (EMEA<\/strong>)<\/li>\n
                                  • emea2.psb.prd.gw.fsapi.com (EMEA<\/strong>)<\/li>\n
                                  • emea3.psb.prd.gw.fsapi.com (EMEA<\/strong>)<\/li>\n
                                  • 710.psb.prd.gw.fsapi.com (AMER<\/strong>)<\/li>\n
                                  • amer.psb.prd.gw.fsapi.com (AMER<\/strong>)<\/li>\n<\/ul>\n

                                    WithSecure Elements Vulnerability Management<\/h2>\n

                                    If you are using WithSecure Elements Vulnerability Management, you additionally need to grant access to the following services<\/p>\n

                                    After the change<\/h3>\n

                                    api.radar-prd.fsapi.com<\/strong><\/p>\n

                                      \n
                                    • This is the main address of the Elements VM REST API, that is used by customers and Scan Nodes.<\/li>\n
                                    • NOTE: <\/strong>Any customer or partner integrations will need to change to this address to avoid loss of functionality. This change can already be made, the new DNS name is already functional and working as a direct replacement.<\/li>\n<\/ul>\n

                                      sn-api.radar-prd.fsapi.com<\/strong><\/p>\n

                                        \n
                                      • Radar Update Service address, used to manage Scan Nodes and deliver product and engines updates to them.\t<\/li>\n<\/ul>\n

                                        updates-api.radar-prd.fsapi.com<\/strong><\/p>\n

                                          \n
                                        • Secondary Radar Update Service address used to manage all VM Portals, publish vulnerability coverage and serve some smaller use cases.<\/li>\n<\/ul>\n

                                          cve.accessory.elements.withsecure.com<\/strong><\/p>\n

                                            \n
                                          • Callback service used by scanning engines to verify remote code execution vulnerabilities.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

                                            Update: accessory.radar-prd.fsapi.com replaced with cve.accessory.elements.withsecure.com Update: Removed information on SPI servers, as these are no longer in use. See this article for the reason why. Update: Removed all F-Secure.com addresses.…<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-6850","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"d84c1e8620ae18bfedafa4f66d179d747d54b2fd","vanilla_article_id":31217,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/31217-network-addresses-for-withsecure-elements-cloud-managed-products","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/6850","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/6850\/revisions"}],"predecessor-version":[{"id":8211,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/6850\/revisions\/8211"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=6850"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement_category?post=6850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}