Added filter by a device OS type for Security events<\/strong><\/h4>\n![\"Picture1.jpg\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-3.jpg.webp\")
<\/img><\/a><\/figure>\nAdded filter by Active Directory Organzational Unit for Security events<\/strong><\/h4>\n![\"Picture2.jpg\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture2-3.jpg.webp\")
<\/img><\/a><\/figure>\nUnprotected devices that have previously had WithSecure EPP client installed<\/strong><\/h4>\nIf these devices have been explicitly deactivated by the administrator, they are now considered protected, so\u00a0that they will not appear in Unprotected devices listing.<\/p>\n
Email reports view has been added<\/strong><\/h4>\n![\"Picture3.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture3-14.png.webp\")
<\/img><\/a><\/figure>\nDevices Status report now has an info flyout<\/strong><\/h4>\n![\"Picture4.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-14.png.webp\")
<\/img><\/a><\/figure>\nSimilar events feature<\/strong><\/h4>\nWe have added a feature intended to help security administrators look at the whole picture and acknowledge multiple events at once. In the action menu there’s a new item “Show similar”, which opens the flyout with all the similar events. The Info icon near the title will show why do we think that these events are similar. The filters are copied from the main view, and you can adjust them to narrow your search further or to limit amount of events shown. On the bottom of the view there’s “Acknowledge all” button, which sends the acknowledgement request for all events currently visible in the view. Please note that acknowledging many events might be time consuming and won’t appear in the portal right away. There’s also an upper limit of 10000 events to be acknowledged simultaneously.<\/p>\n
Please note:<\/strong><\/p>\n\n- Read-only users can’t acknowledge events even with “acknowledge all” feature.<\/li>\n
- Available only for events starting from the 1st of Sep 2023. The action is not present for older events.<\/li>\n<\/ul>\n
![\"Picture5.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-15.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture6.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-13.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture7.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-12.png.webp\")
<\/img><\/a><\/figure>\nmacOS 14 Sonoma notifications<\/strong><\/h4>\nApple has released the next major operating system version\u00a0 14 (Sonoma) ahead of schedule, and our agent is not yet compatible with it<\/a>. We have now two new issues in the EPP dashboard advising not to upgrade yet and showing which devices have already upgraded to the new OS version.<\/p>\n![\"Picture8.jpg\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8.jpg.webp\")
<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows workstation and server: version 23.7<\/strong><\/h3>\nA new version of the endpoint clients is available.<\/p>\n
This release makes the Elements Agent version 23.7 available (internal version 23.7.416).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
New away option in automated tasks.<\/strong><\/h4>\nThe \u201caway\u201d option allows to run automated task after user has been away for defined number of minutes. Example \u201c@away 5\u201d would run task after user have been away for 5 minutes.<\/p>\n![\"Picture9.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-12.png.webp\")
<\/img><\/a><\/figure>\nNew automated task to create restore point.<\/strong><\/h4>\nThere is new automated task which allows to create system restore point in the client.<\/p>\n![\"Picture10.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-9.png.webp\")
<\/img><\/a><\/figure>\nImprovements how windows operating system version is reported.<\/strong><\/h4>\nThe client now sends also windows build number and build number is visible in the device details.<\/p>\n![\"Picture11.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture11-10.png.webp\")
<\/img><\/a><\/figure>\nRemote action to turn off application control.<\/strong><\/h4>\nThere is new remote action to turn off application control.<\/p>\n![\"Picture12.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture12-7.png.webp\")
<\/img><\/a><\/figure>\nImproved security events to contain information also about quarantined registry entries.<\/strong><\/h4>\nIf rollback did happen and restored registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.<\/p>\n![\"Picture13.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture13-6.png.webp\")
<\/img><\/a><\/figure>\nSecurity scanning exclusions improvements<\/strong><\/h4>\nIt is now possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. <\/p>\n![\"Picture14.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture14-6.png.webp\")
<\/img><\/a><\/figure>\nRunning automated task from client user interface<\/strong><\/h4>\nIt is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately.<\/p>\n![\"Picture15.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture15-5.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture16.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture16-4.png.webp\")
<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\nNew Automated Actions view<\/h3>\n
WithSecure Elements EDR has released a new view called ‘Automated actions’.<\/p>\n
This replaces the old ‘Automated response’ view.<\/p>\n![\"Picture17.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture17-6.png.webp\")
<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe functionality stays the same and you can still configure \u2018Device isolation\u2019 rules that run 24\/7 and specify the risk level, like with the original ‘Automated response’ view, however you can now create an action rule with\u00a0\u2018custom\u2019 scheduling\u00a0<\/strong>where you can input specific hours for when you want a rule to run, for example, outside of office hours.<\/p>\n![\"Picture17.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture17-7.png.webp\")
<\/img><\/a><\/figure>\nThe new ‘Automated actions’ view\u00a0includes all existing Device Isolation rules<\/strong>, so there is no need to worry about having to re-create them.<\/p>\nIt includes the new ‘custom’ scheduling, so\u00a0specific days and times can be applied\u00a0<\/strong>for when you want the rules to run, for example, from 17:00 until 09:00 the next morning.<\/p>\n![\"Picture18.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture18-3.png.webp\")
<\/img><\/a><\/figure>\nLastly, the existing ‘Automated response’ view is still available for the next two weeks, in\u00a0read-only mode<\/strong>, so you have time to get used to the new view.<\/p>\nWhy?<\/strong><\/h4>\nNot only does this new feature provide custom scheduling but it also starts to build towards our vision to include more automated actions within Elements \u2013 initially, with the co-monitoring service and the new email notifications with risk level selection, but also for more response actions in the future.<\/p>\n
This new Automated Actions view is now available to use in Elements.<\/p>\n
New Broad Context Detection details view<\/h3>\n
The new Broad Context Detection (BCD) details view has been fully released into production and is now the default view, replacing the old Broad Context Detection details view.<\/p>\n![\"Picture20.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture20-2.png.webp\")
<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe new BCD details view has become the default view so when you click on the \u2018Broad Context Detection\u2019 menu option in Elements, you will now be presented with this new view.<\/p>\n
The old BCD details view is still available to use, for a limited time, to give you more time to familiarise yourself with the new BCD view. You can navigate to the old BCD view via the \u2018Go to old Broad Context Detection view\u2019 button in the top right corner of the page.<\/p>\n![\"Picture21.gif\"](\"https:\/\/support.withsecure.com\/wp-content\/uploads\/2026\/10\/picture21.gif\")
<\/img><\/a><\/figure>\nYou are able to elevate BCDs from within the new BCD details view, unlike before when it was in \u2018Preview\u2019 mode where you had to navigate back to the old BCD view to elevate a detection. The new view supports both manual and automatic elevations and works exactly the same as the old view.<\/p>\n
You are also able to change the default Elevation subscription token selected. The subscription expiring the soonest is selected by default, however you can now see all available subscriptions and change it to another one if you so wish.<\/p>\n![\"Picture22.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture22.png.webp\")
<\/img><\/a><\/figure>\nExtra information has been added to the new view to help you interpret the information displayed.<\/p>\n
Elements Collaboration Protection<\/h2>\nBlocking file types<\/strong><\/h4>\nThe new feature “Blocking file types” was has been enabled\u00a0for all Collaboration Protection customers.\u00a0<\/p>\n
The policy settings were expanded to allow blocking of certain file types. Administrators can select the file types to be disallowed within the protected ecosystem, from a list curated by our security experts. The system will handle all files of the selected file types as harmful and act according to a tool specific policy setting. The feature does not rely on the file extension but leverages intelligent file type recognition.<\/p>\n![\"Picture23.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture23-1.png.webp\")
<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\nDynamic Assets Risk Score has been enabled.<\/strong><\/h3>\nThe Static Asset Risk Score was calculated based only on the CVSS base score, with an additional boost for old and\/or exploitable vulnerabilities, enhanced with the asset importance mark and internet exposure flag.<\/p>\n
Here are the improvements introduced in the second version of Asset Risk Score, that is called “Dynamic Risk Score” with different boost factors:<\/p>\n
The score is slightly (from -10% up to +60%), corrected with EPSS (exploit prediction) score together, when there are no signs of exploitation<\/p>\n
\n- It is boosted between 20-70% when there is an exploit. The boost depends on our knowledge about the maturity of the exploit or observation of incidents related to the vulnerability.<\/li>\n
- It is boosted according to the number and age of cyber security reports describing the vulnerability<\/li>\n
- With other impacting factors such as:\n
\n- Taking into account a few most severe vulnerabilities, as opposed to static risk score that only took the first top one.<\/li>\n
- Taking into account the asset importance that is set by the customer.<\/li>\n
- Taking into account the visibility of the asset from public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Elements Vulnerability Management: System Scan<\/strong><\/h3>\nThe Elements Vulnerability Management System Scan was updated to detect vulnerabilities in the following products as part of authenticated scanning for Windows:<\/p>\n
\n- Siemens JT2Go<\/li>\n
- QNAP QVR Pro Client<\/li>\n<\/ul>\n
In addition, a non-version based detector was added for the VMWare Aria Operations For Networks remote code execution vulnerability (CVE-2023-34039)<\/p>\n
Elements VM Scan Node Agent: Linux<\/strong><\/h3>\nA new version of the Linux Scan Node Agent was released, fixing several known issues and also adding registration towards the Elements Vulnerability Management system.<\/p>\n
Integrations<\/h2>\nEndpoint Protection API: Subscriptions endpoints end of life on 11th of March 2024<\/h3>\n
The old\u00a0subscriptions endpoints<\/a>\u00a0are deprecated and should be replaced by the\u00a0subscription endpoints in the Provisioning API<\/a>. To use this API, you need to\u00a0request Read-only Provisioning API credentials<\/strong>\u00a0from WithSecure Support. Access to Provisioning API is only for partner (SOP) accounts.<\/p>\nThe following Endpoint Protection API subscriptions endpoints will stop working on the 11.03.2024:<\/p>\n
\n- Get company subscription details<\/li>\n
- Get partner subscription details<\/li>\n
- List company subscriptions<\/li>\n
- List partner subscriptions<\/li>\n
- Remove computers from subscription (replaced by Elements API endpoints \u201cUpdate device state<\/a>\u201d or \u201cDelete device<\/a>\u201d)<\/li>\n<\/ul>\n
REMINDER: Elements Connector: Customers still using the (End of Life) Endpoint Protection API to login need to change API authentication credentials<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
The Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n![\"Picture24.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture24-1.png.webp\")
<\/img><\/a><\/figure>\nA Corresponding warning is also shown in the Connector device view:<\/p>\n![\"Picture25.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture25-1.png.webp\")
<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the\u00a0userguide<\/a>.<\/p>\nIn case you missed it<\/h2>\nReminder: WithSecure products and macOS 14 \u201cSonoma\u201d<\/h3>\n
As you may be aware, Apple have announced that the next version of macOS (version 14, also known as \u201cSonoma\u201d) will be released on September 26th 2023.<\/p>\n
Unfortunately, this release has introduced incompatibilities with some WithSecure products.<\/p>\n
The affected products for Mac are:<\/strong><\/p>\n\n- WithSecure Elements Endpoint Detection and Response<\/li>\n
- WithSecure Elements Endpoint Protection<\/li>\n
- WithSecure Client Security (formerly F-Secure Client Security)<\/li>\n
- WithSecure Countercept<\/li>\n<\/ul>\n
We have created a Knowledge Base article<\/a> which details the current status of our support for Sonoma. Our current advice is to NOT upgrade to Sonoma at this time, unless it is critical for your business.<\/p>\nWithSecure is working hard to address these issues and will provide updates via the Knowledge Base page.<\/p>\n
Share your ideas with us<\/h2>\n
Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n![\"Picture26.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture26-1.png.webp\")
<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nAdded filter by Active Directory Organzational Unit for Security events<\/strong><\/h4>\n<\/img><\/a><\/figure>\nUnprotected devices that have previously had WithSecure EPP client installed<\/strong><\/h4>\nIf these devices have been explicitly deactivated by the administrator, they are now considered protected, so\u00a0that they will not appear in Unprotected devices listing.<\/p>\n
Email reports view has been added<\/strong><\/h4>\n<\/img><\/a><\/figure>\nDevices Status report now has an info flyout<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSimilar events feature<\/strong><\/h4>\nWe have added a feature intended to help security administrators look at the whole picture and acknowledge multiple events at once. In the action menu there’s a new item “Show similar”, which opens the flyout with all the similar events. The Info icon near the title will show why do we think that these events are similar. The filters are copied from the main view, and you can adjust them to narrow your search further or to limit amount of events shown. On the bottom of the view there’s “Acknowledge all” button, which sends the acknowledgement request for all events currently visible in the view. Please note that acknowledging many events might be time consuming and won’t appear in the portal right away. There’s also an upper limit of 10000 events to be acknowledged simultaneously.<\/p>\n
Please note:<\/strong><\/p>\n\n- Read-only users can’t acknowledge events even with “acknowledge all” feature.<\/li>\n
- Available only for events starting from the 1st of Sep 2023. The action is not present for older events.<\/li>\n<\/ul>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nmacOS 14 Sonoma notifications<\/strong><\/h4>\nApple has released the next major operating system version\u00a0 14 (Sonoma) ahead of schedule, and our agent is not yet compatible with it<\/a>. We have now two new issues in the EPP dashboard advising not to upgrade yet and showing which devices have already upgraded to the new OS version.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows workstation and server: version 23.7<\/strong><\/h3>\nA new version of the endpoint clients is available.<\/p>\n
This release makes the Elements Agent version 23.7 available (internal version 23.7.416).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
New away option in automated tasks.<\/strong><\/h4>\nThe \u201caway\u201d option allows to run automated task after user has been away for defined number of minutes. Example \u201c@away 5\u201d would run task after user have been away for 5 minutes.<\/p>\n<\/img><\/a><\/figure>\nNew automated task to create restore point.<\/strong><\/h4>\nThere is new automated task which allows to create system restore point in the client.<\/p>\n<\/img><\/a><\/figure>\nImprovements how windows operating system version is reported.<\/strong><\/h4>\nThe client now sends also windows build number and build number is visible in the device details.<\/p>\n<\/img><\/a><\/figure>\nRemote action to turn off application control.<\/strong><\/h4>\nThere is new remote action to turn off application control.<\/p>\n<\/img><\/a><\/figure>\nImproved security events to contain information also about quarantined registry entries.<\/strong><\/h4>\nIf rollback did happen and restored registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.<\/p>\n<\/img><\/a><\/figure>\nSecurity scanning exclusions improvements<\/strong><\/h4>\nIt is now possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. <\/p>\n<\/img><\/a><\/figure>\nRunning automated task from client user interface<\/strong><\/h4>\nIt is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\nNew Automated Actions view<\/h3>\n
WithSecure Elements EDR has released a new view called ‘Automated actions’.<\/p>\n
This replaces the old ‘Automated response’ view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe functionality stays the same and you can still configure \u2018Device isolation\u2019 rules that run 24\/7 and specify the risk level, like with the original ‘Automated response’ view, however you can now create an action rule with\u00a0\u2018custom\u2019 scheduling\u00a0<\/strong>where you can input specific hours for when you want a rule to run, for example, outside of office hours.<\/p>\n<\/img><\/a><\/figure>\nThe new ‘Automated actions’ view\u00a0includes all existing Device Isolation rules<\/strong>, so there is no need to worry about having to re-create them.<\/p>\nIt includes the new ‘custom’ scheduling, so\u00a0specific days and times can be applied\u00a0<\/strong>for when you want the rules to run, for example, from 17:00 until 09:00 the next morning.<\/p>\n<\/img><\/a><\/figure>\nLastly, the existing ‘Automated response’ view is still available for the next two weeks, in\u00a0read-only mode<\/strong>, so you have time to get used to the new view.<\/p>\nWhy?<\/strong><\/h4>\nNot only does this new feature provide custom scheduling but it also starts to build towards our vision to include more automated actions within Elements \u2013 initially, with the co-monitoring service and the new email notifications with risk level selection, but also for more response actions in the future.<\/p>\n
This new Automated Actions view is now available to use in Elements.<\/p>\n
New Broad Context Detection details view<\/h3>\n
The new Broad Context Detection (BCD) details view has been fully released into production and is now the default view, replacing the old Broad Context Detection details view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe new BCD details view has become the default view so when you click on the \u2018Broad Context Detection\u2019 menu option in Elements, you will now be presented with this new view.<\/p>\n
The old BCD details view is still available to use, for a limited time, to give you more time to familiarise yourself with the new BCD view. You can navigate to the old BCD view via the \u2018Go to old Broad Context Detection view\u2019 button in the top right corner of the page.<\/p>\n<\/img><\/a><\/figure>\nYou are able to elevate BCDs from within the new BCD details view, unlike before when it was in \u2018Preview\u2019 mode where you had to navigate back to the old BCD view to elevate a detection. The new view supports both manual and automatic elevations and works exactly the same as the old view.<\/p>\n
You are also able to change the default Elevation subscription token selected. The subscription expiring the soonest is selected by default, however you can now see all available subscriptions and change it to another one if you so wish.<\/p>\n<\/img><\/a><\/figure>\nExtra information has been added to the new view to help you interpret the information displayed.<\/p>\n
Elements Collaboration Protection<\/h2>\nBlocking file types<\/strong><\/h4>\nThe new feature “Blocking file types” was has been enabled\u00a0for all Collaboration Protection customers.\u00a0<\/p>\n
The policy settings were expanded to allow blocking of certain file types. Administrators can select the file types to be disallowed within the protected ecosystem, from a list curated by our security experts. The system will handle all files of the selected file types as harmful and act according to a tool specific policy setting. The feature does not rely on the file extension but leverages intelligent file type recognition.<\/p>\n<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\nDynamic Assets Risk Score has been enabled.<\/strong><\/h3>\nThe Static Asset Risk Score was calculated based only on the CVSS base score, with an additional boost for old and\/or exploitable vulnerabilities, enhanced with the asset importance mark and internet exposure flag.<\/p>\n
Here are the improvements introduced in the second version of Asset Risk Score, that is called “Dynamic Risk Score” with different boost factors:<\/p>\n
The score is slightly (from -10% up to +60%), corrected with EPSS (exploit prediction) score together, when there are no signs of exploitation<\/p>\n
\n- It is boosted between 20-70% when there is an exploit. The boost depends on our knowledge about the maturity of the exploit or observation of incidents related to the vulnerability.<\/li>\n
- It is boosted according to the number and age of cyber security reports describing the vulnerability<\/li>\n
- With other impacting factors such as:\n
\n- Taking into account a few most severe vulnerabilities, as opposed to static risk score that only took the first top one.<\/li>\n
- Taking into account the asset importance that is set by the customer.<\/li>\n
- Taking into account the visibility of the asset from public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Elements Vulnerability Management: System Scan<\/strong><\/h3>\nThe Elements Vulnerability Management System Scan was updated to detect vulnerabilities in the following products as part of authenticated scanning for Windows:<\/p>\n
\n- Siemens JT2Go<\/li>\n
- QNAP QVR Pro Client<\/li>\n<\/ul>\n
In addition, a non-version based detector was added for the VMWare Aria Operations For Networks remote code execution vulnerability (CVE-2023-34039)<\/p>\n
Elements VM Scan Node Agent: Linux<\/strong><\/h3>\nA new version of the Linux Scan Node Agent was released, fixing several known issues and also adding registration towards the Elements Vulnerability Management system.<\/p>\n
Integrations<\/h2>\nEndpoint Protection API: Subscriptions endpoints end of life on 11th of March 2024<\/h3>\n
The old\u00a0subscriptions endpoints<\/a>\u00a0are deprecated and should be replaced by the\u00a0subscription endpoints in the Provisioning API<\/a>. To use this API, you need to\u00a0request Read-only Provisioning API credentials<\/strong>\u00a0from WithSecure Support. Access to Provisioning API is only for partner (SOP) accounts.<\/p>\nThe following Endpoint Protection API subscriptions endpoints will stop working on the 11.03.2024:<\/p>\n
\n- Get company subscription details<\/li>\n
- Get partner subscription details<\/li>\n
- List company subscriptions<\/li>\n
- List partner subscriptions<\/li>\n
- Remove computers from subscription (replaced by Elements API endpoints \u201cUpdate device state<\/a>\u201d or \u201cDelete device<\/a>\u201d)<\/li>\n<\/ul>\n
REMINDER: Elements Connector: Customers still using the (End of Life) Endpoint Protection API to login need to change API authentication credentials<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
The Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nA Corresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the\u00a0userguide<\/a>.<\/p>\nIn case you missed it<\/h2>\nReminder: WithSecure products and macOS 14 \u201cSonoma\u201d<\/h3>\n
As you may be aware, Apple have announced that the next version of macOS (version 14, also known as \u201cSonoma\u201d) will be released on September 26th 2023.<\/p>\n
Unfortunately, this release has introduced incompatibilities with some WithSecure products.<\/p>\n
The affected products for Mac are:<\/strong><\/p>\n\n- WithSecure Elements Endpoint Detection and Response<\/li>\n
- WithSecure Elements Endpoint Protection<\/li>\n
- WithSecure Client Security (formerly F-Secure Client Security)<\/li>\n
- WithSecure Countercept<\/li>\n<\/ul>\n
We have created a Knowledge Base article<\/a> which details the current status of our support for Sonoma. Our current advice is to NOT upgrade to Sonoma at this time, unless it is critical for your business.<\/p>\nWithSecure is working hard to address these issues and will provide updates via the Knowledge Base page.<\/p>\n
Share your ideas with us<\/h2>\n
Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nUnprotected devices that have previously had WithSecure EPP client installed<\/strong><\/h4>\nIf these devices have been explicitly deactivated by the administrator, they are now considered protected, so\u00a0that they will not appear in Unprotected devices listing.<\/p>\n
Email reports view has been added<\/strong><\/h4>\n<\/img><\/a><\/figure>\nDevices Status report now has an info flyout<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSimilar events feature<\/strong><\/h4>\nWe have added a feature intended to help security administrators look at the whole picture and acknowledge multiple events at once. In the action menu there’s a new item “Show similar”, which opens the flyout with all the similar events. The Info icon near the title will show why do we think that these events are similar. The filters are copied from the main view, and you can adjust them to narrow your search further or to limit amount of events shown. On the bottom of the view there’s “Acknowledge all” button, which sends the acknowledgement request for all events currently visible in the view. Please note that acknowledging many events might be time consuming and won’t appear in the portal right away. There’s also an upper limit of 10000 events to be acknowledged simultaneously.<\/p>\n
Please note:<\/strong><\/p>\n\n- Read-only users can’t acknowledge events even with “acknowledge all” feature.<\/li>\n
- Available only for events starting from the 1st of Sep 2023. The action is not present for older events.<\/li>\n<\/ul>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nmacOS 14 Sonoma notifications<\/strong><\/h4>\nApple has released the next major operating system version\u00a0 14 (Sonoma) ahead of schedule, and our agent is not yet compatible with it<\/a>. We have now two new issues in the EPP dashboard advising not to upgrade yet and showing which devices have already upgraded to the new OS version.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows workstation and server: version 23.7<\/strong><\/h3>\nA new version of the endpoint clients is available.<\/p>\n
This release makes the Elements Agent version 23.7 available (internal version 23.7.416).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
New away option in automated tasks.<\/strong><\/h4>\nThe \u201caway\u201d option allows to run automated task after user has been away for defined number of minutes. Example \u201c@away 5\u201d would run task after user have been away for 5 minutes.<\/p>\n<\/img><\/a><\/figure>\nNew automated task to create restore point.<\/strong><\/h4>\nThere is new automated task which allows to create system restore point in the client.<\/p>\n<\/img><\/a><\/figure>\nImprovements how windows operating system version is reported.<\/strong><\/h4>\nThe client now sends also windows build number and build number is visible in the device details.<\/p>\n<\/img><\/a><\/figure>\nRemote action to turn off application control.<\/strong><\/h4>\nThere is new remote action to turn off application control.<\/p>\n<\/img><\/a><\/figure>\nImproved security events to contain information also about quarantined registry entries.<\/strong><\/h4>\nIf rollback did happen and restored registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.<\/p>\n<\/img><\/a><\/figure>\nSecurity scanning exclusions improvements<\/strong><\/h4>\nIt is now possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. <\/p>\n<\/img><\/a><\/figure>\nRunning automated task from client user interface<\/strong><\/h4>\nIt is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\nNew Automated Actions view<\/h3>\n
WithSecure Elements EDR has released a new view called ‘Automated actions’.<\/p>\n
This replaces the old ‘Automated response’ view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe functionality stays the same and you can still configure \u2018Device isolation\u2019 rules that run 24\/7 and specify the risk level, like with the original ‘Automated response’ view, however you can now create an action rule with\u00a0\u2018custom\u2019 scheduling\u00a0<\/strong>where you can input specific hours for when you want a rule to run, for example, outside of office hours.<\/p>\n<\/img><\/a><\/figure>\nThe new ‘Automated actions’ view\u00a0includes all existing Device Isolation rules<\/strong>, so there is no need to worry about having to re-create them.<\/p>\nIt includes the new ‘custom’ scheduling, so\u00a0specific days and times can be applied\u00a0<\/strong>for when you want the rules to run, for example, from 17:00 until 09:00 the next morning.<\/p>\n<\/img><\/a><\/figure>\nLastly, the existing ‘Automated response’ view is still available for the next two weeks, in\u00a0read-only mode<\/strong>, so you have time to get used to the new view.<\/p>\nWhy?<\/strong><\/h4>\nNot only does this new feature provide custom scheduling but it also starts to build towards our vision to include more automated actions within Elements \u2013 initially, with the co-monitoring service and the new email notifications with risk level selection, but also for more response actions in the future.<\/p>\n
This new Automated Actions view is now available to use in Elements.<\/p>\n
New Broad Context Detection details view<\/h3>\n
The new Broad Context Detection (BCD) details view has been fully released into production and is now the default view, replacing the old Broad Context Detection details view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe new BCD details view has become the default view so when you click on the \u2018Broad Context Detection\u2019 menu option in Elements, you will now be presented with this new view.<\/p>\n
The old BCD details view is still available to use, for a limited time, to give you more time to familiarise yourself with the new BCD view. You can navigate to the old BCD view via the \u2018Go to old Broad Context Detection view\u2019 button in the top right corner of the page.<\/p>\n<\/img><\/a><\/figure>\nYou are able to elevate BCDs from within the new BCD details view, unlike before when it was in \u2018Preview\u2019 mode where you had to navigate back to the old BCD view to elevate a detection. The new view supports both manual and automatic elevations and works exactly the same as the old view.<\/p>\n
You are also able to change the default Elevation subscription token selected. The subscription expiring the soonest is selected by default, however you can now see all available subscriptions and change it to another one if you so wish.<\/p>\n<\/img><\/a><\/figure>\nExtra information has been added to the new view to help you interpret the information displayed.<\/p>\n
Elements Collaboration Protection<\/h2>\nBlocking file types<\/strong><\/h4>\nThe new feature “Blocking file types” was has been enabled\u00a0for all Collaboration Protection customers.\u00a0<\/p>\n
The policy settings were expanded to allow blocking of certain file types. Administrators can select the file types to be disallowed within the protected ecosystem, from a list curated by our security experts. The system will handle all files of the selected file types as harmful and act according to a tool specific policy setting. The feature does not rely on the file extension but leverages intelligent file type recognition.<\/p>\n<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\nDynamic Assets Risk Score has been enabled.<\/strong><\/h3>\nThe Static Asset Risk Score was calculated based only on the CVSS base score, with an additional boost for old and\/or exploitable vulnerabilities, enhanced with the asset importance mark and internet exposure flag.<\/p>\n
Here are the improvements introduced in the second version of Asset Risk Score, that is called “Dynamic Risk Score” with different boost factors:<\/p>\n
The score is slightly (from -10% up to +60%), corrected with EPSS (exploit prediction) score together, when there are no signs of exploitation<\/p>\n
\n- It is boosted between 20-70% when there is an exploit. The boost depends on our knowledge about the maturity of the exploit or observation of incidents related to the vulnerability.<\/li>\n
- It is boosted according to the number and age of cyber security reports describing the vulnerability<\/li>\n
- With other impacting factors such as:\n
\n- Taking into account a few most severe vulnerabilities, as opposed to static risk score that only took the first top one.<\/li>\n
- Taking into account the asset importance that is set by the customer.<\/li>\n
- Taking into account the visibility of the asset from public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Elements Vulnerability Management: System Scan<\/strong><\/h3>\nThe Elements Vulnerability Management System Scan was updated to detect vulnerabilities in the following products as part of authenticated scanning for Windows:<\/p>\n
\n- Siemens JT2Go<\/li>\n
- QNAP QVR Pro Client<\/li>\n<\/ul>\n
In addition, a non-version based detector was added for the VMWare Aria Operations For Networks remote code execution vulnerability (CVE-2023-34039)<\/p>\n
Elements VM Scan Node Agent: Linux<\/strong><\/h3>\nA new version of the Linux Scan Node Agent was released, fixing several known issues and also adding registration towards the Elements Vulnerability Management system.<\/p>\n
Integrations<\/h2>\nEndpoint Protection API: Subscriptions endpoints end of life on 11th of March 2024<\/h3>\n
The old\u00a0subscriptions endpoints<\/a>\u00a0are deprecated and should be replaced by the\u00a0subscription endpoints in the Provisioning API<\/a>. To use this API, you need to\u00a0request Read-only Provisioning API credentials<\/strong>\u00a0from WithSecure Support. Access to Provisioning API is only for partner (SOP) accounts.<\/p>\nThe following Endpoint Protection API subscriptions endpoints will stop working on the 11.03.2024:<\/p>\n
\n- Get company subscription details<\/li>\n
- Get partner subscription details<\/li>\n
- List company subscriptions<\/li>\n
- List partner subscriptions<\/li>\n
- Remove computers from subscription (replaced by Elements API endpoints \u201cUpdate device state<\/a>\u201d or \u201cDelete device<\/a>\u201d)<\/li>\n<\/ul>\n
REMINDER: Elements Connector: Customers still using the (End of Life) Endpoint Protection API to login need to change API authentication credentials<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
The Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nA Corresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the\u00a0userguide<\/a>.<\/p>\nIn case you missed it<\/h2>\nReminder: WithSecure products and macOS 14 \u201cSonoma\u201d<\/h3>\n
As you may be aware, Apple have announced that the next version of macOS (version 14, also known as \u201cSonoma\u201d) will be released on September 26th 2023.<\/p>\n
Unfortunately, this release has introduced incompatibilities with some WithSecure products.<\/p>\n
The affected products for Mac are:<\/strong><\/p>\n\n- WithSecure Elements Endpoint Detection and Response<\/li>\n
- WithSecure Elements Endpoint Protection<\/li>\n
- WithSecure Client Security (formerly F-Secure Client Security)<\/li>\n
- WithSecure Countercept<\/li>\n<\/ul>\n
We have created a Knowledge Base article<\/a> which details the current status of our support for Sonoma. Our current advice is to NOT upgrade to Sonoma at this time, unless it is critical for your business.<\/p>\nWithSecure is working hard to address these issues and will provide updates via the Knowledge Base page.<\/p>\n
Share your ideas with us<\/h2>\n
Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nDevices Status report now has an info flyout<\/strong><\/h4>\n<\/img><\/a><\/figure>\nSimilar events feature<\/strong><\/h4>\nWe have added a feature intended to help security administrators look at the whole picture and acknowledge multiple events at once. In the action menu there’s a new item “Show similar”, which opens the flyout with all the similar events. The Info icon near the title will show why do we think that these events are similar. The filters are copied from the main view, and you can adjust them to narrow your search further or to limit amount of events shown. On the bottom of the view there’s “Acknowledge all” button, which sends the acknowledgement request for all events currently visible in the view. Please note that acknowledging many events might be time consuming and won’t appear in the portal right away. There’s also an upper limit of 10000 events to be acknowledged simultaneously.<\/p>\n
Please note:<\/strong><\/p>\n\n- Read-only users can’t acknowledge events even with “acknowledge all” feature.<\/li>\n
- Available only for events starting from the 1st of Sep 2023. The action is not present for older events.<\/li>\n<\/ul>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nmacOS 14 Sonoma notifications<\/strong><\/h4>\nApple has released the next major operating system version\u00a0 14 (Sonoma) ahead of schedule, and our agent is not yet compatible with it<\/a>. We have now two new issues in the EPP dashboard advising not to upgrade yet and showing which devices have already upgraded to the new OS version.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows workstation and server: version 23.7<\/strong><\/h3>\nA new version of the endpoint clients is available.<\/p>\n
This release makes the Elements Agent version 23.7 available (internal version 23.7.416).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
New away option in automated tasks.<\/strong><\/h4>\nThe \u201caway\u201d option allows to run automated task after user has been away for defined number of minutes. Example \u201c@away 5\u201d would run task after user have been away for 5 minutes.<\/p>\n<\/img><\/a><\/figure>\nNew automated task to create restore point.<\/strong><\/h4>\nThere is new automated task which allows to create system restore point in the client.<\/p>\n<\/img><\/a><\/figure>\nImprovements how windows operating system version is reported.<\/strong><\/h4>\nThe client now sends also windows build number and build number is visible in the device details.<\/p>\n<\/img><\/a><\/figure>\nRemote action to turn off application control.<\/strong><\/h4>\nThere is new remote action to turn off application control.<\/p>\n<\/img><\/a><\/figure>\nImproved security events to contain information also about quarantined registry entries.<\/strong><\/h4>\nIf rollback did happen and restored registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.<\/p>\n<\/img><\/a><\/figure>\nSecurity scanning exclusions improvements<\/strong><\/h4>\nIt is now possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. <\/p>\n<\/img><\/a><\/figure>\nRunning automated task from client user interface<\/strong><\/h4>\nIt is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\nNew Automated Actions view<\/h3>\n
WithSecure Elements EDR has released a new view called ‘Automated actions’.<\/p>\n
This replaces the old ‘Automated response’ view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe functionality stays the same and you can still configure \u2018Device isolation\u2019 rules that run 24\/7 and specify the risk level, like with the original ‘Automated response’ view, however you can now create an action rule with\u00a0\u2018custom\u2019 scheduling\u00a0<\/strong>where you can input specific hours for when you want a rule to run, for example, outside of office hours.<\/p>\n<\/img><\/a><\/figure>\nThe new ‘Automated actions’ view\u00a0includes all existing Device Isolation rules<\/strong>, so there is no need to worry about having to re-create them.<\/p>\nIt includes the new ‘custom’ scheduling, so\u00a0specific days and times can be applied\u00a0<\/strong>for when you want the rules to run, for example, from 17:00 until 09:00 the next morning.<\/p>\n<\/img><\/a><\/figure>\nLastly, the existing ‘Automated response’ view is still available for the next two weeks, in\u00a0read-only mode<\/strong>, so you have time to get used to the new view.<\/p>\nWhy?<\/strong><\/h4>\nNot only does this new feature provide custom scheduling but it also starts to build towards our vision to include more automated actions within Elements \u2013 initially, with the co-monitoring service and the new email notifications with risk level selection, but also for more response actions in the future.<\/p>\n
This new Automated Actions view is now available to use in Elements.<\/p>\n
New Broad Context Detection details view<\/h3>\n
The new Broad Context Detection (BCD) details view has been fully released into production and is now the default view, replacing the old Broad Context Detection details view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe new BCD details view has become the default view so when you click on the \u2018Broad Context Detection\u2019 menu option in Elements, you will now be presented with this new view.<\/p>\n
The old BCD details view is still available to use, for a limited time, to give you more time to familiarise yourself with the new BCD view. You can navigate to the old BCD view via the \u2018Go to old Broad Context Detection view\u2019 button in the top right corner of the page.<\/p>\n<\/img><\/a><\/figure>\nYou are able to elevate BCDs from within the new BCD details view, unlike before when it was in \u2018Preview\u2019 mode where you had to navigate back to the old BCD view to elevate a detection. The new view supports both manual and automatic elevations and works exactly the same as the old view.<\/p>\n
You are also able to change the default Elevation subscription token selected. The subscription expiring the soonest is selected by default, however you can now see all available subscriptions and change it to another one if you so wish.<\/p>\n<\/img><\/a><\/figure>\nExtra information has been added to the new view to help you interpret the information displayed.<\/p>\n
Elements Collaboration Protection<\/h2>\nBlocking file types<\/strong><\/h4>\nThe new feature “Blocking file types” was has been enabled\u00a0for all Collaboration Protection customers.\u00a0<\/p>\n
The policy settings were expanded to allow blocking of certain file types. Administrators can select the file types to be disallowed within the protected ecosystem, from a list curated by our security experts. The system will handle all files of the selected file types as harmful and act according to a tool specific policy setting. The feature does not rely on the file extension but leverages intelligent file type recognition.<\/p>\n<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\nDynamic Assets Risk Score has been enabled.<\/strong><\/h3>\nThe Static Asset Risk Score was calculated based only on the CVSS base score, with an additional boost for old and\/or exploitable vulnerabilities, enhanced with the asset importance mark and internet exposure flag.<\/p>\n
Here are the improvements introduced in the second version of Asset Risk Score, that is called “Dynamic Risk Score” with different boost factors:<\/p>\n
The score is slightly (from -10% up to +60%), corrected with EPSS (exploit prediction) score together, when there are no signs of exploitation<\/p>\n
\n- It is boosted between 20-70% when there is an exploit. The boost depends on our knowledge about the maturity of the exploit or observation of incidents related to the vulnerability.<\/li>\n
- It is boosted according to the number and age of cyber security reports describing the vulnerability<\/li>\n
- With other impacting factors such as:\n
\n- Taking into account a few most severe vulnerabilities, as opposed to static risk score that only took the first top one.<\/li>\n
- Taking into account the asset importance that is set by the customer.<\/li>\n
- Taking into account the visibility of the asset from public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Elements Vulnerability Management: System Scan<\/strong><\/h3>\nThe Elements Vulnerability Management System Scan was updated to detect vulnerabilities in the following products as part of authenticated scanning for Windows:<\/p>\n
\n- Siemens JT2Go<\/li>\n
- QNAP QVR Pro Client<\/li>\n<\/ul>\n
In addition, a non-version based detector was added for the VMWare Aria Operations For Networks remote code execution vulnerability (CVE-2023-34039)<\/p>\n
Elements VM Scan Node Agent: Linux<\/strong><\/h3>\nA new version of the Linux Scan Node Agent was released, fixing several known issues and also adding registration towards the Elements Vulnerability Management system.<\/p>\n
Integrations<\/h2>\nEndpoint Protection API: Subscriptions endpoints end of life on 11th of March 2024<\/h3>\n
The old\u00a0subscriptions endpoints<\/a>\u00a0are deprecated and should be replaced by the\u00a0subscription endpoints in the Provisioning API<\/a>. To use this API, you need to\u00a0request Read-only Provisioning API credentials<\/strong>\u00a0from WithSecure Support. Access to Provisioning API is only for partner (SOP) accounts.<\/p>\nThe following Endpoint Protection API subscriptions endpoints will stop working on the 11.03.2024:<\/p>\n
\n- Get company subscription details<\/li>\n
- Get partner subscription details<\/li>\n
- List company subscriptions<\/li>\n
- List partner subscriptions<\/li>\n
- Remove computers from subscription (replaced by Elements API endpoints \u201cUpdate device state<\/a>\u201d or \u201cDelete device<\/a>\u201d)<\/li>\n<\/ul>\n
REMINDER: Elements Connector: Customers still using the (End of Life) Endpoint Protection API to login need to change API authentication credentials<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
The Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nA Corresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the\u00a0userguide<\/a>.<\/p>\nIn case you missed it<\/h2>\nReminder: WithSecure products and macOS 14 \u201cSonoma\u201d<\/h3>\n
As you may be aware, Apple have announced that the next version of macOS (version 14, also known as \u201cSonoma\u201d) will be released on September 26th 2023.<\/p>\n
Unfortunately, this release has introduced incompatibilities with some WithSecure products.<\/p>\n
The affected products for Mac are:<\/strong><\/p>\n\n- WithSecure Elements Endpoint Detection and Response<\/li>\n
- WithSecure Elements Endpoint Protection<\/li>\n
- WithSecure Client Security (formerly F-Secure Client Security)<\/li>\n
- WithSecure Countercept<\/li>\n<\/ul>\n
We have created a Knowledge Base article<\/a> which details the current status of our support for Sonoma. Our current advice is to NOT upgrade to Sonoma at this time, unless it is critical for your business.<\/p>\nWithSecure is working hard to address these issues and will provide updates via the Knowledge Base page.<\/p>\n
Share your ideas with us<\/h2>\n
Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
<\/img><\/a><\/figure>\nSimilar events feature<\/strong><\/h4>\nWe have added a feature intended to help security administrators look at the whole picture and acknowledge multiple events at once. In the action menu there’s a new item “Show similar”, which opens the flyout with all the similar events. The Info icon near the title will show why do we think that these events are similar. The filters are copied from the main view, and you can adjust them to narrow your search further or to limit amount of events shown. On the bottom of the view there’s “Acknowledge all” button, which sends the acknowledgement request for all events currently visible in the view. Please note that acknowledging many events might be time consuming and won’t appear in the portal right away. There’s also an upper limit of 10000 events to be acknowledged simultaneously.<\/p>\n
Please note:<\/strong><\/p>\n\n- Read-only users can’t acknowledge events even with “acknowledge all” feature.<\/li>\n
- Available only for events starting from the 1st of Sep 2023. The action is not present for older events.<\/li>\n<\/ul>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nmacOS 14 Sonoma notifications<\/strong><\/h4>\nApple has released the next major operating system version\u00a0 14 (Sonoma) ahead of schedule, and our agent is not yet compatible with it<\/a>. We have now two new issues in the EPP dashboard advising not to upgrade yet and showing which devices have already upgraded to the new OS version.<\/p>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\nElements Agent for Windows workstation and server: version 23.7<\/strong><\/h3>\nA new version of the endpoint clients is available.<\/p>\n
This release makes the Elements Agent version 23.7 available (internal version 23.7.416).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
New away option in automated tasks.<\/strong><\/h4>\nThe \u201caway\u201d option allows to run automated task after user has been away for defined number of minutes. Example \u201c@away 5\u201d would run task after user have been away for 5 minutes.<\/p>\n<\/img><\/a><\/figure>\nNew automated task to create restore point.<\/strong><\/h4>\nThere is new automated task which allows to create system restore point in the client.<\/p>\n<\/img><\/a><\/figure>\nImprovements how windows operating system version is reported.<\/strong><\/h4>\nThe client now sends also windows build number and build number is visible in the device details.<\/p>\n<\/img><\/a><\/figure>\nRemote action to turn off application control.<\/strong><\/h4>\nThere is new remote action to turn off application control.<\/p>\n<\/img><\/a><\/figure>\nImproved security events to contain information also about quarantined registry entries.<\/strong><\/h4>\nIf rollback did happen and restored registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.<\/p>\n<\/img><\/a><\/figure>\nSecurity scanning exclusions improvements<\/strong><\/h4>\nIt is now possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. <\/p>\n<\/img><\/a><\/figure>\nRunning automated task from client user interface<\/strong><\/h4>\nIt is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately.<\/p>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\nNew Automated Actions view<\/h3>\n
WithSecure Elements EDR has released a new view called ‘Automated actions’.<\/p>\n
This replaces the old ‘Automated response’ view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe functionality stays the same and you can still configure \u2018Device isolation\u2019 rules that run 24\/7 and specify the risk level, like with the original ‘Automated response’ view, however you can now create an action rule with\u00a0\u2018custom\u2019 scheduling\u00a0<\/strong>where you can input specific hours for when you want a rule to run, for example, outside of office hours.<\/p>\n<\/img><\/a><\/figure>\nThe new ‘Automated actions’ view\u00a0includes all existing Device Isolation rules<\/strong>, so there is no need to worry about having to re-create them.<\/p>\nIt includes the new ‘custom’ scheduling, so\u00a0specific days and times can be applied\u00a0<\/strong>for when you want the rules to run, for example, from 17:00 until 09:00 the next morning.<\/p>\n<\/img><\/a><\/figure>\nLastly, the existing ‘Automated response’ view is still available for the next two weeks, in\u00a0read-only mode<\/strong>, so you have time to get used to the new view.<\/p>\nWhy?<\/strong><\/h4>\nNot only does this new feature provide custom scheduling but it also starts to build towards our vision to include more automated actions within Elements \u2013 initially, with the co-monitoring service and the new email notifications with risk level selection, but also for more response actions in the future.<\/p>\n
This new Automated Actions view is now available to use in Elements.<\/p>\n
New Broad Context Detection details view<\/h3>\n
The new Broad Context Detection (BCD) details view has been fully released into production and is now the default view, replacing the old Broad Context Detection details view.<\/p>\n<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\nThe new BCD details view has become the default view so when you click on the \u2018Broad Context Detection\u2019 menu option in Elements, you will now be presented with this new view.<\/p>\n
The old BCD details view is still available to use, for a limited time, to give you more time to familiarise yourself with the new BCD view. You can navigate to the old BCD view via the \u2018Go to old Broad Context Detection view\u2019 button in the top right corner of the page.<\/p>\n<\/img><\/a><\/figure>\nYou are able to elevate BCDs from within the new BCD details view, unlike before when it was in \u2018Preview\u2019 mode where you had to navigate back to the old BCD view to elevate a detection. The new view supports both manual and automatic elevations and works exactly the same as the old view.<\/p>\n
You are also able to change the default Elevation subscription token selected. The subscription expiring the soonest is selected by default, however you can now see all available subscriptions and change it to another one if you so wish.<\/p>\n<\/img><\/a><\/figure>\nExtra information has been added to the new view to help you interpret the information displayed.<\/p>\n
Elements Collaboration Protection<\/h2>\nBlocking file types<\/strong><\/h4>\nThe new feature “Blocking file types” was has been enabled\u00a0for all Collaboration Protection customers.\u00a0<\/p>\n
The policy settings were expanded to allow blocking of certain file types. Administrators can select the file types to be disallowed within the protected ecosystem, from a list curated by our security experts. The system will handle all files of the selected file types as harmful and act according to a tool specific policy setting. The feature does not rely on the file extension but leverages intelligent file type recognition.<\/p>\n<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\nDynamic Assets Risk Score has been enabled.<\/strong><\/h3>\nThe Static Asset Risk Score was calculated based only on the CVSS base score, with an additional boost for old and\/or exploitable vulnerabilities, enhanced with the asset importance mark and internet exposure flag.<\/p>\n
Here are the improvements introduced in the second version of Asset Risk Score, that is called “Dynamic Risk Score” with different boost factors:<\/p>\n
The score is slightly (from -10% up to +60%), corrected with EPSS (exploit prediction) score together, when there are no signs of exploitation<\/p>\n
\n- It is boosted between 20-70% when there is an exploit. The boost depends on our knowledge about the maturity of the exploit or observation of incidents related to the vulnerability.<\/li>\n
- It is boosted according to the number and age of cyber security reports describing the vulnerability<\/li>\n
- With other impacting factors such as:\n
\n- Taking into account a few most severe vulnerabilities, as opposed to static risk score that only took the first top one.<\/li>\n
- Taking into account the asset importance that is set by the customer.<\/li>\n
- Taking into account the visibility of the asset from public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Elements Vulnerability Management: System Scan<\/strong><\/h3>\nThe Elements Vulnerability Management System Scan was updated to detect vulnerabilities in the following products as part of authenticated scanning for Windows:<\/p>\n
\n- Siemens JT2Go<\/li>\n
- QNAP QVR Pro Client<\/li>\n<\/ul>\n
In addition, a non-version based detector was added for the VMWare Aria Operations For Networks remote code execution vulnerability (CVE-2023-34039)<\/p>\n
Elements VM Scan Node Agent: Linux<\/strong><\/h3>\nA new version of the Linux Scan Node Agent was released, fixing several known issues and also adding registration towards the Elements Vulnerability Management system.<\/p>\n
Integrations<\/h2>\nEndpoint Protection API: Subscriptions endpoints end of life on 11th of March 2024<\/h3>\n
The old\u00a0subscriptions endpoints<\/a>\u00a0are deprecated and should be replaced by the\u00a0subscription endpoints in the Provisioning API<\/a>. To use this API, you need to\u00a0request Read-only Provisioning API credentials<\/strong>\u00a0from WithSecure Support. Access to Provisioning API is only for partner (SOP) accounts.<\/p>\nThe following Endpoint Protection API subscriptions endpoints will stop working on the 11.03.2024:<\/p>\n
\n- Get company subscription details<\/li>\n
- Get partner subscription details<\/li>\n
- List company subscriptions<\/li>\n
- List partner subscriptions<\/li>\n
- Remove computers from subscription (replaced by Elements API endpoints \u201cUpdate device state<\/a>\u201d or \u201cDelete device<\/a>\u201d)<\/li>\n<\/ul>\n
REMINDER: Elements Connector: Customers still using the (End of Life) Endpoint Protection API to login need to change API authentication credentials<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
The Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n<\/img><\/a><\/figure>\nA Corresponding warning is also shown in the Connector device view:<\/p>\n<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the\u00a0userguide<\/a>.<\/p>\nIn case you missed it<\/h2>\nReminder: WithSecure products and macOS 14 \u201cSonoma\u201d<\/h3>\n
As you may be aware, Apple have announced that the next version of macOS (version 14, also known as \u201cSonoma\u201d) will be released on September 26th 2023.<\/p>\n
Unfortunately, this release has introduced incompatibilities with some WithSecure products.<\/p>\n
The affected products for Mac are:<\/strong><\/p>\n\n- WithSecure Elements Endpoint Detection and Response<\/li>\n
- WithSecure Elements Endpoint Protection<\/li>\n
- WithSecure Client Security (formerly F-Secure Client Security)<\/li>\n
- WithSecure Countercept<\/li>\n<\/ul>\n
We have created a Knowledge Base article<\/a> which details the current status of our support for Sonoma. Our current advice is to NOT upgrade to Sonoma at this time, unless it is critical for your business.<\/p>\nWithSecure is working hard to address these issues and will provide updates via the Knowledge Base page.<\/p>\n
Share your ideas with us<\/h2>\n
Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<\/img><\/a><\/figure>\nFurther information<\/h2>\n
- \n
- Read-only users can’t acknowledge events even with “acknowledge all” feature.<\/li>\n
- Available only for events starting from the 1st of Sep 2023. The action is not present for older events.<\/li>\n<\/ul>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n
macOS 14 Sonoma notifications<\/strong><\/h4>\n
Apple has released the next major operating system version\u00a0 14 (Sonoma) ahead of schedule, and our agent is not yet compatible with it<\/a>. We have now two new issues in the EPP dashboard advising not to upgrade yet and showing which devices have already upgraded to the new OS version.<\/p>\n
<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\n
Elements Agent for Windows workstation and server: version 23.7<\/strong><\/h3>\n
A new version of the endpoint clients is available.<\/p>\n
This release makes the Elements Agent version 23.7 available (internal version 23.7.416).<\/p>\n
The endpoints automatically upgrade, without a reboot.<\/p>\n
New away option in automated tasks.<\/strong><\/h4>\n
The \u201caway\u201d option allows to run automated task after user has been away for defined number of minutes. Example \u201c@away 5\u201d would run task after user have been away for 5 minutes.<\/p>\n
<\/img><\/a><\/figure>\nNew automated task to create restore point.<\/strong><\/h4>\n
There is new automated task which allows to create system restore point in the client.<\/p>\n
<\/img><\/a><\/figure>\nImprovements how windows operating system version is reported.<\/strong><\/h4>\n
The client now sends also windows build number and build number is visible in the device details.<\/p>\n
<\/img><\/a><\/figure>\nRemote action to turn off application control.<\/strong><\/h4>\n
There is new remote action to turn off application control.<\/p>\n
<\/img><\/a><\/figure>\nImproved security events to contain information also about quarantined registry entries.<\/strong><\/h4>\n
If rollback did happen and restored registry entries, the security event generated from the event was missing information about the restored registry entries. Now the event contains information about the restored registry entries.<\/p>\n
<\/img><\/a><\/figure>\nSecurity scanning exclusions improvements<\/strong><\/h4>\n
It is now possible for administrators to enabled and disable individual rules, instead of removing the rules completely. Also, it is possible to write a comment for the exclusion. <\/p>\n
<\/img><\/a><\/figure>\nRunning automated task from client user interface<\/strong><\/h4>\n
It is possible to run automated task from the client user interface. Running task is only possible for administrative users and must be enabled from the profile separately.<\/p>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
New Automated Actions view<\/h3>\n
WithSecure Elements EDR has released a new view called ‘Automated actions’.<\/p>\n
This replaces the old ‘Automated response’ view.<\/p>\n
<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\n
The functionality stays the same and you can still configure \u2018Device isolation\u2019 rules that run 24\/7 and specify the risk level, like with the original ‘Automated response’ view, however you can now create an action rule with\u00a0\u2018custom\u2019 scheduling\u00a0<\/strong>where you can input specific hours for when you want a rule to run, for example, outside of office hours.<\/p>\n
<\/img><\/a><\/figure>\nThe new ‘Automated actions’ view\u00a0includes all existing Device Isolation rules<\/strong>, so there is no need to worry about having to re-create them.<\/p>\n
It includes the new ‘custom’ scheduling, so\u00a0specific days and times can be applied\u00a0<\/strong>for when you want the rules to run, for example, from 17:00 until 09:00 the next morning.<\/p>\n
<\/img><\/a><\/figure>\nLastly, the existing ‘Automated response’ view is still available for the next two weeks, in\u00a0read-only mode<\/strong>, so you have time to get used to the new view.<\/p>\n
Why?<\/strong><\/h4>\n
Not only does this new feature provide custom scheduling but it also starts to build towards our vision to include more automated actions within Elements \u2013 initially, with the co-monitoring service and the new email notifications with risk level selection, but also for more response actions in the future.<\/p>\n
This new Automated Actions view is now available to use in Elements.<\/p>\n
New Broad Context Detection details view<\/h3>\n
The new Broad Context Detection (BCD) details view has been fully released into production and is now the default view, replacing the old Broad Context Detection details view.<\/p>\n
<\/img><\/a><\/figure>\nWhat has changed?<\/strong><\/h4>\n
The new BCD details view has become the default view so when you click on the \u2018Broad Context Detection\u2019 menu option in Elements, you will now be presented with this new view.<\/p>\n
The old BCD details view is still available to use, for a limited time, to give you more time to familiarise yourself with the new BCD view. You can navigate to the old BCD view via the \u2018Go to old Broad Context Detection view\u2019 button in the top right corner of the page.<\/p>\n
<\/img><\/a><\/figure>\nYou are able to elevate BCDs from within the new BCD details view, unlike before when it was in \u2018Preview\u2019 mode where you had to navigate back to the old BCD view to elevate a detection. The new view supports both manual and automatic elevations and works exactly the same as the old view.<\/p>\n
You are also able to change the default Elevation subscription token selected. The subscription expiring the soonest is selected by default, however you can now see all available subscriptions and change it to another one if you so wish.<\/p>\n
<\/img><\/a><\/figure>\nExtra information has been added to the new view to help you interpret the information displayed.<\/p>\n
Elements Collaboration Protection<\/h2>\n
Blocking file types<\/strong><\/h4>\n
The new feature “Blocking file types” was has been enabled\u00a0for all Collaboration Protection customers.\u00a0<\/p>\n
The policy settings were expanded to allow blocking of certain file types. Administrators can select the file types to be disallowed within the protected ecosystem, from a list curated by our security experts. The system will handle all files of the selected file types as harmful and act according to a tool specific policy setting. The feature does not rely on the file extension but leverages intelligent file type recognition.<\/p>\n
<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\n
Dynamic Assets Risk Score has been enabled.<\/strong><\/h3>\n
The Static Asset Risk Score was calculated based only on the CVSS base score, with an additional boost for old and\/or exploitable vulnerabilities, enhanced with the asset importance mark and internet exposure flag.<\/p>\n
Here are the improvements introduced in the second version of Asset Risk Score, that is called “Dynamic Risk Score” with different boost factors:<\/p>\n
The score is slightly (from -10% up to +60%), corrected with EPSS (exploit prediction) score together, when there are no signs of exploitation<\/p>\n
- \n
- It is boosted between 20-70% when there is an exploit. The boost depends on our knowledge about the maturity of the exploit or observation of incidents related to the vulnerability.<\/li>\n
- It is boosted according to the number and age of cyber security reports describing the vulnerability<\/li>\n
- With other impacting factors such as:\n
- \n
- Taking into account a few most severe vulnerabilities, as opposed to static risk score that only took the first top one.<\/li>\n
- Taking into account the asset importance that is set by the customer.<\/li>\n
- Taking into account the visibility of the asset from public internet.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Elements Vulnerability Management: System Scan<\/strong><\/h3>\n
The Elements Vulnerability Management System Scan was updated to detect vulnerabilities in the following products as part of authenticated scanning for Windows:<\/p>\n
- \n
- Siemens JT2Go<\/li>\n
- QNAP QVR Pro Client<\/li>\n<\/ul>\n
In addition, a non-version based detector was added for the VMWare Aria Operations For Networks remote code execution vulnerability (CVE-2023-34039)<\/p>\n
Elements VM Scan Node Agent: Linux<\/strong><\/h3>\n
A new version of the Linux Scan Node Agent was released, fixing several known issues and also adding registration towards the Elements Vulnerability Management system.<\/p>\n
Integrations<\/h2>\n
Endpoint Protection API: Subscriptions endpoints end of life on 11th of March 2024<\/h3>\n
The old\u00a0subscriptions endpoints<\/a>\u00a0are deprecated and should be replaced by the\u00a0subscription endpoints in the Provisioning API<\/a>. To use this API, you need to\u00a0request Read-only Provisioning API credentials<\/strong>\u00a0from WithSecure Support. Access to Provisioning API is only for partner (SOP) accounts.<\/p>\n
The following Endpoint Protection API subscriptions endpoints will stop working on the 11.03.2024:<\/p>\n
- \n
- Get company subscription details<\/li>\n
- Get partner subscription details<\/li>\n
- List company subscriptions<\/li>\n
- List partner subscriptions<\/li>\n
- Remove computers from subscription (replaced by Elements API endpoints \u201cUpdate device state<\/a>\u201d or \u201cDelete device<\/a>\u201d)<\/li>\n<\/ul>\n
REMINDER: Elements Connector: Customers still using the (End of Life) Endpoint Protection API to login need to change API authentication credentials<\/h3>\n
In order to provide a better and more unified set of APIs for WithSecure Elements, we are progressively deprecating the Endpoint Protection API and replacing it by Elements API. If your Elements Connector is used to stream security events from the WithSecure Elements portal to your SIEM and was configured before 23.05 release, it might be still using Endpoint Protection API.<\/p>\n
The Elements Security Center will warn you if actions are needed in the Issues list:<\/p>\n
<\/img><\/a><\/figure>\nA Corresponding warning is also shown in the Connector device view:<\/p>\n
<\/img><\/a><\/figure>\nIn order to preserve event forwarding functionality please switch over to using Elements API credentials before 31.12.2023. You can find full details of the required changes in the\u00a0userguide<\/a>.<\/p>\n
In case you missed it<\/h2>\n
Reminder: WithSecure products and macOS 14 \u201cSonoma\u201d<\/h3>\n
As you may be aware, Apple have announced that the next version of macOS (version 14, also known as \u201cSonoma\u201d) will be released on September 26th 2023.<\/p>\n
Unfortunately, this release has introduced incompatibilities with some WithSecure products.<\/p>\n
The affected products for Mac are:<\/strong><\/p>\n
- \n
- WithSecure Elements Endpoint Detection and Response<\/li>\n
- WithSecure Elements Endpoint Protection<\/li>\n
- WithSecure Client Security (formerly F-Secure Client Security)<\/li>\n
- WithSecure Countercept<\/li>\n<\/ul>\n
We have created a Knowledge Base article<\/a> which details the current status of our support for Sonoma. Our current advice is to NOT upgrade to Sonoma at this time, unless it is critical for your business.<\/p>\n
WithSecure is working hard to address these issues and will provide updates via the Knowledge Base page.<\/p>\n
Share your ideas with us<\/h2>\n
Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n
<\/img><\/a><\/figure>\nFurther information<\/h2>\n