These enhancements are crucial for our partners working with SOAR, as they can now build playbooks to automatically trigger specific actions.<\/p>\n
For instance, they can assign a restricted profile (instead of isolating) and display a message to inform the user about the reason for the restriction. The playbook could also immediately trigger a scan, set a profile to collect Microsoft event logs as security events, enable debug logging, or collect a diagnostic file. This allows an analyst to have more information at their disposal when they start working on an incident.<\/p>\n
Endpoint Protection API is now deprecated<\/h3>\n
With the support of the \u201cmissing software update\u201d feature in the Elements API, the Endpoint Protection API has been fully replaced. We urge you to transition to the Elements API as soon as possible, and ensure that your Elements Connector no longer uses the old Endpoint Protection API.<\/p>\n
Elements Security Center<\/h2>\nIntroducing the Elements News Center<\/h3>\n
We are pleased to announce the release of Elements News Center, one of the latest features added to our Elements Security Center. This feature will make it easy for you to stay up to date on what is happening in the Security Center, read more about new features you might want to try out, quickly consult the latest changelogs, and be prepared to react to the ever-changing threat landscape.<\/p>\n
You can find out much more about the News Center in our dedicated article<\/a><\/p>\n Email Reports<\/strong><\/p>\n Email reports can now be configured to be sent on daily, weekly or monthly intervals. Admins can also select the desired time of the day for when they want to receive the report.<\/p>\n Privacy Note for URL information<\/strong><\/p>\n We have added an info in the Security Events details explaining why the website URL information is missing from the event together with a guidance on how to enable it in the profile.<\/p>\n Dynamic Risk Score and Outbreak Control<\/strong><\/p>\n Dynamic risk score can now be used as a trigger for Outbreak control in Profile assignment rules. This allows the administrator to define even more rules to ensure that the endpoint device is more secure when there are active exploits on known threats.<\/p>\n Automated tasks can run when user is away<\/strong><\/p>\n It is now possible to define automated tasks that can be triggered after the user is \u201caway\u201d<\/p>\n Custom notes for rules and exclusions<\/strong><\/p>\n It is now possible to add custom notes for new exclusions and rules, so the administrator can make it clearer why it was added.<\/p>\n Global exclusions for all security scans<\/strong><\/p>\n We have now added the possibility to define global exclusions for all scans.<\/p>\n An update to the WithSecure Elements Mobile Protection app for Android has been released.<\/p>\n This release includes the following new features and improvements:<\/p>\n An update to the WithSecure Elements Mobile Protection app for iOS has been released.<\/p>\n This release includes the following new features and improvements:<\/p>\n A new version of the endpoint clients is available, and the endpoints automatically upgrade, without a reboot.<\/p>\n This release brings the following changes:<\/p>\n Network installer improvements<\/strong><\/p>\n This update includes new reliability improvements to the network installer; it handles network connectivity problems and error reporting better during the installation process.<\/p>\n Privacy and License Terms location<\/strong><\/p>\n The Privacy Policy and End-User License Terms links have been changed to point to WithSecure site “download.withsecure.com\u201d, having previously been using f-secure.com.<\/p>\n Diagnostic file renamed<\/strong><\/p>\n The diagnostic file “fsdiag.zip” has been renamed to “wsdiag.zip”.<\/p>\n Old Installer warning<\/strong><\/p>\n The Elements Security Center dashboard now displays a warning if the Elements Agent has been installed with an installer that is older than six months. For a frictionless installation we recommend using the latest possible installer.<\/p>\n Additional information about Installation in Devices view<\/strong><\/p>\n We have added extra information related to installation to the Elements Security Center\u2019s Devices view. This includes Elements Agent installation time<\/strong> and Installer package creation time<\/strong>.<\/p>\n Improvements to Event History and Automated Tasks<\/strong><\/p>\n The Agent Settings-Automated Tasks view and Event history list have been improved to show the Automated Tasks \u201caway\u201d option. Away option allows to run automated task after user has been away for defined number of minutes.<\/p>\n New detection details view<\/strong><\/p>\n The Detection details view was renewed to serve better the security admins\u2019 needs and support their day-to-day work flow.<\/p>\n The page got completely redesigned to support the Elements consistency in design and functionality. E.g. now a security admin can navigate between pre-filtered detections with no need to return to Detections view.<\/p>\n However, the update goes beyond the facelift. The response actions were introduced to that view to illuminate the unnecessary navigation between the Quarantine and Detection detail views. The additional information and cross linking are aiming to support the decision-making process.<\/p>\n No more unprotected mailboxes due to license outage<\/strong> <\/p>\n There is now a better overview of available licenses, their usage, and outages across cloud services. The redesigned\u00a0subscriptions view on the Cloud Services page brings transparency to which assets are unprotected due to license outages.<\/p>\n Furthermore, the feature\u00a0notifies security administrators on Dashboard and Cloud Services pages\u00a0if the mailbox count exceeds the total number of licenses. This helps to ensure that the organization remains compliant with licensing requirements.<\/p>\n The following capabilities have been added to authenticated scanning for Windows:<\/p>\n Additionally, the detection of the JSCAPE MFT Server product (without version) has been added to remote scanning.<\/p>\n Elements Collaboration Protection (ECP) Security Events<\/strong><\/p>\n Security events related to email, Teams, Onedrive, Sharepoint have been added.<\/strong><\/p>\n Please Note: <\/strong>To access these events, integrations need to change to a new API endpoint \u201cQuery EPP, EDR and Collaboration Protection Security Events\u201d that replace the previous \u201cRead list of security events\u201d<\/p>\n Description added to both EDR incidents and detections endpoints<\/strong><\/p>\n One may read the EDR incident analysis through API and add it to a report or a ticket. Human-friendly descriptions of the detection within an EDR incidents help triaging incidents within a SOAR. <\/p>\n Better filtering of devices<\/strong><\/p>\n It is now possible to Filter using AD group, Operating System and public IP address<\/p>\n Query missing Softwares Update per device <\/strong><\/p>\n It is now possible to check which devices have missing patches, and then get the list of missing patch. <\/p>\n With the release of these new functionalities in Elements API, we announced the end of life of the corresponding endpoint in Endpoint Protection API, and consequently Endpoint Protection API is fully deprecated.<\/strong><\/p>\n Performance improvement in Incidents endpoint<\/strong><\/p>\n To improve performance, the API caller should include archived=false in the query<\/p>\n Example:<\/em><\/p>\n curl -H “Authorization: Bearer $TOKEN” https:\/\/api.connect.withsecure.com\/incidents\/v1\/incidents?archived=false<\/p>\n New response actions available<\/strong><\/p>\n For the\u00a0device operations endpoint<\/a>\u00a0support for the following new operations has been added:<\/p>\n QakBot and DarkGate<\/strong><\/p>\n QakBot is a banking Trojan that has been active since 2007. In recent years, it has been used to distribute ransomware and other malware. DarkGate is a new malware family that has been observed filling the void left by QakBot.<\/p>\n TeamsPhisher and Storm-0324<\/strong><\/p>\n TeamsPhisher is a phishing tool that is designed to target Microsoft Teams users. Storm-0324 is a threat actor that has been observed using TeamsPhisher to distribute malware.<\/p>\n Malicious takeover of subdomains<\/strong><\/p>\n This refers to a technique where threat actors take control of a subdomain belonging to a legitimate website and use it to host malware or launch phishing attacks.<\/p>\n Mis-scoring of a vulnerability in Juniper firewalls and switches<\/strong><\/p>\n Refers to a vulnerability in Juniper firewalls and switches that was initially scored as low severity, but was later found to be more serious. The vulnerability could allow an attacker to bypass authentication and gain access to sensitive information.<\/p>\n Hacktivist attacks in Canada and Europe<\/strong><\/p>\n Hacktivism refers to the use of hacking and other forms of digital activism to promote a political or social cause. The report highlights recent hacktivist attacks in Canada and Europe, including attacks on government websites and critical infrastructure.<\/p>\n Ransomware trends<\/strong><\/p>\n Ransomware is a type of malware that encrypts a victim’s files and demands payment in exchange for the decryption key. The report provides statistics and trends on ransomware attacks, as well as highlighting several new ransomware families.<\/p>\n High-profile vulnerability and exploit issues<\/strong><\/p>\n The report highlights several vulnerabilities and exploits that could be used by attackers to gain access to sensitive information or disrupt critical infrastructure. These include CVE-2018-0802, CVE-2018-8653, CVE-2018-0798, CVE-2023-23397, CVE-2017-0199, CVE-2017-11882, CVE-2010-0033, CVE-2023-28274, CVE-2010-4452, and CVE-2023-21716.<\/p>\n Download report<\/strong><\/a><\/p>\n Phishing campaign impacting Finland<\/strong><\/p>\n Phishing campaign that is targeting Finnish organizations. The attackers are using a variety of tactics to trick users into giving up their login credentials, including sending fake emails that appear to be from legitimate sources.<\/p>\n Infostealer market<\/strong><\/p>\n Current state of the infostealer market, which is a type of malware that is designed to steal sensitive information from infected systems. The report notes that the market is currently dominated by a few key players, and that the malware is often sold on underground forums.<\/p>\n Fallout following the compromise of Okta<\/strong><\/p>\n Overview of the fallout following the compromise of Okta, a company that provides identity and access management services to many other third parties. The report notes that the attackers were able to access customer accounts at 1Password, Beyond Trust, and Cloudflare by abusing credentials, cookies, and session tokens contained within HAR files.<\/p>\n HTTP\/2 rapid reset DDoS technique<\/strong><\/p>\n A new DDoS technique that is designed to exploit a vulnerability in the HTTP\/2 protocol. The technique involves sending a series of specially crafted requests that cause the server to reset the connection, which can result in a denial of service.<\/p>\n Hacktivist landscape<\/strong><\/p>\n Current state of the hacktivist landscape, which has been further shaped by ongoing conflict in Israel. The report notes that hacktivist groups are increasingly using social media to spread their message and coordinate their activities.<\/p>\n Ransomware landscape<\/strong><\/p>\n Statistics on known ransomware attacks, including the number of attacks and the amount of ransom demanded. The report notes that ransomware attacks continue to be a major threat to organizations of all sizes<\/p>\n Darkgate malware<\/strong><\/p>\n The report includes a reference to a wider piece of research on the Darkgate malware, which is a financially motivated cybercrime actor that is using multiple malware families to target digital marketing professionals.<\/p>\n Download report<\/strong><\/a><\/p>\n You can find out more about our current support for macOS 14 at our dedicated article<\/a><\/p>\n For most customers, WithSecure Elements will work out of the box. However, some administrators tightly control the addresses that are reachable from their networks, and for them we have made a comprehensive list<\/a> of all the servers our clients connect to.<\/p>\n Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\nElements Endpoint Protection Portal<\/h3>\n
![\"Picture4.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture4-15.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture5.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture5-16-scaled.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture6.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture6-14-scaled.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture7.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture7-13.png.webp\")
<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\n
Elements Mobile Protection for Android<\/h3>\n
\n
Elements Mobile Protection for IOS<\/h3>\n
\n
Elements Agent for Windows workstation and server<\/h3>\n
![\"Picture8.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture8-13.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture9.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture9-13.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture10.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture10-10.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture11.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture11-11.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture12.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture12-8.png.webp\")
<\/img><\/a><\/figure>\nElements Collaboration Protection<\/h2>\n
![\"Picture19.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture19-3.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture20.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture20-3.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture21.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture21-2.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture22.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture22-1.png.webp\")
<\/img><\/a><\/figure>\n![\"Picture23.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture23-2.png.webp\")
<\/img><\/a><\/figure>\nElements Vulnerability Management<\/h2>\n
System Scan<\/h3>\n
\n
Integrations<\/h2>\n
Elements API<\/h3>\n
\n
Other items of interest<\/h2>\n
Monthly Threat Highlights Report: September 2023<\/h3>\n
Monthly Threat Highlights Report: October 2023<\/h3>\n
In case you missed it<\/h2>\n
Support for macOS 14 \u201cSonoma\u201d<\/h3>\n
Network addresses for WithSecure Elements<\/h3>\n
Share your ideas with us<\/h2>\n
![\"Feedback.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-1.png.webp\")
<\/img><\/a><\/figure>\nFurther information<\/h2>\n