{"id":7100,"date":"2025-01-16T09:34:12","date_gmt":"2025-01-16T07:34:12","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7100"},"modified":"2026-10-19T13:09:07","modified_gmt":"2026-10-19T10:09:07","slug":"whats-new-in-elements-december-2024","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/en\/announcements\/whats-new-in-elements-december-2024\/","title":{"rendered":"What&#8217;s New in Elements: December 2024"},"content":{"rendered":"<h2 data-id=\"editor-s-highlights\"><strong>Editor\u2019s Highlights<\/strong><\/h2>\n<h3 data-id=\"withsecure-elements-technical-trainings-available-for-everyone\"><strong>WithSecure Elements Technical Trainings available for everyone<\/strong><\/h3>\n<p>We are happy to announce that we have now made some of our technical trainings freely available for everyone.<\/p>\n<p>By following the trainings, you can learn more about our\u00a0<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fsolutions%2Fsoftware-and-services%2Fwithsecure-elements-extended-detection-and-response\" target=\"_blank\" rel=\"nofollow noopener ugc\">Extended Detection and Response<\/a>\u00a0and\u00a0<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fsolutions%2Fsoftware-and-services%2Fwithsecure-elements-exposure-management\" target=\"_blank\" rel=\"nofollow noopener ugc\">Exposure Management<\/a>\u00a0solutions, including:<\/p>\n<ul>\n<li>How to use the Elements Security Center effectively to manage the solutions<\/li>\n<li>How to deploy the products that make up the solutions<\/li>\n<li>How to configure the products<\/li>\n<li>Daily Administration tasks, including responding to events<\/li>\n<\/ul>\n<p>You can find the <a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fsupport%2Ftechnical-training\" target=\"_blank\" rel=\"nofollow noopener ugc\">technical trainings here<\/a>.<\/p>\n<h3 data-id=\"2024-mitre-att-ck-evaluations-enterprise-withsecure-edr-is-a-leader-in-detection-to-alert-ratio\"><strong>2024 MITRE ATT&amp;CK\u00ae Evaluations: Enterprise (WithSecure EDR is a leader in detection-to-alert ratio)<\/strong><\/h3>\n<p>In the latest round of MITRE testing, we excelled in the area of detection-to-alert ratio. In plain terms, this means that our EDR solution ensured accurate and early detection without unnecessary noise caused through irrelevant alerts.<\/p>\n<p>These results reinforce our commitment to offering IT professionals with limited investigation resources the best-value cyber security solutions that deliver proven results time and again, only alerting when necessary \u2013 often avoiding thousands of time-consuming false positives.<\/p>\n<p>See more:<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fexpertise%2Fcampaigns%2Fmitre-2024\" target=\"_blank\" rel=\"nofollow noopener ugc\">2024 MITRE ATT&amp;CK\u00ae Evaluations: Enterprise | WithSecure\u2122<\/a><\/p>\n<h2 data-id=\"extended-detection-and-response\"><strong>Extended Detection and Response<\/strong><\/h2>\n<h3 data-id=\"endpoint-protection\"><strong>Endpoint Protection<\/strong><\/h3>\n<h4 data-id=\"elements-agent-for-macos-elements-agent-client-security-network-isolation\"><strong>Elements Agent for macOS: Elements Agent \/ Client Security &amp; network isolation<\/strong><\/h4>\n<p><strong>Important information<\/strong> for customers planning on upgrading to macOS Sequoia 15.1.1 or higher.<\/p>\n<p>Network isolation on macOS 15.1.1 and higher <strong>does not currently work<\/strong> in conjunction with Apple\u2019s built-in firewall.<\/p>\n<p>WithSecure has been in contact with Apple and they have confirmed the issue. WithSecure continues to seek for a resolution together with Apple.<\/p>\n<h4 data-id=\"elements-agent-for-macos\"><strong>Elements Agent for macOS<\/strong><\/h4>\n<p>WithSecure Elements Agent macOS 24.6.53972\u00a0has been released to general availability.<\/p>\n<p>This release fixes an issue which caused product initialization to sometimes fail.<\/p>\n<p>The product Installer can be downloaded from\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fdownload.withsecure.com%2FPSB%2Flatest%2FElementsAgentInstaller_53972.mpkg\" target=\"_blank\" rel=\"nofollow noopener ugc\">here<\/a>, and the update is available for automatic update to existing installations.<\/p>\n<p>Elements Agent macOS 24.6 supports following macOS versions:<\/p>\n<ul>\n<li>macOS 15 Sequoia<\/li>\n<li>macOS 14 Sonoma<\/li>\n<li>macOS 13 Ventura<\/li>\n<\/ul>\n<h3 data-id=\"identity-security\"><strong>Identity Security<\/strong><\/h3>\n<h4 data-id=\"elements-identity-security-identity-response-capability\"><strong>Elements Identity Security: Identity Response Capability<\/strong><\/h4>\n<p>We are thrilled to announce a significant update to our detection and response product. This release introduces the\u00a0<strong>Identity Response capability<\/strong>, designed to enhance your responsiveness to security incidents involving compromised users.<\/p>\n<p>By configuring this new feature, Elements Cloud will integrate seamlessly with Microsoft Entra ID, enabling you to take swift action on affected users.<\/p>\n<p><strong>How to Set Up:<\/strong><\/p>\n<ol>\n<li>Navigate to the\u00a0<strong>Environment -&gt; Cloud<\/strong>\u00a0page.<\/li>\n<li>Go to the\u00a0<strong>Detection and Response<\/strong>\u00a0tab.<\/li>\n<li>Follow the instructions to configure the Identity Response capability. To assist you further, we have provided a helpful onboarding video to guide you through the process of onboarding.<\/li>\n<\/ol>\n<p>Executing response actions could not be easier. Do this directly from the Identity\u00a0<strong>Broad Context Detections\u00a0<\/strong>(BCDs), for quick, effective containment. The response actions included are:<\/p>\n<ul>\n<li>End the current user session<\/li>\n<li>Reset the users password<\/li>\n<li>Disable the users access<\/li>\n<\/ul>\n<p>This capability helps prevent major impacts and stops attackers in their tracks.<\/p>\n<h2 data-id=\"exposure-management\"><strong>Exposure Management<\/strong><\/h2>\n<h3 data-id=\"xm-newsletter\"><strong>XM\u00a0newsletter<\/strong><\/h3>\n<p><strong>Finding status management<\/strong><\/p>\n<p>We have now added Finding Status management. This is similar to recommendations status management, the user can manually adjust the impact on individual finding status. Only active findings are taken into account for risk score calculations. \u00a0<\/p>\n<p><strong>More detailed information about scans<\/strong><\/p>\n<p>There is now more detailed information about the related scan(s) in the <strong>Recommendation details<\/strong>.<\/p>\n<ul>\n<li>&#8220;Scan subtype&#8221; column gives a hint on what scan type has led into the creation of the finding. e.g &#8220;System Scan&#8221; for vulnerability findings and &#8220;Azure (cloud scan)&#8221; for Cloud findings.<\/li>\n<\/ul>\n<p><strong>Note:<\/strong> This data is available for recent scans only. In case of old scans, a re-scan is required to populate it.<\/p>\n<p><strong>Filter alignment<\/strong><\/p>\n<p>Filters<strong> <\/strong>are now aligned across various XM views.<\/p>\n<p><strong>Identity list view: <\/strong><\/p>\n<p>MFA false-positives have been significantly reduced. Now more precise status appears on the UI. Note: As a result of this fix, users might notice more yellow colors on Identity list page.<\/p>\n<h3 data-id=\"vulnerability-management\"><strong>Vulnerability Management<\/strong><\/h3>\n<h4 data-id=\"evm-portal\"><strong>EVM Portal<\/strong><\/h4>\n<p><strong>New engine for Internet Discovery<\/strong><\/p>\n<p>The Internet Discovery page now utilizes the new scanning engine,\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=http%3A%2F%2FShodan.io\" target=\"_blank\" rel=\"nofollow noopener ugc\">Shodan.io<\/a>.<\/p>\n<p><strong>Obsolete API Endpoints removed<\/strong><\/p>\n<p>We have now permanently removed some obsolete API endpoints and these are no longer available.<\/p>\n<h4 data-id=\"evm-system-scan\"><strong>EVM System Scan<\/strong><\/h4>\n<p>The ability to detect vulnerabilities in the following products was added to Authenticated Scanning for Windows:<\/p>\n<ul>\n<li>Apache Kafka Clients<\/li>\n<li>Autodesk Navisworks (Freedom, Manage, Simulate)<\/li>\n<li>Cisco Enterprise Chat and Email<\/li>\n<li>Cleo servers<\/li>\n<li>GitHub CLI<\/li>\n<li>Intel Processor Identification Utility<\/li>\n<li>NetApp SnapCenter Server<\/li>\n<li>NetCloud Exchange client<\/li>\n<li>Ollama<\/li>\n<li>Spring LDAP<\/li>\n<\/ul>\n<p><strong>Important note<\/strong>: Due to some corner cases that trouble some customers we had to temporarily disable calculation of all missing Microsoft Cumulative Updates and go back to the previous model. We will be actively developing solution for those cases so that the calculation will be back as soon as possible. Although this is unfortunate and detections may for the time not paint the whole picture, if any of the Cumulative Update is missing, there will be at least one vulnerability showing up in the reports.<\/p>\n<h2 data-id=\"elements-foundations\"><strong>Elements Foundations<\/strong><\/h2>\n<h3 data-id=\"elements-security-center\"><strong>Elements Security Center<\/strong><\/h3>\n<p><strong>New Mac profile editor is now in production<\/strong><\/p>\n<p>An updated profile editor for Mac clients has been released<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-24.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-24.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-24.png.webp 602w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-24-300x151.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-24-447x226.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-24-289x146.png.webp 289w\" sizes=\"auto, 100vw\" alt=\"Picture1.png\" height=\"304\" width=\"602\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h2 data-id=\"integrations\"><strong>Integrations<\/strong><\/h2>\n<h3 data-id=\"elements-api\"><strong>Elements API<\/strong><\/h3>\n<p>A bugfix has been released in the query devices endpoint (GET\u00a0\/devices\/v1\/devices). <\/p>\n<p>Previously the response enum field firewallState contained a value &#8220;disabledMacos&#8221; while the correct and documented spelling is &#8220;disabledMacOs&#8221;. With the latest release the spelling in the response has been fixed and is now &#8220;disabledMacOs&#8221; (capital O as in Os).<\/p>\n<h2 data-id=\"other-items-of-interest\"><strong>Other items of interest<\/strong><\/h2>\n<h3 data-id=\"threat-highlight-reports-december\"><strong>Threat Highlight Reports: December<\/strong><\/h3>\n<p><strong>Threat Advisory: Abuse of VPN features<\/strong><\/p>\n<p>Recently a <strong>proof-of-concept<\/strong> tool was released publicly that demonstrates how to deploy a <strong>rogue VPN server to <\/strong>exploit a feature found in multiple VPN products.<\/p>\n<p>The tool demonstrates techniques to attack the <strong>SSL-VPN feature<\/strong>, that is found in VPN products including but not limited to: <strong>Cisco AnyConnect, SonicWall NetExtender, Palo Alto GlobalProtect, Ivanti Connect Secure<\/strong><\/p>\n<p>Because of insufficient digital certificate verification, attackers could manipulate the SSL-VPN communication process.<\/p>\n<p>If successful, the NachoVPN tool\u00a0allows for remote code execution, credential theft,\u00a0traffic interception, and\/or privilege escalation.<\/p>\n<p>You can\u00a0<a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fen%2Fexpertise%2Fresearch-and-innovation%2Fresearch%2Fmonthly-threat-highlights-report\" target=\"_blank\" rel=\"nofollow noopener ugc\">sign up<\/a>\u00a0to receive the monthly Threat Reports, with full details of these threats.<\/p>\n<h2 data-id=\"in-case-you-missed-it\"><strong>In case you missed it<\/strong><\/h2>\n<h3 data-id=\"end-of-support-for-f-secure-branded-elements-clients\"><strong>End of support for F-Secure branded Elements clients<\/strong><\/h3>\n<p>As 2024 closed, support for F-Secure branded Elements clients was stopped. All supported products have an equivalent WithSecure branded version, and in most cases these will have been taken into use automatically. <a href=\"https:\/\/community.withsecure.com\/en\/kb\/articles\/31410-withsecure-elements-and-f-secure-branded-clients-end-of-support-2024-12-31\" target=\"_blank\" rel=\"nofollow noopener ugc\">You can find more information here<\/a>.<\/p>\n<h2 data-id=\"share-your-ideas-with-us\"><strong>Share your ideas with us<\/strong><\/h2>\n<p>Our purpose is to co-secure the world with you. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via <a href=\"https:\/\/community.withsecure.com\/categories\/ideas\" target=\"_blank\" rel=\"nofollow noopener ugc\">the Ideas section of the WithSecure Community<\/a>, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n<figure class=\"entry-image display-medium float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-14.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-14.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-14.png.webp 337w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-14-300x298.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-14-150x150.png.webp 150w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/feedback-14-147x146.png.webp 147w\" sizes=\"auto, 100vw\" alt=\"Feedback.png\" height=\"335\" width=\"337\" loading=\"lazy\" data-display-size=\"medium\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<h2 data-id=\"further-information\"><strong>Further information<\/strong><\/h2>\n<p>Changelogs and Release Notes for all parts of WithSecure\u2122 Elements can be found at the\u00a0<a href=\"http:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fwww.withsecure.com%2Fuserguides%2F\" target=\"_blank\" rel=\"nofollow noopener ugc\">Help Center<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Editor\u2019s Highlights WithSecure Elements Technical Trainings available for everyone We are happy to announce that we have now made some of our technical trainings freely available for everyone. By following&hellip;<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7100","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"5816cdf7160a391bdaadd9f6fe1902d665231af4","vanilla_article_id":31592,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/31592-whats-new-in-elements-december-2024","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7100","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7100\/revisions"}],"predecessor-version":[{"id":8533,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement\/7100\/revisions\/8533"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=7100"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/announcement_category?post=7100"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}