{"id":4765,"date":"2026-10-19T11:36:28","date_gmt":"2026-10-19T08:36:28","guid":{"rendered":"https:\/\/support.withsecure.com\/?page_id=4765"},"modified":"2026-10-19T11:36:28","modified_gmt":"2026-10-19T08:36:28","slug":"endpoint-security-formerly-endpoint-detection-response","status":"publish","type":"page","link":"https:\/\/support.withsecure.com\/en\/changelogs\/products\/endpoint-security-formerly-endpoint-detection-response\/","title":{"rendered":"Endpoint Security (formerly Endpoint Detection &#038; Response)"},"content":{"rendered":"<section\n    class=\"wp-block-support-banner edwp-block wp-block-support-banner--bg-light-gray layout--spacing-xxxl-top layout--spacing-xxxl-bottom\"\n    >\n            <div class=\"wp-block-support-banner__container\">\n        <div class=\"wp-block-support-banner__content-wrapper\">\n                        <div class=\"wp-component-content wp-component-content--default wp-block-support-banner__content\">\n            <h2 class=\"wp-component-heading text--h2 wp-component-content__title\">\n    Changelogs<\/h2>                    <div class=\"wp-component-content__inner\">\n                                    <div class=\"wp-component-content__content wysiwyg\">\n                        <div class=\"wp-component-paragraph \">\n    <h4>Endpoint Security (formerly Endpoint Detection &amp; Response)<\/h4>\n<\/div>\n                    <\/div>\n                                                            <\/div>\n                <\/div>                            <div class=\"wp-block-support-banner__searchbar\">\n                    <div class=\"addsearch-standalone-searchbar-container\" data-addsearch-results-url=\"\/en\/search\"><\/div>\n                <\/div>\n                                <\/div>\n    <\/div>\n<\/section>\n\n\n<section\n    class=\"wp-block-content-list edwp-block layout--spacing-l-top layout--spacing-l-bottom\"\n    >\n    <div class=\"wp-block-content-list__container\">\n        \n        <div class=\"wp-block-content-list__main\">\n                    <ul class=\"wp-block-content-list__list\">\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-08-25T00:00:00+00:00\">August 25, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/controlled-updates-for-withsecure-elements-agents\/\">\n                <p class=\"wp-block-content-list__title\">Controlled Updates for WithSecure Elements agents<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,<\/p>\n<p>We are introducing Controlled Updates for WithSecure Elements agents, giving you the ability to align agent updates with your own change and maintenance windows rather than receiving them as soon as they are published.<\/p>\n<p><strong>What is changing?<\/strong><\/p>\n<p>Until now, Elements agents have updated automatically as new versions became available. You can now choose the update mode per profile:<\/p>\n<ul>\n<li><strong>Automatic Updates<\/strong> \u2014 devices receive new agent versions as they are released. This remains the default, and nothing changes for profiles you leave as they are.<\/li>\n<li><strong>Controlled Updates<\/strong> \u2014 devices stay on an assigned release group until you upgrade them, or until that group expires.<\/li>\n<\/ul>\n<p>Because the setting is applied per profile, you can mix modes across your estate \u2014 for example, keeping workstations on Automatic Updates while applying Controlled Updates to servers.<\/p>\n<p><strong>What to know before you start<\/strong><\/p>\n<ul>\n<li>Security intelligence updates are not affected by this setting. They continue to be delivered to all devices regardless of the update mode you choose.<\/li>\n<li>This is not a way to postpone updates indefinitely. Devices are brought up to date automatically once their assigned release group expires.<\/li>\n<li>Controlled Updates is not supported alongside the Elements Connector.<\/li>\n<li>Available for Windows, macOS, and Linux Elements agents.<\/li>\n<\/ul>\n<p>For release group schedules, configuration steps, and how to assign devices, see <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fsupport.withsecure.com%2Fuserguides%2Fproduct.html%23business%2Fpsb-portal%2Flatest%2Fen%2Fcontrolled_updates-psb-portal-latest-en\" target=\"_blank\" rel=\"nofollow noopener ugc\">Controlled Updates<\/a> in the user guide.<\/p>\n<p>We believe this improvement will give administrators working under strict change control the predictability they need, without weakening the protection on the devices themselves.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-06-29T00:00:00+00:00\">June 29, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-06-29-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) \u2014 2026-06-29 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,\u00a0<\/p>\n<p>We are expanding the Automated actions feature in Elements EDR to help partners respond to endpoint threats faster and at scale. With this update, you can now create automated rules that trigger six new EDR response actions whenever a Broad Context Detection (BCD) is created or updated to a medium, high, or severe risk level.\u00a0<\/p>\n<p><strong>What is changing?<\/strong>\u00a0<\/p>\n<p>Automated Actions for endpoint rules already supported Device Isolation as an automated response. We are now adding six new response actions, giving you greater flexibility to automate incident\u00a0response\u00a0across your customer\u00a0organisations.\u00a0<\/p>\n<p>With this update, six new response actions are available for automation:\u00a0<\/p>\n<ol>\n<li><strong>Retrieve\u00a0files<\/strong>\u00a0&#8211;\u00a0collects files from endpoints based on path patterns,\u00a0<\/li>\n<li><strong>Enumerate\u00a0services<\/strong>\u00a0&#8211;\u00a0lists all installed services on Windows endpoints,\u00a0<\/li>\n<li><strong>Retrieve browser\u00a0artefacts<\/strong>\u00a0&#8211;\u00a0collects browser history and data from major browsers,\u00a0<\/li>\n<li><strong>Netstat<\/strong>\u00a0&#8211; retrieves network connection information,\u00a0\u00a0<\/li>\n<li><strong>Enumerate scheduled tasks<\/strong>\u00a0&#8211; lists Windows scheduled tasks,\u00a0\u00a0<\/li>\n<li><strong>Enumerate processes<\/strong>\u00a0&#8211; lists all running processes.\u00a0<\/li>\n<\/ol>\n<p>\u00a0<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673.png.webp 936w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673-300x163.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673-768x416.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673-447x242.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-d896fd60bdbe78-d673-270x146.png.webp 270w\" sizes=\"auto, 100vw\" alt=\"image-d896fd60bdbe78-d673.png\" height=\"507\" width=\"936\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>\u00a0<\/p>\n<p><strong>How rules work<\/strong>\u00a0<\/p>\n<p>When creating a rule with one of the new response actions, you choose a risk level trigger (Medium, High, or Severe) and a device scope. Rules set to &#8220;All Devices&#8221; can span multiple customer\u00a0organisations; rules scoped to &#8220;Devices with specific labels&#8221; apply to a single\u00a0organisation\u00a0only. Schedule options\u00a0remain\u00a0Continuous or Custom, and the rule type is fixed to Endpoint. As with existing rules, the rule type and response type cannot be changed after\u00a0creation,\u00a0all other fields\u00a0remain\u00a0editable.\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>With automated EDR response actions, you can:\u00a0<\/p>\n<ul>\n<li>Reduce manual effort when responding to endpoint threats,\u00a0<\/li>\n<li>Ensure consistent, policy-driven responses to similar risk levels,\u00a0<\/li>\n<li>Scale security operations across many customer\u00a0organisations,\u00a0<\/li>\n<li>Focus expert attention on complex investigations rather than repetitive tasks.\u00a0<\/li>\n<\/ul>\n<p>We believe this improvement will meaningfully reduce the manual burden on partners managing high volumes of endpoint\u00a0detections, and\u00a0bring the power of EDR response actions into your automated workflows.\u00a0<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-06-29T00:00:00+00:00\">June 29, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-06-29-update-2\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-06-29 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,\u00a0<\/p>\n<p>We are expanding the suppression rule capabilities in Elements EDR to give you greater control over large, complex detections. With this update, you can now suppress key detections individually from BCD Details &#8211; directly from the Timeline, Process tree, or Process details views.\u00a0<\/p>\n<p>What is changing?\u00a0<\/p>\n<p>Previously, the Accepted Behavior closure wizard was limited to BCDs with up to five unsuppressed key detections. This limit exists intentionally to keep auto-generated rule sets small, precise, and easy to audit. Raising it could produce unwieldy or overly permissive rules.\u00a0<\/p>\n<p>With this update:\u00a0<\/p>\n<ul>\n<li>For BCDs with\u00a0<strong>more than five key detections<\/strong>, you can now suppress each remaining detection individually after closing the BCD as Accepted Behavior.\u00a0<\/li>\n<li>A new\u00a0<strong>per-detection suppression<\/strong>\u00a0option is available directly in the BCD Details view (Timeline, Process tree, and Process details tabs) for all BCDs closed as Accepted Behavior.\u00a0<\/li>\n<\/ul>\n<p>Three-level organizational hierarchy\u00a0<\/p>\n<p>Suppression rules follow a three-level organizational hierarchy:\u00a0<strong>Company<\/strong>,\u00a0<strong>SEP (Service Partner)<\/strong>, and\u00a0<strong>SOP (Solution Provider)<\/strong>. Each level can independently create its own suppression rule for the same key detection, with a maximum of one rule per level. A rule created at a given level can only be edited by administrators at that same level or above &#8211; when editing is not\u00a0permitted\u00a0at your level, the Edit button is\u00a0disabled\u00a0and a tooltip explains who can\u00a0modify\u00a0the rule.\u00a0<\/p>\n<p>What does this mean\u00a0for\u00a0you?\u00a0<\/p>\n<ul>\n<li>For large BCDs with more than five key detections, you no longer need to work around the detection limit &#8211; you can suppress the remaining detections individually after closure.\u00a0<\/li>\n<li>You\u00a0retain\u00a0full precision &#8211; each suppression rule is still tied to a specific key detection and pre-populated from its context, keeping rules targeted and auditable.\u00a0<\/li>\n<li>The existing Accepted Behavior wizard for BCDs with five or fewer key detections is unchanged.\u00a0<\/li>\n<\/ul>\n<p>We believe this improvement will significantly enhance the day-to-day experience of security teams managing large, complex detections, and make the suppression workflow more flexible without compromising precision or auditability.\u00a0<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-06-26T00:00:00+00:00\">June 26, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-06-26-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-06-26 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,\u00a0<\/p>\n<p>We are expanding device isolation capabilities in WithSecure Elements to now include Linux devices. Security administrators can remotely isolate a Linux device directly from the Elements Security Center when a security incident is detected, bringing Linux in line with the isolation functionality already available for Windows and macOS.\u00a0<\/p>\n<p><strong>What is changing?<\/strong>\u00a0<\/p>\n<p>Device isolation has been available for Windows and macOS devices for some time, allowing administrators to\u00a0contain\u00a0active threats by restricting network communication while keeping the device visible and manageable in the Security Center. With this update, the same capability is now extended to Linux.\u00a0<\/p>\n<p>When a Linux device is isolated, its network communication is restricted to help\u00a0contain\u00a0active threats, prevent lateral movement, and limit potential impact during investigation and remediation.\u00a0Isolation can be triggered as a response action from the Devices view and released once the incident has been resolved.\u00a0<\/p>\n<p>We believe this improvement will meaningfully strengthen your ability to respond to threats across mixed-OS environments, giving your security teams consistent containment capabilities whether the device in question is running Windows, macOS, or Linux.\u00a0<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-06-01T00:00:00+00:00\">June 1, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-06-01-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-06-01 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,\u00a0<\/p>\n<p>Following our earlier updates\u00a0regarding\u00a0the Detection and Response Reports view, we have now completed the\u00a0final step\u00a0of this transition.\u00a0<\/p>\n<p>\u00a0<\/p>\n<p><strong>What has changed?<\/strong>\u00a0<\/p>\n<p><strong>As of today,\u00a0Monday, June 1, the\u00a0Detection and Response Reports tab has been removed from Elements\u00a0and is no longer available.<\/strong>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p><strong>What does this mean?<\/strong>\u00a0<\/p>\n<ul>\n<li>The Detection and Response Reports tab is no longer accessible.\u00a0<\/li>\n<li>Reports that were not downloaded before the removal are no longer available through this view.\u00a0<\/li>\n<\/ul>\n<p>\u00a0<\/p>\n<p><strong>What should you do now?<\/strong>\u00a0<\/p>\n<p><strong>We recommend using the\u00a0My Reports tab\u00a0to create and manage your reports going forward.<\/strong>\u00a0It provides a more unified and up-to-date reporting experience and is now the main place for all reporting activities.\u00a0<\/p>\n<p>Moving to My Reports ensures you can continue working with your reports without interruption.\u00a0<\/p>\n<p>Thank you for your support during this transition and for helping us simplify and improve the reporting experience.\u00a0<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-05-07T00:00:00+00:00\">May 7, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-05-07-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-05-07 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,<\/p>\n<p>Following up on our earlier updates regarding the Detection and Response Reports view, we are now moving to the final step of this transition.<\/p>\n<p><strong>What is changing next?<\/strong><\/p>\n<p><strong>On Monday, June 1, the Detection and Response Reports tab will be removed from Elements and will no longer be available.<\/strong><\/p>\n<p>The page already includes a notification to help you prepare for this change:<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26.png.webp 1916w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26-300x142.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26-1024x484.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26-768x363.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26-1536x726.png.webp 1536w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26-447x211.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-26-309x146.png.webp 309w\" sizes=\"auto, 100vw\" alt=\"image.png\" height=\"906\" width=\"1916\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>After this date:<\/p>\n<ul>\n<li>The Detection and Response Reports tab will no longer be accessible.<\/li>\n<li>Any reports that have not been downloaded before this date will no longer be available through this view.<\/li>\n<\/ul>\n<p><strong>What should you do now?<\/strong><\/p>\n<p>Please make sure to download any reports you want to keep before June 1.<\/p>\n<p>We recommend using the My Reports tab to create and manage your reports going forward. It provides a more unified and up-to-date reporting experience and is now the main place for all reporting activities.<\/p>\n<p><strong>Moving to My Reports ensures you can continue working with your reports without interruption.<\/strong><\/p>\n<p>Thank you for your support during this transition and for helping us simplify and improve the reporting experience.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-04-10T00:00:00+00:00\">April 10, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-04-10-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-04-10 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,<\/p>\n<p>Following up on our recent update about the Detection and Response Reports view being moved to read-only mode, we want to share an important next step.<\/p>\n<p><strong>What is changing next?<\/strong><\/p>\n<p><strong>On 20 April, all existing schedulers in the Detection and Response Reports view will be deactivated.<\/strong><\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25.png.webp 1919w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25-300x141.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25-1024x481.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25-768x361.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25-1536x722.png.webp 1536w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25-447x210.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-25-311x146.png.webp 311w\" sizes=\"auto, 100vw\" alt=\"image.png\" height=\"902\" width=\"1919\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p>After that date:<\/p>\n<ul>\n<li>Reports will no longer be generated in this view.<\/li>\n<li>Previously generated reports will still be available for download in the Detection and Response Reports tab.<\/li>\n<\/ul>\n<p>The Detection and Response Reports tab itself will be removed entirely soon.<\/p>\n<p><strong>What should you do now?<\/strong><\/p>\n<p>We encourage you to start using the My Report tab and set up your report there as soon as possible. My Report provides all the same reporting capabilities as the previous view &#8211; and even more. It offers an improved and more intuitive experience, with ongoing enhancements and new features planned.\u00a0<\/p>\n<p><strong>Moving to My Report now will ensure you have uninterrupted access to your reports and benefit from the latest updates.<\/strong><\/p>\n<p>Thank you for adapting early and helping us move forward with a more unified reporting experience.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-03-30T00:00:00+00:00\">March 30, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-03-30-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-03-30 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>To help you create more flexible and maintainable suppression rules, <strong>wildcards are available for Accepted Behavior suppression rule parameters<\/strong>. Wildcards allow you to match patterns instead of exact values, making it easier to suppress recurring or similar events without creating multiple rules.<\/p>\n<p><strong>What are wildcards?<\/strong><\/p>\n<p>Wildcards let you define suppression rules using partial matches rather than exact strings. This is especially useful when values vary slightly, such as file names, paths, or user names.<\/p>\n<p>The following wildcard characters are supported:<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">*<\/code> \u2013 matches any sequence of characters (including empty)<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">*.exe<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">file.exe<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test.exe<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">.exe<\/code><\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">?<\/code> \u2013 matches any single character<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">file?.txt<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">file1.txt<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">fileA.txt<\/code><\/li>\n<\/ul>\n<p>To treat wildcard characters as literal values, use the backslash (<code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">\\<\/code>) as an escape character:<\/p>\n<ul>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">\\*<\/code> \u2013 matches a literal asterisk<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test\\*.txt<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test*.txt<\/code><\/li>\n<li><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">\\?<\/code> \u2013 matches a literal question mark<br \/>\nExample: <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test\\?.txt<\/code> matches <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">test?.txt<\/code><\/li>\n<\/ul>\n<p><strong>Supported parameters<\/strong><\/p>\n<p>Wildcards are supported in suppression rules for Accepted Behavior when matching the following parameters:<\/p>\n<ul>\n<li>Process name<\/li>\n<li>Process path<\/li>\n<li>Process command line<\/li>\n<li>Username<\/li>\n<li>Parent process name<\/li>\n<li>Parent process path<\/li>\n<\/ul>\n<p><strong>How to use wildcards<\/strong><\/p>\n<p>You can create or edit wildcard-based suppression rules in two ways:<\/p>\n<ul>\n<li>From <strong>Events \u2192 Broad Context Detections<\/strong>, when closing a detection as <em>Accepted behavior<\/em> and choosing to create a suppression rule.<\/li>\n<li>From <strong>Security Configurations \u2192 Automated actions \u2192 Suppression rules<\/strong>, by editing an existing rule.<\/li>\n<\/ul>\n<p>In both flows, select <strong>Wildcard<\/strong> for the chosen parameter in the Parameters step, then define the pattern using <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">*<\/code>, <code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">?<\/code>, or escaped characters as needed.<\/p>\n<p>Using wildcards helps reduce rule duplication, keeps configurations cleaner, and makes suppression rules easier to maintain over time<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17.png.webp 942w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-300x293.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-768x749.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-447x436.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-17-150x146.png.webp 150w\" sizes=\"auto, 100vw\" alt=\"image.png\" height=\"919\" width=\"942\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2026-01-27T00:00:00+00:00\">January 27, 2026<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2026-01-27-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2026-01-27 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,<\/p>\n<p>To make it easier for our Japanese MDR customers to work in their native language, we are introducing <strong>AI-powered on-demand translation<\/strong> for communication in <strong>elevated BCDs<\/strong> in Elements.<\/p>\n<p>Starting from <strong>1 February 2026<\/strong>, customers with an <strong>active MDR service<\/strong> and the <strong>Elements user interface set to Japanese<\/strong> will be able to exchange messages with analysts in elevated BCDs in <strong>Japanese<\/strong>, with translations provided on demand by an approved <strong>AI (LLM)<\/strong> service.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/uploads\/2026\/10\/20260127-1437-03-3720739.gif\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/uploads\/2026\/10\/20260127-1437-03-3720739.gif\" alt=\"20260127-1437-03.3720739.gif\" height=\"688\" width=\"1684\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/gif\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p><strong>What is changing?<\/strong><\/p>\n<ul>\n<li>In the <strong>BCD details view<\/strong> in Elements, users will see new options to <strong>translate comments on demand<\/strong>:\n<ul>\n<li>from <strong>English to Japanese<\/strong>, and<\/li>\n<li>from <strong>Japanese to English<\/strong>.<\/li>\n<\/ul>\n<\/li>\n<li>Japanese-speaking users can write and read BCD comments in <strong>their native language<\/strong>, while still being able to request an English version when needed.<\/li>\n<li>Translations are <strong>not automatic in the background<\/strong> &#8211; they are triggered <strong>explicitly by the user<\/strong> for each comment via dedicated translation buttons.<\/li>\n<\/ul>\n<p><strong>What does this mean for you?<\/strong><\/p>\n<ul>\n<li>If you are an MDR customer using Elements in <strong>Japanese<\/strong>, communication in elevated BCDs becomes <strong>clearer, more natural, and easier to follow<\/strong> in your own language.<\/li>\n<li>You keep full control over when translations are requested, allowing you to focus on the comments that matter most.<\/li>\n<li>The way you <strong>work with elevated BCDs in Elements stays familiar<\/strong> &#8211; this enhancement adds a convenient translation capability on top of your existing experience, without introducing new complexity into your daily workflow.<\/li>\n<\/ul>\n<p>We believe this improvement will significantly enhance the day-to-day experience of our Japanese MDR customers and pave the way for further localization and usability enhancements in the future.<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n            <li class=\"wp-block-content-list__item\">\n                            <time class=\"wp-block-content-list__updated\" datetime=\"2025-11-14T00:00:00+00:00\">November 14, 2025<\/time>\n            \n            <a class=\"wp-block-content-list__link\" href=\"https:\/\/support.withsecure.com\/en\/changelogs\/endpoint-security-formerly-endpoint-detection-response-2025-11-14-update\/\">\n                <p class=\"wp-block-content-list__title\">Endpoint Security (formerly Endpoint Detection &#038; Response) &#8211; 2025-11-14 Update<\/p>\n            <\/a>\n\n            \n                            <details class=\"wp-block-content-list__details\">\n                    <summary class=\"wp-block-content-list__summary\">Read more<\/summary>\n                    <div class=\"wp-component-paragraph wp-block-content-list__body\">\n    <p>Dear community,<\/p>\n<p>In line with our plans for unification and streamlining the reporting experience, the <strong>Detection &amp; Response Reports<\/strong> view in Elements has now been transitioned to <strong>read-only mode<\/strong>.<\/p>\n<figure class=\"entry-image display-large float-none\"><a class=\"embedImage-link\" href=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10.png.webp\" rel=\"nofollow noopener ugc\" target=\"_blank\"><img decoding=\"async\" class=\"embedImage-img\" src=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10.png.webp\" srcset=\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10.png.webp 1918w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10-300x143.png.webp 300w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10-1024x487.png.webp 1024w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10-768x365.png.webp 768w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10-1536x730.png.webp 1536w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10-447x213.png.webp 447w, https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/image-10-307x146.png.webp 307w\" sizes=\"auto, 100vw\" alt=\"image.png\" height=\"912\" width=\"1918\" loading=\"lazy\" data-display-size=\"large\" data-float=\"none\" data-type=\"image\/png\" data-embed-type=\"image\"><\/img><\/a><\/figure>\n<p><strong>What does this mean?<\/strong><\/p>\n<ul>\n<li>You can no longer create new schedulers or modify existing ones in the Detection &amp; Response Reports view.<\/li>\n<li>Existing active schedulers will continue to generate reports, and you can still download these reports as usual, until the view is fully removed.<\/li>\n<\/ul>\n<p><strong>What should you do next?<br \/><\/strong><br \/>\nWe encourage you to start using the My Report tab and set up your report there as soon as possible. My Report provides all the same reporting capabilities as the previous view &#8211; and even more. It offers an improved and more intuitive experience, with ongoing enhancements and new features planned. <strong>Moving to My Report now will ensure you have uninterrupted access to your reports and benefit from the latest updates.<\/strong><\/p>\n<p>The complete removal of the Detection &amp; Response Reports view is planned for <strong>Q1 2026<\/strong>.<\/p>\n<p>Thank you for being proactive and embracing these improvements.<br \/>\nWe appreciate your cooperation as we continue to enhance your Elements experience!<\/p>\n<\/div>\n                <\/details>\n                    <\/li>\n    <\/ul>\n\n                            <\/div>\n    <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":0,"featured_media":0,"parent":4744,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-4765","page","type-page","status-publish","hentry"],"acf":[],"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4765","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/types\/page"}],"replies":[{"embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/comments?post=4765"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4765\/revisions"}],"predecessor-version":[{"id":8134,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4765\/revisions\/8134"}],"up":[{"embeddable":true,"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/pages\/4744"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/en\/wp-json\/wp\/v2\/media?parent=4765"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}