Top troubleshooting articles

• Performance issues caused by WithSecure endpoint products

  Read more
  View article

  Issue:

  When an WithSecure endpoint product is installed on a computer or server, there is high CPU or memory (RAM) usage and applications are experiencing performance issues. The connectivity of some applications can also be slow or blocked completely. 
  
  Issue affects all WithSecure clients:

  • Elements Endpoint Protection EPP for Computers 
  • Elements Endpoint Protection EPP for Servers 
  • Business Suite Client Security
  • Business Suite Server Security 
  • Business Suite Email and Server Security

  Resolution:

  Performance issues can for example be the result of:

  • Connectivity issues to the Security Cloud
  • Misconfigured Application Control
  • Web Traffic scanning
  • A scheduled scan is running

  
  Connectivity issues to the Security Cloud
  
  What is Security Cloud?
  When Security Cloud is enabled on WithSecure endpoint products, it connects to WithSecure Backend to check reputation and other objects. WithSecure endpoint products have database updates which can detect the malware without connection to cloud, but, to check the reputation we need the cloud connection. There is a local cache, but the reputation is checked first using Security Cloud, since it has the latest information. 

  When you enable Security Cloud, you need to make sure that the endpoints can communicate to Security Cloud:

  • *.withsecure.com
  • *.fsapi.com

  Note: The domains mentioned above needs to be whitelisted to your firewall or proxy. In case you have enabled some proxy in your environment, the client reads it via discovery service and tries to connect to *.fsapi.com through it. 
  
  To test the connectivity, use WithSecure Connectivity Tool, which is available in the installation folders of Elements Endpoint Protection (EPP for Computers and EPP for Servers), Business Client Security and Business Suite Server Security. With the tool you can view the list of addresses the product connects to and check the connectivity towards them. 
  
  The tool is located in the following folder:

  • Client Security: C:\Program Files (x86)\F-Secure\Client Security\ui\fsconnectionchecker.exe
  • Server Security: C:\Program Files (x86)\F-Secure\Server Security\ui\fsconnectionchecker.exe
  • Elements EPP for Computers/Elements EPP for Servers: C:\Program Files (x86)\F-Secure\PSB\ui\wsconnectionchecker.exe

  Misconfigured Application Control
  
  If you have a premium subscription of Business Suite or Elements Endpoint Protection, it will include the Application Control feature. 
  
  If the product is using high amounts of CPU performance, make sure you have not set the Application Control Global rule as Allow and monitor all applications. This setting should be used only during testing to find out which applications need exclusion rules, since it will affect the performance of devices.
  
  Also make sure that you have not created Application control exclusion rules which only include a SHA1/SHA256 as a condition, since the calculation of the SHA1/SHA256 will require some CPU performance. Instead, we recommend using other conditions (such as the target path, etc.) in conjunction with the file hash condition.
  
  Web Traffic Scanning
  
  If you are experiencing performance issues with network based applications, which communicate over HTTP to an internal server, it could be that Web Traffic Scanning (Advanced Network Protection) is causing the issue. Try to temporarily disable Web Traffic Scanning to confirm if the issue is caused by it. If issue was caused by Web Traffic Scanning, you can add the internal servers address and hostname to the Allowed sites list so that the communication between the clients and the internal server is not checked. 
  
  In order to troubleshoot further what part of the product is causing the slow down, try disabling security features one by one:

  1. DeepGuard
  2. Real-time Scanning
  3. Firewall
  4. Browsing Protection
  5. Web Content Control
  6. Web Traffic Scanning
  7. Application Control
  8. DataGuard
  9. Device Control
  10. Software Updater

  Which process is being slowed down, and how is it visible? eg. – fshoster process taking up high CPU usage?
  
  A Scheduled scan is running: 
  
  Make sure that a scheduled scan is not currently running, since a running scheduled scan will use a lot of CPU and memory resources depending on the chosen settings. You can from the Windows Task Manager’s Details tab check if fsscan.exe is running. If fsscan.exe is running, either a scheduled scan or a manual scan is currently being run. 

  Article no: 000013321

• Elements Endpoint Detection and Response (EDR) detects a safe application. How to whitelist the detection?

  Read more
  View article

  Issue:

  WithSecure Elements Endpoint Detection and Response (EDR) detects a safe application (e.g. an in-house application). How to whitelist the detection?

  Resolution:

  You can close the Broad Context Detection (BCD) as “Accepted behavior”, to create suppression rule that can accept the behavior of a user or a process. To do this, you need to follow these steps:

  1. Log in to the Elements Security Center at https://elements.withsecure.com
  2. Expand the EVENTS category on the left pane
  3. Select the Broad Context Detections option
  4. Click on the respective Broad Context Detection to open the details page for this detection
  5. Click on the drop-down menu in the top left corner
  6. Select Closed from the drop-down menu, then select the reason as Accepted behavior
  7. Click on the Create rule button and follow the on-screen instructions

  After this, you can review the suppression rule by following these steps:

  1. Expand the Security Configurations category on the left pane
  2. Select the Automated actions option
  3. Select Suppression rules

  You can find more information regarding this feature in the following community article:
  
  https://community.withsecure.com/en/kb/articles/31324-elements-edr-new-feature-accepted-behavior
  
  If you encounter any issue in creating the suppression rules (such as having more than 5 key detections in the BCD), you can close the BCD as “False positive” by following these steps:

  1. Log in to the Elements Security Center at https://elements.withsecure.com.
  2. Expand the EVENTS category on left pane
  3. Select Broad Context Detections option.
  4. Select the BCD ID that require whitelisting.
  5. Click “Update status” option at bottom page.
  6. Select “Closed” from drop down menu, then select reason as “False positive”
  7. Click “Update” option.

  
  Once you have at least 1 incident that is identical to the incident, and there is no identical incident where status is closed as confirmed, the false positive handling in WithSecure Elements Endpoint Detection and Response (EDR) will close the false-positive automatically.

  Broad context detections can be closed as Auto false positive automatically when they are identical to previously closed false alarms. For WithSecure Elements Endpoint Detection and Response to close a broad context detection as Auto false positive, the following criteria must be met:

  • Incident has to be New / Unconfirmed,
  • you must have closed an identical incident in the same organization as False positive, and
  • no identical incidents in the same organization have been Confirmed.

  More information about automatic handling of incidents can be found here. 

  In the event that this has been completed multiple times and the file still gets detected, make a whitelist request for the False Positive event in the Elements Security Center by doing the following:

  1. Select Support
  2. Select Request for allowlisting
  3. Verify that the following fields are populated correctly: 
     • Problem Category -> Threat/Malware
     • Problem Subcategory -> False Positive
     • Product Name -> Elements Endpoint Detection & Response
     • Language -> English
  4. Under Describe the problem in detail, provide 3-5 example Broad Context Detection ID (BCD-ID), a reason for why this content should be whitelisted and the scope (single host, company level, etc.)
  5. Fill in the rest of the required case information. Correct and complete information helps us to identify you and provide you with the proper service level
  6. Click Submit to open the support ticket

  Article no: 000013764

• Getting an error of "Your login to WithSecure™ Partner Portal failed." when logging into Partner Portal

  Read more
  View article

  Issue:

  Getting an error of “Your login to WithSecure™ Partner Portal failed. Please try using a different browser, or you can open a support ticket at: https://www.withsecure.com/en/support ” when logging into Partner Portal.

  Resolution:

  This error message appears typically when user has an existing WithSecure user account, but that account does not have the access rights on it for the Partner Portal. If you have several user accounts, it could be that you are for example logged in to Elements portal with an account that doesn’t have Partner Portal access rights. If you then in the same session try to log in to Partner Portal, it will automatically try to log in with the account you are logged in with in Elements portal. Try to therefore close the browser window or open an incognito window before trying to log in again. 
  
  If you do not have Partner Portal access rights and you need them, an existing user with Partner Portal administrator access rights can add you as a user: https://community.withsecure.com/en/kb/articles/32823-adding-new-users-to-the-partner-portal

  If you have been given Partner Portal access rights and received the Welcome email but you are still unable to login to the portal:

  • If you have no WithSecure user account (for example Elements Endpoint Protection, Collaboration Protection or Vulnerability Management user account) from before, make sure you have created one using the registration process from the Welcome email you have received. The registration email is sent from crm-admin@withsecure.com. The account can be created from the following page if you already have received the welcome email https://portal.withsecure.com/signup Use the same email address that you used to request the access rights.
  • If you have had a WithSecure user account from before and now receive this error message when logging in to Partner Portal after receiving the Welcome email, open a support request so that we can check the status of your account’s user rights. 
  • If you have several WithSecure user accounts, try to open an incognito / inprivate window in your browser and then try to log in again. 
  • if you have a network wide ad-blocker active (e.g. Pi-Hole), this is known to cause problems for the login. Try disabling or bypassing this solution.

  If you do not receive the Welcome email in your Inbox, please check your spam/junk email folder as it could be filtered by accident and if there is any rule to move mail from subfolders in Outlook.

  Article no: 000014557

• How to reset two factor authentication (2FA) for a WithSecure Business Account (Elements, Partner Portal, eService Portal) user account

  Read more
  View article

  Issue:

  How to reset two factor authentication (2FA) for a WithSecure Business Account (Elements, Partner Portal, eService Portal) user account. 
  
  Example scenarios:

  • User has a new mobile device and wants to move or transfer the authenticator to the new device 
  • Device that had the multi factor authentication (MFA) application broke or has been lost 

  Resolution:

  If you still have access to the old authenticator device, you can move the authenticator to a new device by logging in with the existing authenticator to the Elements portal, where you can remove the old authenticator and add a new one: 

  1. Log in to the Elements portal: https://elements.withsecure.com
  2. Click on the user icon in the top-right corner 
  3. Go to My settings 
  4. Click on the Change button on the right side of the Multi-factor Authentication enabled text
  5. Log in with your existing authenticator codes
  6. Click on the Remove button on the right side of the Google authenticator or similar text
  7. Confirm the removal by authenticating again with your username, password and authenticator code

  Once the existing authenticator has been removed, simply click on the add button to add your new authenticator.
  
  Note: Partner Portal and eService Portal users can also log in to the Elements portal and change the MFA settings.
  
  If you do not have access to the old device, ask another administrator to delete your user account and then they can create a new administrator account for you.  Your administrator rights must be removed from each Elements product you have access to:

  • Elements Endpoint Protection
  • Elements Vulnerability Management / Elements Exposure Management
  • Elements Collaboration Protection
  • Elements Administration
  • Extended Detection and Response

  NOTE: Only users with access rights to Elements Endpoint Protection can be deleted.

  To proceed, follow these steps:

  1. Log in to the Elements Security Center
  2. Navigate to Management > Organization Settings > Security Administrators
  3. Click on the user you want to delete
  4. Disable all the access rights listed above
  5. Click Save

  NOTE: If you are a WithSecure partner with access to the Partner Portal or a WithSecure customer with access to the eService Portal using the same user account, you need to contact Customer Care to have the account removed. 

  
  If you’re the only administrator on the Elements account, or the other administrators do not have necessary access rights to create new administrator user accounts, contact WithSecure Customer Care for further assistance.

  Article no: 000013157

• Request for registration.json offline token to activate a Policy Manager which is in an isolated or offline environment

  Read more
  View article

  Issue:

  I would like to register my Policy Manager Server which is not connected to a network (offline), how do I proceed?

  Resolution:

  1. Contact WithSecure support by opening a support request here.
  2. Provide the following information for WithSecure technical support to create an offline registration file:

  • Account Name
  • Customer ID
  • Installation ID 
  • Business Suite license Expiry date

  How to obtain Customer and Installation ID:

  Policy Manager for Windows

  • Open Policy Manager console, and go to Help menu > Registration dialog, or;
  • Find the information from the Policy Manager Server installation folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\upstream-statistics.json
  • Note: the folder C:\ProgramData\ by default is a hidden folder. To workaround this issue, copy/paste the name of the folder C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data\to an File Explorer window to view the content of set folder.

  Policy Manager for Linux:
      Please refer 
       /var/opt/f-secure/fspms/data/upstream-statistics.json

  
  Notes:
  “upstream-statistics.json” file is created by Policy Manager when it attempts to connect to the registration backend (corp-reg.f-secure.com) and it keeps updating daily on each attempt to check the license. You should not create or edit the Customer ID and Installation ID in the upstream-statistics.json file directly because it is not intended to be edited manually.
  
  Once support has provided you with an offline registration file, use the following steps to activate it on your Policy Manager Server. 
  This file is actually created based on the ordered period or expiry date in the license certificate and there is no other license file used by Policy Manager Server for registration.
  
  Windows:
  
  Policy Manager for Windows:

  1. Copy the offline registration file registration.json to the folder: C:\ProgramData\WithSecure\NS\Policy Manager\Policy Manager Server\data
  2. Restart the WithSecure Policy Manager Server service by typing the following commands in an elevated command prompt (CMD)
     • net stop wspms
     • net start wspms

  
  Linux:

  1. Copy the offline registration file to registration.json the folder /var/opt/f-secure/fspms/data 
  2. Restart the fspms daemon:

  • # /etc/init.d/fspms restart

  If the registration.json file disappears from data folder, the activation was successful and Policy Manager is activated until the expiry of your current subscription. After renewing the subscription you need to request a new registration token from support. There is no need to change the permissions for the registration.json file as file inherits proper permissions from the parent folder data.
  Make sure to do this some time in advance so that you don’t end up with an expired Policy Manager Server.

  Article no: 000013614