Support articles

Find clear, step-by-step solutions to common WithSecure issues across installation, configuration, updates, and product performance.

How to configure the automatic action on infection when Elements Agent detects a malicious file?

Issue:

How to configure the automatic action on infection when Elements Endpoint Protection Agent detects a malicious file?

Resolution:

The action on infection for Elements Endpoint Protection is by default is set to 'Quarantine'. To modify this setting:

  1. Log in to the Elements Security Center portal
  2. Navigate to the Security Configurations > Profiles page
  3. Click on the profile that is in use on the device
  4. Go to the Real-time scanning settings page
  5. Scroll down to the File scanning section
  6. Select desired action from the Action on infection drop-down menu: 
    1. Device action on infection automatically
    2. Rename
    3. Delete
    4. Disinfect
    5. Quarantine
    6. Ask after scan
    7. Block
  7. Click Save profile

Note that riskware and spyware have their own separate "action on riskware" and "Action on spyware" settings. If a detected file is not following the action set for infection, please check from the Events > Security Events page if the detected file is classified as either riskware or spyware.