How to exclude specific software updates from Software Updater in WithSecure Elements Endpoint Protection?

Issue:

How to create an exclusion for a certain software update with the WithSecure Software Updater feature in the Elements Security Center Portal for EPP for Computers or EPP for Servers devices? I do not want to have Software Updater installing updates automatically or have the user manually installing the update.

Resolution:

Prerequisite: You need to have a non-default profile before you can configure your software updater settings.

You can exclude specific software updates from automatic installation or you can include specific software updates in automatic installation by following these steps:

1. Log in to the Elements Portal: https://elements.withsecure.com
2. Open the Security configurations section from the menu on the left
3. Go to the Profiles page
4. Select the profile you want to modify
5. Go to Software updater settings tab
6. Under Exclude from automatic installation, click Add exclusion
7. Select from the Conditions drop-down menu one of the following:
   • Update name contains
   • Software name contains
   • Vendor name contains 
   • Severity equals to
   • Bulletin ID equals to
8. Then depending on the rule you've chosen, enter the value to the remaining field. Examples:
   • Update name contains: Google Chrome 89.0.4389.82 (Note: for Microsoft updates, do not include the version number. Use for example only the KB number)
   • Software name contains: Google Chrome
   • Vendor name contains: Google Inc.
   • Severity equals to: Critical Security / Important Security 
   • Bulletin ID equals to: FSPM-41-64283-4 (Note: Same update can have several different Bulletin IDs due to for example Operating system version)

You can view the update details from the Software Updater page in the Endpoint Protection Portal.

Note: 

• Only one software per exclusion is supported. If you need to add multiple software, click Add exclusion again.
• You can add several conditions in one rule, if you want to combine for example Software name contains and Severity equals to conditions, click Add condition in the Conditions column.

After the profile has been saved and published, the exclusion/ will be taken into use on the devices that have this profile assigned. 

If you would like to hide the update completely from being detected as missing by Software Updater, you need to exclude it via the following setting in the Endpoint Protection Portal profile editor:

1. Log in to the Elements Portal
2. Under Security Configurations, select Profiles on the sidebar.The Profiles page opens.
3. Select the For Windows Servers tab or For Windows Computers tab, and then select the profile that you want to edit. The Profile for Windows Servers or for Windows Computers opens
4. Select the profile you want to modify
5. Go to Software updater settings tab
6. Scroll down to the Exclude from scanning section
7. Click Add exclusion

When the update is hidden with this rule, the update will not be listed at all in the Software Updates Missing updates tab in the Endpoint Protection portal. It will also not be visible locally on the device for the user.