All charts in the reports page can now be exported as SVG files<\/p>\n Device history<\/strong><\/p>\n Added a history log of device data changes to device details.<\/p>\n Currently supported fields are: Overall protection, Software updates status, Network isolation, Reboot needed, Assigned profile, Profile assignment state, IP addresses, Public IP, Last user and UPN.<\/p>\n Changes to saved views<\/strong><\/p>\n Custom views can now be shared by using the “Move to organization views” button. Organization views are visible to all admins at the same organization level.<\/p>\n It is now possible to set a view as default. Default view will be applied by default the next time you log into portal.<\/p>\n Organization and system views can now be hidden.<\/p>\n Device details now has an option to Connect with RDP<\/strong><\/p>\n It is now possible to connect with RDP to computers directly from Elements portal.<\/p>\n Please Note: <\/strong>This features requires a premium subscription.<\/p>\n Export affected devices<\/strong><\/p>\n It is now possible to export the list of affected devices from flyout for selected missing updates.<\/p>\n Software updates installation log changes<\/strong><\/p>\n The log now shows separate column for KB ID<\/p>\n Elements Security Center\u00a0scope management has been introduced. This changes the way how WithSecure Elements Security Center is used to manage multiple Companies under Solution Provider (SOP) or Service Partner (SEP) organisation.<\/p>\n All companies under same organisation hierarchy<\/strong><\/p>\n Elements Security Center has one organisation hierarchy. This is tree like three level hierarchy to help to manage large amount of companies. With Elements scope management this three level hierarchy is shared and synchronised across all Elements security capabilities.<\/p>\n Elements scope selector user interface component visualises organisation hierarchy and highlights what types of subscriptions each company has (see picture below).<\/p>\n Here “Data Fellows Security” is top level Solution Provider (SOP) organisation having multiple companies under it. Elements scope selector shows indicator of subscription type within company and shows union of available subscription types for Solution Provider and Service Partner organisations.<\/p>\n In the example “BE Consultancy Services” company has Endpoint Protection, Endpoint Detection and Response, and Vulnerability management subscriptions (highlighted icons). “BE Consultancy Services” does not have Collaboration Protection or Cloud Security Posture Management subscriptions (dimmed icons).<\/p>\n Synchronised scope selection<\/strong><\/p>\n With these improvements scope selection within Elements is fully synchronised between different parts of the Elements Security Center. This means that when you change organisation while being in Endpoint Protection dashboard and then move to any other part of Elements Security Center e.g. to Collaboration Protection dashboard your organisation selection is always preserved until you explicitly pick another organisation scope.<\/p>\n Menu synchronisation<\/strong><\/p>\n Navigation menu of Elements Security Center adapts to features that are available for selected organisation and current user.<\/p>\n Sample below shows navigation menu behaviour when selected organisation has limited set of subscriptions available.<\/p>\n The company called “Computational Fluid Dynamics” only has Endpoint Protection and Endpoint Detection and Response subscriptions so other Elements security capabilities are not available due to missing subscription. Common management functionalities are available for all organisations.<\/p>\n In cases where organisation has subscription but users access to given security capability is limited this is indicated in Elements menu with “No access”. In sample below user does not have access role to Cloud Security Posture Management while organisation does have subscription for it.<\/p>\n It is also possible that company organisation has\u00a0restricted<\/em>\u00a0Solution Provider and Service Partner access to their company data. These cases are indicated with “Restricted” label in corresponding menu item (see sample below).<\/p>\n A new version of the endpoint client for Windows is available. This release makes the Elements Agent version 23.5 available (internal version 23.5.378).<\/p>\n The endpoints automatically upgrade, without a reboot.<\/p>\n WithSecure Rollback<\/strong><\/p>\n We have added a new feature to the client, which can rollback unwanted changes in the unlikely event that some malware has been allowed to run.<\/p>\n Remote change of local exclusion lists<\/strong><\/p>\n It is now possible to remotely change local exclusion lists, directly from the Elements Security Center.<\/p>\n Remote Action to restart Elements Agent<\/strong><\/p>\n We have added a new remote operation to restart Elements Agent right from the Elements Portal. Restarting services allows to fix various client problems without making a system reboot.<\/p>\n CPU information reported to Security Center<\/strong><\/p>\n The Elements Agent now reports CPU information to the portal<\/p>\n Agent includes more information to Elements Security Center<\/strong><\/p>\n The Agent now sends more information about shared folders and logged in users to the portal<\/p>\n Client now reports if RDP is enabled on client<\/strong><\/p>\n The agent reports if the RDP services is enabled on the client, allowing the Elements Security Center to show an option to login with RDP<\/p>\n WithSecure Elements EDR has launched new response actions.<\/p>\n The new response actions include:<\/p>\n These new response actions focus on identifying if persistence has been achieved on endpoints and provides a quick way for detection teams to collect this information.<\/p>\n The new response actions can be easily found using the search functionality within the Response wizard. <\/p>\n As with all other Response actions, these can run simultaneously on multiple devices with one response definition and results (from the selected devices) available and stored within the Elements portal.<\/p>\n A new way to suppress noise has been implemented to XDR Detection pipeline. After this change was applied, the incident (aka BCD) creation delays have been much less than before!<\/p>\n Closed – False Positive<\/strong>: The incident has been closed and is no longer monitored. The detection was not malicious.<\/p>\n Closed – Auto False Positive<\/strong>: The incident has been closed automatically as false positive based on identical incidents that have been closed as false positive. <\/p>\n To optimize system performance, an automated suppression mechanism will activate if any detection part of an incident marked as false positive repeats more than 4 days within a 30 days period, or repeats more than 5 times a day.<\/p>\n If later an incident earlier marked as False positive is marked as Confirmed, all identical incidents are automatically reopened. In such event also the automated suppression mechanism would be deactivated for future detections.<\/p>\n In June the Collaboration Protection team completed the sequence of improvements on the product backend and infrastructure systems. These improvements are set of long lasting and architectural changes covering switch to multi-tenancy, recovering on critical points, overcoming technical limitations and technical debt.<\/p>\n The key outcomes of these changes are:<\/p>\n The following capabilities were added to authenticated scanning for Windows:<\/p>\n Added an activity log for the deletion of asset alias events<\/strong><\/p>\n This log provides visibility into the actions taken when an asset alias is deleted, allowing for better tracking and auditing of asset management activities.<\/p>\n Added event logging functionality for enabling and disabling agent scanning.<\/strong><\/p>\n The old invitations endpoints are deprecated and should be replaced by the new Elements devices endpoints:\u00a0 <\/p>\n The following Endpoint Protection API invitation endpoints will stop working on 03.11.2023:<\/p>\n Reminder: In order to provide a better and unified set of APIs for WithSecure Elements, we are progressively deprecating the\u00a0Endpoint Protection API<\/a>\u00a0and replacing it by\u00a0Elements API<\/a>. The following endpoints will reach their end of life soon as indicated earlier in this change log:<\/p>\n Update Service Partner (SEP) name<\/strong><\/p>\n This new API call allows to change an existing Service Partner(SEP) name by using the unique identifier as described in this link<\/a>.<\/p>\n New properties have been added to to\u00a0<\/strong>device list endpoint<\/strong><\/a><\/p>\n Manage devices<\/strong><\/p>\n New endpoints have been published:<\/p>\n List incidents<\/strong><\/p>\n A new endpoint has been published:<\/p>\n Monthly highlights<\/strong><\/p>\n Newly introduced top-level domains<\/strong><\/p>\n The report highlights the dangers associated with newly introduced top-level domains and how they can be exploited by cybercriminals to launch phishing attacks and other malicious activities.<\/p>\n Bypassed vulnerabilities in Microsoft Outlook<\/strong><\/p>\n The report discusses a recent vulnerability in Microsoft Outlook that was patched but could still be bypassed due to a bug in the HTML platform. This vulnerability could allow attackers to execute malicious code on affected systems.<\/p>\n Actively exploited vulnerabilities in common WordPress plugins<\/strong><\/p>\n The report identifies several actively exploited vulnerabilities in common WordPress plugins, including a high-severity reflected cross-site scripting (XSS) flaw in the Advanced Custom Fields plugin.<\/p>\n The growing infostealer marketplace<\/strong><\/p>\n The report provides an update on the state of the growing infostealer marketplace and how it is being used by cybercriminals to steal sensitive information from individuals and organizations.<\/p>\n The state of hacktivist groups<\/strong><\/p>\n The report provides a brief update on the state of so-called hacktivist groups and their activities, including recent attacks against government agencies and corporations.<\/p>\n The current state of ransomware<\/strong><\/p>\n Finally, the report takes a closer look at the current state of ransomware and identifies several newcomers to this growing threat landscape.<\/p>\n Download the complete report<\/strong><\/a><\/p>\n Our purpose is to co-secure the world with you \u2013\u00a0now as WithSecure\u2122. To co-create the best possible cyber security products and services, we warmly recommend you share your ideas via our Ideas Portal, now accessible directly from WithSecure\u2122 Elements Security Center.<\/p>\n Changelogs and Release Notes for all parts of WithSecure\u2122 Elements can be found at the\u00a0Help Center\u00a0<\/a><\/p>\n![\"Picture1.png\"](\"https:\/\/support.withsecure.com\/wp-content\/smush-webp\/2026\/10\/picture1-10.png.webp\")
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements scope management.<\/h2>\n
Elements scope management<\/strong><\/h3>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Protection<\/h2>\n
Elements Agent for Windows and Server new version 23.5<\/h3>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nElements Endpoint Detection and Response<\/h2>\n
New response actions released.<\/h3>\n
\n
<\/img><\/a><\/figure>\nNew automated way to suppress repeating false positives<\/h3>\n
Elements Collaboration Protection<\/h2>\n
\n
Elements Vulnerability Management<\/h2>\n
System Scan<\/h3>\n
\n
Elements Vulnerability Management Portal<\/h3>\n
<\/img><\/a><\/figure>\n<\/img><\/a><\/figure>\nIntegrations<\/h2>\n
Endpoint Protection API: Provisioning invitations endpoints end of life on 3rd of November 2023<\/h3>\n
\n
\n
Provisioning API<\/h3>\n
Elements API<\/h3>\n
\n
\n
\n
Other items of interest<\/h2>\n
Monthly Threat Highlights Report: May 2023<\/h3>\n
In case you missed it<\/h2>\n
Share your ideas with us<\/h3>\n
<\/img><\/a><\/figure>\nFurther information<\/h2>\n