Elements Endpoint Detection and Response topic index

Open the interactive Elements Endpoint Detection and Response user guide

Topics that several products share are listed under the product that owns them.

• WithSecure Elements Endpoint Detection and Response
• Get started with WithSecure Elements Security Center
• Logging in
• Log in to non-federated domains
• MFA methods
• Choose multi-factor authentication
• About access rights
• Add a new service partner
• Change your account details
• Adding a customer company
• Order products for an existing customer company
• View available product subscriptions
• Set up federated single sign-on with Microsoft Entra ID
• Send an installation link via email
• Elements Endpoint Detection and Response overview
• Get started with WithSecure Elements Endpoint Detection and Response
• Key features
• Broad Context Detections
• Deploying endpoint sensors on organization devices
• System requirements
• Preinstallation recommendations
• Deployment methods for Windows
• Deploy manually using an EXE file
• Deploy manually using an MSI file
• MSI properties
• Invite users by email
• Deploy via Active Directory GPO
• Deploy using Microsoft Intune as a line-of-business (Windows)
• Prepare the installer package for Intune
• Deployment in persistent mode on Virtual Desktop Infrastructure (VDI) systems
• Prepare a golden image
• Deployment methods for Mac devices
• Automatic installation, activation and configuration of the product
• Install the product automatically
• Common distribution scenarios
• Use MDM profiles to set up the product
• Deployment methods for Linux devices
• Installing the product for use with WithSecure Elements
• Install the product using a DEB or RPM package
• Handling common use cases
• Use the WithSecure MSI transformation tool
• Reinstallation of Elements Agent without duplicating devices
• Investigating detections and responding to incidents
• Investigate Broad Context Detections
• Advanced incident investigation with Event Search
• Use Event Search
• Save your Event Search view
• Risk level score
• Change the importance of monitored hosts
• Automatic device profiling
• Investigate software
• Respond to detections
• Closed resolutions for broad context detections
• Turn on advanced response actions
• Create a response action
• Investigative actions
• Retrieve files (Win, Lnx, Mac)
• Retrieve PowerShell history (Win)
• Retrieve event log entries (Win)
• Retrieve event log files (Win)
• Retrieve event log tracing entries (Win)
• Retrieve anti-virus logs (Win)
• Retrieve browser artefacts (Win)
• Retrieve jumplist files (Win)
• Retrieve MFT (Win)
• Retrieve RDP cache files (Win)
• Retrieve registry hives (Win)
• Retrieve System Resource Usage Monitor database (Srumdb) (Win)
• Map registry (Win)
• Retrieve MBR (Win)
• Retrieve Amcache (Win)
• Retrieve Prefetch (Win)
• Retrieve Recently Accessed (Win)
• Map file system (Win, Lnx, Mac)
• Netstat (Win, Lnx, Mac)
• Enumerate processes (Win, Lnx, Mac)
• Enumerate scheduled tasks (Win)
• Enumerate services (Win)
• Enumerate WMI persistence (Win)
• Process memory dump (Win, Lnx)
• Full memory dump (Win, Lnx)
• Test connections (Win)
• Containment actions
• Kill process (Win, Lnx, Mac)
• Kill thread (Win)
• Remediation actions
• Delete files (Win, Lnx, Mac)
• Delete registry (Win)
• Delete scheduled tasks (Win)
• Delete services (Win)
• Remove permission (Win)
• Delete WMI persistence (Win)
• Response action output formats
• Automate responses to detections
• Manage suppression rules
• Edit suppression rules
• Suppress detections individually
• Using wildcards in suppression rules
• Viewing suppression rules
• Isolate hosts from the network
• Isolate a single device from the network
• Release hosts from the isolation
• Elevating incidents to WithSecure
• Elevate an incident
• Elevation status of a BCD
• Collect forensics packages
• Forensics package contents
• Automatic false positive closure
• Set up detection alerts
• Events that generate detection alerts
• Create customized email reports on security events
• Best practices
• Check the overall state of monitored organizations
• Check the status of applications in monitored companies
• Acknowledge an incident
• Respond to a targeted attack
• Incident types
• Abnormal file accesses
• Abnormal file modification
• Abnormal library or module
• Abnormal location
• Abnormal network connection
• Abnormal parameters
• Abnormal privileges
• Abnormal process
• Abnormal processes relation
• Abnormal process execution
• Abnormal user activity
• Anomaly
• Backdoored file
• CC network connection
• Changing file visibility
• Changing security settings
• Changing user information
• Cloud
• Compromised clean process
• Creating attack tools
• Credential theft
• Directed attack
• Injection
• Injection target
• Lateral movement
• Lateral movement initiator
• Lateral movement target
• Log anomalies
• Malicious parameters
• Malicious process
• Malware
• Persistence
• Phishing
• Privilege escalation
• PUP (Potentially Unwanted Programs)
• Recon activities
• Scripting abuse
• Sensitive file modification
• Sensor tamper
• Spoofing files
• Spoofing inputs
• Spoofing memory
• Spoofing network
• Spoofing security settings
• Spoofing user information
• Spoofing vulnerabilities
• System or tool misuse
• Testing the service
• Run a simple test with Windows system tools
• Run an advanced test with Powershell
• Support
• Report false positives

All user guide topic indexes