Endpoint Detection and Response

nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Can specific devices be excluded from being isolated automatically by the EDR Automated actions rule?
Issue: We have set up the Endpoint Detection and Response (EDR) Automated actions rule so that it automatically isolated devices from the network which have a received a Broad Context Detection that matches a specific risk level threshold. We don't want for example our critical servers to ever be automatically isolated…
Elements EDR Advanced response task shows "Failed" status
Issue: After creating an advanced response task for Elements Endpoint Detection and Response (EDR), the State is shown as Finished but the Progress column shows the task Failed. What can cause the advanced response task to fail? Resolution: If the EDR advanced response tasks fail, first you need to make sure that…
Elements EDR automated actions feature did not isolate device from the network
Issue: We have a device isolation rule created with the automated actions feature for Elements Endpoint Detection and Response (EDR) that should isolate the device from the network, but after a Broad Context Detection (BCD) occurred on a device, either: * The automated actions device isolation rule did not trigger at all *…
Can specific or particular EDR Broad Context Detections be removed or deleted from the Elements portal?
Issue: Can we remove or delete specific or particular Elements Endpoint Detection and Response Broad Context Detections (BCDs) from the Elements Security Center portal's Events > Security Events page. Resolution: Broad Context Detections cannot be fully deleted or removed from the Elements Security Center portal's Events >…
How to in the Elements portal list only devices with the a Critical importance level?
Issue: How to in the Elements Security Center portal on the Environment > Devices list show only EPP and EDR devices that have been assigned the Critical importance level? Resolution: You can on the Environment > Devices page in the Elements Security Center portal use a filter to only show devices with a specific…
Does the Elements Endpoint Detection and Response (EDR) sensor need to reach the Internet to work?
Issue: Is the Elements Endpoint Detection and Response (EDR) sensor required to connect to the Internet and / or WithSecure back-end services to work? Resolution: The Elements Endpoint Detection and Response sensor needs to be able to reach the internet and the WithSecure back-end services to work, since the detections are…
Elements EDR for Computers local settings are missing
Issue: We have installed Elements Agent using an EDR subscription key. Why are the local settings in the Elements Agent user interface missing? Resolution: When Elemenst Agent has been installed using an EDR for computers or EDR for Servers subscription key, the local Elements Agent user interface does not include any…
Do Elements EDR and EPP require a connection to the Amazon Web Services addresses (*.amazonaws.com)?
Issue: Do Elements Endpoint Detection and Response (EDR) and Elements Endpoint Protection (EPP) connect to the Amazon Web Services addresses (*.amazonaws.com)? I notice that the connectivity to some *.amazonaws.com addresses on port 443 and 8883 are listed, when running the WithSecure Connectivity Tool. Resolution:…
Can a device be released locally from network isolation if automated action has isolated it?
Issue: If a device has been isolated from the network due to a high or severe risk level EDR Broad Context Detection, can a device be released locally from network isolation if the automated actions feature has isolated it? Resolution: If a device has been isolated from the network by the Automated actions rule, the device…
How to list only a specific device's detections on the Broad Context Detections page in the Elements portal?
Issue: How to list only a specific device's detections on the Events > Broad Context Detections page in the Elements Security Center portal? There is no "device name" filter option Resolution: On the Events > Broad Context Detections page there is a Data content filter option, which can be used to show specific strings…