Elements Connector
Getting Started Guideii | Contents | Elements Connector

Contents

Chapter 1: Introduction........................................................................3
Chapter 2: Deploying Elements Connector.........................................4
2.1 System requirements...................................................................................................................5
2.2 Installing Elements Connector on Windows.................................................................................5
2.2.1 Command-line parameters and MSI properties.................................................................6
2.3 Installing Elements Connector on Linux.......................................................................................6

Chapter 3: Managing Elements Connector via the portal..................8
Chapter 4: Configuring Elements Connector as a proxy..................10
4.1 Configuring Elements Connector as a proxy using commercial certificates...............................11
4.2 Configuring Elements Connector as a proxy using self-generated certificates...........................114.2.1 Overriding properties for the self-generated certificates...................................................12
4.3 Changing the default port values on Elements Connector..........................................................13
4.3.1 Changing the default port value in Windows.....................................................................13

Chapter 5: Configuring event forwarding.........................................14
5.1 Configuring API access for Elements Connector........................................................................15
5.2 Configuring event forwarding settings........................................................................................15

Chapter 6: Troubleshooting...............................................................17

Chapter1
Introduction
Elements Connector is an on-premise product that serves three
purposes.
•••Elements Connector optimizes traffic between the managed
endpoints in your environment and WithSecure services by caching
Software Updater, malware definition updates, and program
upgrades. If you download all these updates directly from theinternet, your device consumes a huge amount of external traffic.
To reduce the costs, you can use WithSecure caching endpoint,
which downloads the requested files only once and then distributes
them to the devices within your network.
The Elements Connector Ultimate proxy acts as a proxy for all traffic
between WithSecure endpoints and cloud services simplifying
firewall configurations and allowing the use of WithSecure products
in semi-closed environments.
For companies that use security monitoring services such as Splunk,
Elements Connector provides security events forwarding fromWithSecure cloud services to security information and event
management (SIEM).

Elements Connector in its proxy role replaces WithSecure Policy
Manager Proxy. The most important improvements over the previous
product are automatic upgrades and support for centralized
manageability from the WithSecure Elements Security Center.
Related tasks
Replacing Endpoint Proxy on Windows
Replacing Endpoint Proxy on Linux

4 | Deploying Elements Connector | Elements Connector

Chapter2
Deploying Elements Connector
Topics:•••System requirements
Installing Elements Connector on
Windows
Installing Elements Connector on
Linux

Instructions on how to deploy the product.

Elements Connector | Deploying Elements Connector | 5

2.1 System requirements
The following shows the recommended requirements for installing and using the product.
System requirements for Windows:
One of the following Windows operating systems:
•
•
•
•
•
•
•
•

Windows Server 2008 R2 with latest SP1; Standard, Enterprise or Web Server editions
Windows Server 2012; Essentials, Standard or Datacenter editions
Windows Server 2012 R2; Essentials, Standard or Datacenter editions
Windows Server 2016; Essentials, Standard or Datacenter editions
Windows Server 2019; Essentials, Standard or Datacenter editions (Server Core is supported)
Windows Server 2022; Essentials, Standard or Datacenter editions (Server Core is supported)
Windows 10
Windows 11

System requirements for Linux:
One of the following 64-bit Linux platforms:•

Alma Linux 8•

CentOS 7, 8•

Debian 9, 10, 11, 12•

openSUSE Leap 43, 15•

Oracle Linux•Red Hat Enterprise Linux 6, 7, 8•

Rocky Linux 8•

SuSE Linux Enterprise Server 11, 12, 15•

SuSE Linux Enterprise Desktop 11, 12, 15•

Ubuntu 16.04, 18.04, 20.04, 22.04, 24.04 LTS

Hardware requirements for both Windows and Linux:••••

Processor: Dual-core 2GHz CPU or higher
Memory: 4 GB RAM
Disk space: 10 GB of free disk space
Network: 100 Mbit network

2.2 Installing Elements Connector on Windows
Follow these instructions to install WithSecure Elements Connector in your managed environment on
Windows.
To download and install Elements Connector:
1. In the WithSecure Elements Endpoint Protection portal, go to the Downloads page and click MSI under
WithSecure Elements Connector > Windows.
2. Save the downloaded .msi file to the computer where you want to install Elements Connector.
3. On the command line, locate the installation .msi file and run the following command:
installer.msi VOUCHER=<subscription key>
Replace <subscription key> with a valid subscription key for Elements Connector. You can findyour subscription key on the Subscriptions page in the WithSecure Elements Endpoint portal.

6 | Deploying Elements Connector | Elements Connector

4. Complete the installation wizard.
After installation, if you want to use event forwarding, you have to configure the API access and assign a
profile with the event forwarding settings before using the product.
Note: To check whether Elements Connector is correctly installed, open the following URL in your browser:
https://localhost/.If Elements Connector is installed and working properly, the Elements Connector welcome
page opens.
Related concepts
Configuring event forwarding on page 14

2.2.1 Command-line parameters and MSI properties
When installing WithSecure Elements Connector using an .msi package, you can use the command-line
parameters and MSI properties listed here.
MSI property

Explanation

VOUCHER

Sets the subscription key.
Format: VOUCHER=<subscription key>

PROXY_SERVER

Overrides proxy to use for downloads.
Format: PROXY_SERVER=<url>
Note: If you did not use the PROXY_SERVER parameter during
the installation or you need to edit the proxy value after the
installation, set it in
c:\ProgramData\WithSecure\NS\ElementsConnector\data\fspms.proxy.config as follows and restart the Elements
Connector service:
http_proxy=http://proxy-server-address:80

Elements Connector supports the use of multiple HTTP-proxies that you can configure at once. This allows
for proxy redundancy, which means that Elements Connector can switch to a next proxy in the list if thecurrent one has connectivity issues. You can configure a list of multiple proxies using the MSI properties(PROXY_SERVER) or fspms.proxy.config (http_proxy=...). You can also configure multiple proxies via
the Elements Connector profile in General settings > Internet connection > HTTP proxy.
Note: When adding several proxy addresses in a row, use semicolon to separate them, for example:
http://proxy-server-1:80;http://proxy-server-2:80;http://proxy-server-3:80

2.3 Installing Elements Connector on Linux
Follow these instructions to install WithSecure Elements Connector in your managed environment on
Linux.
To download and install Elements Connector:
1. In the WithSecure Elements Endpoint Protection portal, go to the Downloads page and click DEB or
RPM under WithSecure Elements Connector > Linux.
2. Save the downloaded .deb or .rpm file to the computer where you want to install Elements Connector.
3. On the command line, locate the installation .deb or .rpm file and run the following command as theroot user:

Elements Connector | Deploying Elements Connector | 7•

Debian, Ubuntu:# dpkg -i elements-connector.deb•

Red Hat, CentOS, SuSE, Oracle Linux:# rpm -i elements-connector.rpm

Note: Elements Connector requires Linux capabilities library. Make sure it is installed before installing
Elements Connector. SUSE Linux Enterprise Server 11 and SUSE Linux Enterprise Desktop 11
administrators might need to explicitly enable Linux File System Capabilities by adding 'file_caps=1' asa kernel boot option (see SUSE Linux Enterprise Server 11 release notes for more details:
https://www.suse.com/releasenotes/x86_64/SUSE-SLES/11-SP4).
4. Configure and start Elements Connector by running the following script as the root user:# /opt/f-secure/fspms/bin/fspms-config
Note: To set the HTTP proxy address, edit
/var/opt/f-secure/fspms/data/fspms.proxy.config as follows and restart the Elements
Connector service: http_proxy=http://proxy-server-address:80
Note: On the second configuration step, you must enter a valid subscription key for Elements Connector.
You can find your subscription key on the Subscriptions page in the WithSecure Elements Endpoint
portal.
Elements Connector supports the use of multiple HTTP-proxies that you can configure at once. This
allows for proxy redundancy, which means that Elements Connector can switch to a next proxy in thelist if the current one has connectivity issues. You can configure a list of multiple proxies using the MSI
properties (PROXY_SERVER) or fspms.proxy.config (http_proxy=...). You can also configure multiple
proxies via the Elements Connector profile in General settings > Internet connection > HTTP proxy.
Note: When adding several proxy addresses in a row, use semicolon to separate them, for example:
http://proxy-server-1:80;http://proxy-server-2:80;http://proxy-server-3:80

8 | Managing Elements Connector via the portal | Elements Connector

Chapter3
Managing Elements Connector via the portal
You can manage Elements Connector via the WithSecure Elements
portal.
Via the portal, you can add Connector devices, assign profiles, view
their status and details, such as assigned profile and device properties.
Device properties also highlight Connector operational issues, forexample, low disk space and expired certificates.
For more details on how to configure computer and server profiles andto make sure that they use the Connector, go to the WithSecure
Elements help at WithSecure Elements Endpoint Protection | Elements
Endpoint Protection | Latest | WithSecure User Guides.

Elements Connector | Managing Elements Connector via the portal | 9

10 | Configuring Elements Connector as a proxy | Elements Connector

Chapter4
Configuring Elements Connector as a proxy
Topics:•••Configuring Elements Connector
as a proxy using commercial
certificates
Configuring Elements Connector
as a proxy using self-generated
certificates
Changing the default port values
on Elements Connector

For using Elements Connector as a proxy, you need to install it on acomputer that has access to the internet and is accessible by yourcompany endpoint computers.
Elements Connector supports two independent modes: caching modeand ultimate mode:••

In the caching mode, Elements Connector implements native
support for WithSecure malware definitions and software update
distribution protocols that allows an effective optimization of theinternet traffic.
In the ultimate mode, Elements Connector acts as a proxy for all
traffic between WithSecure endpoints and cloud services, including
the centralized management capabilities, cloud lookups (Karma &Mind), EDR, and other features.

The solution allows you to use WithSecure products in semi-closed
environments where endpoints are not allowed to access the internet
directly. Elements Connector restricts an outbound connection only to
WithSecure cloud services. Therefore, separate firewall configurations
are not required.
For the endpoint computers to use Elements Connector as a cachingproxy, you must specify its address in the profile settings of the
WithSecure Elements Connector endpoint computers.
For the endpoint computers to use Elements Connector as an ultimate
proxy, you must specify its address under Manually defined HTTP
proxy address in the profile settings of the endpoint computers.
Ultimate mode extends the HTTP host interface (default port 80) - use
this port value in the endpoint computer profile setting.
Note: You can use both the caching and ultimate proxy modes together.
Note: An Elements Connector can use another Elements Connector
to connect to the internet. In such a case, only the first Elements
Connector to which WithSecure endpoints are connecting can act bothin the caching and ultimate proxy modes. The other Connectors in the
chain function only in the ultimate proxy mode.
If you are using the Software Updater feature, you need to makeendpoint computers trust the TLS server certificate of the Elements
Connector by using one of the two options:••

You can use proper, commercial certificates (the preferred option).
You can use self-generated certificates that are automatically createdduring an Elements Connector installation.

Elements Connector | Configuring Elements Connector as a proxy | 11

4.1 Configuring Elements Connector as a proxy using commercial
certificates
Instructions on how to configure Elements Connector as a proxy using a commercial certificate.
To configure Elements Connector:
1. Purchase a commercial certificate or generate a company-issued one for a server running Elements
Connector to set up TLS.
2. Create a PKCS#12 archive to bundle a private key with its certificate. For example, with the OpenSSL
tool this command may look like the following:
openssl pkcs12 -export -in certificate.crt -inkey private.key -out server.p12-name server -passout pass:p12password
Note: In case you have a long list of intermediate certificates, might be useful to include the whole chain
to the PKCS#12 archive's source certificate. The command may look like the following: cat tls.crt
ca_intermediate.crt ca_root.crt > certificate.crt
3. Import the PKCS#12 archive to the Connector keystore to replace the existing certificate by runningthe following command:•

On Windows:"<Program Files>\WithSecure\ElementsConnector\jre\bin\keytool.exe"-importkeystore -destkeystore"<ProgramData>\WithSecure\NS\ElementsConnector\data\fspms.jks"-deststorepass superPASSWORD -destalias fspms -destkeypass superPASSWORD-srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass p12password-srcalias server•

On Linux:/opt/f-secure/fspms/jre/bin/keytool -importkeystore -destkeystore/var/opt/f-secure/fspms/data/fspms.jks -deststorepass superPASSWORD-destalias fspms -destkeypass superPASSWORD -srckeystore server.p12-srcstoretype PKCS12 -srcstorepass p12password -srcalias server

4. After importing the certificate, restart the Connector service.

4.2 Configuring Elements Connector as a proxy using
self-generated certificates
Instructions on how to configure Elements Connector as a proxy using a self-generated certificate.
To configure Elements Connector:
1. Export the certificate from the Connector key store by running the following command:•

On Windows:"<Program Files>\WithSecure\ElementsConnector\jre\bin\keytool.exe"-keystore "<ProgramData>\WithSecure\NS\ElementsConnector\data\fspms-ca.jks"-alias fspm-ca -exportcert -file connector-ca.crt -rfc -protected•

On Linux:/opt/f-secure/fspms/jre/bin/keytool -keystore /var/opt/f-secure/fspms/data/fspms-ca.jks -alias fspm-ca -exportcert -file connector-ca.crt -rfc
-protected12 | Configuring Elements Connector as a proxy | Elements Connector

2. Add the exported connector-ca.crt certificate as trusted for the endpoint computers.
Note: For example, on Windows, the connetor-ca.crt certificate must be installed to the following
location: Local Machine > Trusted Root Certificate Authorities.

4.2.1 Overriding properties for the self-generated certificates
If Elements Connector cannot properly resolve its own DNS address automatically, that is, if external DNS
records differ from the hostnames, you can use Java system properties to explicitly set custom certificate
properties.
You can use the following properties:•••

certAdditionalDns to specify a comma-separated list of additional DNS values for the subject's
alternative names
certAdditionalIp to specify a comma-separated list of additional IP addresses for the subject's
alternative names
certForceSubject to override the TLS certificate. The subject must contain a comma-separated listof all values that are required to generate the subject.

To start using Java system properties with Elements Connector:
On Windows
1. To specify the Java system properties via the Windows registry, do the following:a) Run Regedit as an administrator.
b) Create the following string registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector\additional_java_argsc) Specify the Java system properties in the following format:-DpropertyName=value
If you want to specify multiple properties, use space as the delimiter. Property names and values
are case-sensitive. For example:-DcertAdditionalDns="pmserver.mydomain.pro, pmserver.myanotherdomain.com"-DcertAdditionalIp="127.0.0.1, 127.0.0.2"d) Restart the WithSecure Elements Connector service (fsconnector) for the new configuration settings
to take effect.
On Linux:
2. The above instructions work also for Linux. However, instead of the registry, use the following
configuration file: /etc/opt/f-secure/fspms/fspms.conf:a) Use a line with the following parameter: additional_java_args.
b) Specify the Java system properties with the value in quotes in the following format:-DpropertyName=value
If you want to specify multiple properties, use space as the delimiter. Property names and values
are case-sensitive. For example:-DcertAdditionalDns="pmserver.mydomain.pro, pmserver.myanotherdomain.com"-DcertAdditionalIp="127.0.0.1, 127.0.0.2"c) Restart the WithSecure Elements Connector service (fsconnector) to make the new configuration
settings take effect.
3. To force certificate renewal, do the following:a) Stop the Elements Connector service.
b) Depending on which operating system you have, remove one of the following:Elements Connector | Configuring Elements Connector as a proxy | 13••

c:\ProgramData\WithSecure\NS\ElementsConnector\data\fspms.jks/var/opt/f-secure/fspms/data/fspms.jksc) Start the Elements Connector service.
The certificate is created when the service starts next time.

4.3 Changing the default port values on Elements Connector
By default, Elements Connector uses ports 80 and 443 to proxy the traffic.
You can set the HttpPortNum and HttpsPortNum values in the Windows registry.

4.3.1 Changing the default port value in Windows
Instructions on how to change the default port values on Elements Connector in Windows.
You need to have Elements Connector installed before changing the HTTP and HTTPS port values.
To change the default port values:
1. Open Windows Registry Editor by entering regedit in the search bar.
2. From the results, select Registry Editor.
3. Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WithSecure\ElementsConnector
4. Select HttpPortNum and do the following:a) Change Base to Decimal.
b) Enter the new HTTP port numberc) Select OK.
5. Select HttpsPortNum and do the following:a) Change Base to Decimal.
b) Enter the new HTTPS port number.
c) Select OK.
6. Open the command prompt as an administrator and run the following commands to start the service:
net stop wsconnector
net start wsconnector
After the service restarts, Elements Connector starts using the new ports.

14 | Configuring event forwarding | Elements Connector

Chapter5
Configuring event forwarding
Topics:••Configuring API access for
Elements Connector
Configuring event forwarding
settings

WithSecure offers an easily-adaptable solution for the partners who
use security information and event management (SIEM) products tomonitor managed environments.
You can deploy Elements Connector either on-premise or in the cloudand use it to serve as a security events forwarder that pulls data fromthe WithSecure cloud and forwards it to SIEM. For an Microsoft Sentinel
integration, Elements Connector is available in the Azure
Marketplace:https://azuremarketplace.microsoft.com/en-us/marketplace/apps/
withsecurecorporation.sentinel-solution-withsecure-via-connector.
Note: For more information on how to configure Elements Connector
to be used with Microsoft Sentinel, see
https://learn.microsoft.com/en-us/azure/sentinel/
data-connectors/withsecure-elements-via-connector.
With Elements Connector, you can stream all security events from the
WithSecure Elements Endpoint portal to your SIEM. Elements
Connector supports Syslog, Common Event Format (CEF), and Log
Event Extended Format (LEEF) message formats to stream data, whichmakes it a generic solution to integrate seamlessly with almost any
SIEM.
You can configure the use of the forwarding feature for the whole partner
scope or limit it to a certain company, depending on the API key that isused.
To get the event stream forwarded to SIEM, you first have to make sureto enable access to the Endpoint Protection API and configure Elements
Connector to use the API. You must create the API key using a
dedicated company-level account so that it only retrieves events thatare related to that company. If you use a dedicated partner-level accountto create the key, the security events from all the partner-managed
companies end up in the desired SIEM. Finally, you need to activate
the forwarding feature and configure the destination SIEM in the
WithSecure Elements Endpoint Protection portal under Profiles forConnector.

Elements Connector | Configuring event forwarding | 15

5.1 Configuring API access for Elements Connector
When you have installed WithSecure Elements Connector, you have to configure some settings to makesure that the API access works.
1. Create Elements API credentials as follows:a) Log in as an EPP administrator to the Elements Security Center.
b) Under Management, open the API client view .
c) Change your scope to the organization for which you want to create a new pair of credentials.
Note: If you are a partner and you want to create credentials for a company, you must change thescope to the organization for which you want to issue the credentials.
d) Select Add new.
e) Enter a description for the new client credentials.
Important: You cannot change the description after saving the credentials.
f) After you have created a new pair of credentials, follow the instructions on the screen.
Note: Remember to save the secret value in a safe place, because you will not be able to read thatvalue again.
g) Select the I have copied and stored the secret option and then select Done.
The new item is shown in the list.
2. Create an api-access.properties file in the following folder:••

Windows: <ProgramData>\WithSecure\NS\ElementsConnector\dataLinux: /var/opt/f-secure/fspms/data

3. Add the following key-value pairs to the file:
apiUrl = https://api.connect.withsecure.com
clientId = <api-client-id>
secret = <api-secret>Note: The user account should be the same as the one that you specified while generating the API
credentials.
4. Save the file.
5. Restart WithSecure Elements Connector service as follows:••

On Windows, restart WithSecure Elements Connector from the Services app.
On Linux, run the following command as the root user:#/etc/init.d/fsconnector restart

Note: After you turn on event forwarding in the profile settings, the api-access.properties file isdeleted automatically. The API credentials are stored in an encrypted form in a secure storage.

5.2 Configuring event forwarding settings
All the event forwarding settings are grouped under the Event forwarding section of a Elements Connector
profile.
To configure event forwarding:
1. In the WithSecure Elements Endpoint Protection portal, go to the Profiles page and select For
Connector.
2. Select the profile for which you want to set up event forwarding.
3. Select Event forwarding.

4. Turn Enable event forwarding on to allow forwarding security events to a SIEM system.
5. Enter an SIEM system address for the target system.
Note: An SIEM system address is a DNS or IP address of the SIEM server to ingest events followed
by a port number.
Note: If the ports are omitted, the default values for the protocols are: 515 (TCP), 514 (UDP).
6. From the Message format drop-down menu, select one of the supported formats for the forwarded
messages:•••

Common Event Format (CEF)
Log Event Extended Format (LEEF)
Syslog

7. From the Protocol drop-down menu, select one of the communication protocols that are used to connect
to the SIEM:
•
•
•

TCP
UDP
TCP+TLS

Important: After you finish configuring the settings, check the log file to make sure that the Connector
trusts the SIEM server certificate.
8. Select Save and publish.
The new profile now appears on the For Connector profile list.
Once Elements Connector receives the updated profile, it starts polling security events from the WithSecure
cloud and forwards those to the destination SIEM.

Chapter6
Troubleshooting
Connector creates several log files that can help you to solve issues
that you might have while using it.
On Windows, all Connector logs are stored in the<ProgramData>\WithSecure\NS\ElementsConnector\logfolder.
••fsconnector-forwarding.log contains information about
forwarded events,
upstream-request.log collects all Connector requests to
WithSecure Cloud.

On Linux, logs are stored in /var/opt/f-secure/fspms/logs.