Solution overview

WithSecure
Elements Endpoint
Detection andResponsetm

WithSecuretm Elements – Reduce cyber risk,
complexity and inefficiency.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

2

Contents
1. Executive summary.......................................................................................3
Flexibility to build resilient cyber security with WithSecure™ Elements ........3
Benefits of the integrated solution................................................................. 4
Introducing WithSecure™ Elements Endpoint Detection and Response......6
2. Key benefits................................................................................................... 7
3. Solution overview..........................................................................................9
3.1 Management portal: Elements Security Center..................................... 10
3.2 Endpoint clients..................................................................................... 11
3.3 Application visibility............................................................................... 12
3.4 Behavioral Analysis............................................................................... 13
3.5 Broad Context Detection™.................................................................... 13
3.6 Incident management............................................................................ 13
3.7 Guidance to respond............................................................................. 14
3.8 Elevate to WithSecure™........................................................................ 15
3.9 Automating actions................................................................................ 15
3.10 Advanced Response Actions.............................................................. 16
3.11 Event Search....................................................................................... 16
3.12 Event Search for Threat Hunting.......................................................... 16
4. Data security................................................................................................ 17
4.1 Data protection and confidentiality........................................................ 17
4.2 Data security measures......................................................................... 17
4.3 Data centers.......................................................................................... 17

DISCLAIMER: This document gives a high-level overview of the key security components in the
WithSecure™ Elements Endpoint Detection and Response solution. Details are omitted in order toprevent targeted attacks against our solutions.
WithSecure™ is constantly improving its services. WithSecure™ reserves the right to modify
features or functionality of the Software in accordance to its product life cycle practices.
Last updated: May, 2021

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

1. Executive summary
Targeted cybersecurity attacks can be difficult to analyze and respond to, and become an
extremely costly problem for companies even before they turn into actual data breaches. The
attack remediation stage alone may take over two months and cost nearly two million dollars.1
Fileless attacks are commonly not recognized by traditional antivirus protection, and targeted
attacks often go unnoticed for months or even years.2 With the WithSecuretm Elements Endpoint
Detection and Response solution, you can gain contextual visibility into your security, automate
threat identification, and stop attacks before data breaches involving sensitive, confidential orotherwise protected data exposed to an unauthorized party, like a cybercriminal, happen.

Flexibility to build resilient cyber security
with WithSecure™ Elements
In today's agile business environment, the only constant ischange. WithSecure™ Elements offers companies all-in-one
security that adapts to changes in both the business and thethreat landscape, growing along with the organization. It offers
flexibility in licensing models and in its pick-and-choose security technologies. WithSecure™ Elements integrates a full rangeof cyber security components, including vulnerability management, patch management, endpoint protection, and detection
and response, into a single lightweight software packagethat is managed in one unified, cloud-based management

console. Using the same console companies can manage
the security of their Microsoft 365 collaboration services. The
solution is available as a fully managed subscription service
through our certified partners or as a self-managed cloud
solution. Customers can easily shift from self-managed toa fully managed service, so companies that struggle to findemployees with cyber security skills can stay protected amid
the ever-developing attack landscape.
WithSecure™ Elements consists of four solutions that are all
managed with the same console, WithSecure™ Elements
Security Center.

3

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

WithSecure™ Elements Endpoint Protection:

WithSecure™ Elements Collaboration Protection:

WithSecure's multiple AV-TEST Best Protection winner,cloud-native, AI-powered endpoint protection can be deployed
instantly from your browser and manage the security of all yourendpoints, keeping your organization fenced in from attacks.
WithSecure™ Elements Endpoint Protection covers mobiles,
desktops, laptops and servers.

Complement the native email security capabilities of Microsoft
365 by providing advanced security to prevent attacks via
email and URL’s. Cloud-to-cloud integration makes the solution easy to deploy and manage.

WithSecure™ Elements Endpoint Detection andResponse:
Gain full visibility to advanced threats with our endpoint detection and response. With our unique Broad Context Detection,
you can minimize alert noise and zero in on incidents, and with
automated response you can effectively stop breaches aroundthe clock. WithSecure™ Elements. Endpoint Detection andResponse covers desktops, laptops and servers.

WithSecure™ Elements Vulnerability Management:
Ponemon Institute’s 2018 Cost of a Data Breach Report indicated the days toidentify data breaches varied by industry sector from 150 to 287 days,
and post data breach response activities alone spending alone $1.76 million
over 69 days as mean time.
2
Ponemon Institute's 2020 Cost of a Data Breach Report indicated that
average time to identify and contain data breach is 280 daysv
1

4

Discover and manage critical vulnerabilities in your network
and assets. By exposing, prioritizing and automatically patching vulnerabilities you can reduce your attack surface andminimize entry points for attackers.

WithSecure™ Elements Endpoint Protection, Endpoint
Detection and Response and Vulnerability Management are
packed into a single automatically updated software packet,
saving your time and money in software deployment andadministration.

Benefits of the integrated solutions
The modular WithSecure™ Elements solution adapts to yourcompany changing needs. Unified cyber security means
easier licensing, fewer security management tasks and moreproductivity without sacrificing your company’s cyber security
posture. The cloud-based console – WithSecure™ Elements
Security Center - provides centralized visibility, insights andmanagement across all endpoints and cloud services. It is fully
managed by one of our certified Managed Service Providers,or self-managed with on-demand support from WithSecure™
for tough cases. The Security Center provides a single viewto the security status combining the Endpoint Protection,
Endpoint Protection and Response, Vulnerability Management, and Microsoft 365 protection.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

All the endpoint solutions (Elements Endpoint Protection, Endpoint Detection and Response, and Vulnerability Management) are using a single software agent that isrequired to deploy only once. The add-on solutions can thenlater be activated without having to deploy additional solutions. WithSecure™ Elements Collaboration Protection is a
cloud-based solution that does not require installations tocompany endpoints.
In addition to deployment and management benefits, the
WithSecure™ Elements solutions are designed to work
together maximizing the security benefits for the company.
By combining security events and alerts the XDR capabilities
WithSecure™ Elements can provide holistic security breaking
down the silos of disconnected solutions.

WithSecure™ Elements
Endpoint
Protection
Standard
Advanced anti-malware andpatch management
Anti-ransomware with
dataguard and application
control

Advanced threat protection

Vulnerability management
and prioritization

Advanced email security for
Microsoft 365
Note: available features may vary by operating platform

Endpoint
Protection
Premium

Detection andResponse

Vulnerability
Management

Microsoft 365
Protection

5

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

Introducing WithSecure™ Elements
Endpoint Detection and Response
WithSecure™ Elements Endpoint Detection and Response
is a leading context-level endpoint detection and response(EDR) solution to help companies to gain immediate visibility into their IT environment and security status, protect thebusiness and its sensitive data by detecting attacks quickly,
and responding fast with expert guidance. With its deep bidirectional intelligence and high level of automation, WithSecure’s solution protects against advanced threats even before
breaches happen. It detects incidents with lightweight clients,
which are installed on monitored hosts across the organization’s network. The clients collect data on behavioral events
such as file access, launched processes, network connections
being created, or something being written into the registry or
system logs. These events are then further analyzed by thesolution. In addition to real-time detections, the solution also
makes detections based on historical data. At the end of theday, utilizing cutting-edge technology is just one part of theequation, as technology is only as good as the people behind
it. Our threat hunters and researchers are among the leading
experts in the industry, and immensely dedicated to providing
the very best on the cybersecurity market. At WithSecure™,
we combine that technology and that unsurpassable humanexpertise to deliver a world-class endpoint detection andresponse solution.

The solution is uniquely backed by WithSecure™, whichmeans that a detection can be elevated to WithSecure™ for
further threat analysis by experienced cyber security experts.
The solution is also available as a partner managed EDR
service that combines technology, threat intelligence, andpartner services to provide an all-in-one breach detection andresponse service. The managed EDR services free up anorganization’s own resources from advanced threat monitoringand incident management to alert the organization only whenreal threats have been detected.
At the end of the day, utilizing cutting-edge technology isjust one part of the equation, as technology is only as goodas the people behind it. Our threat hunters and researchers
are among the leading experts in the industry, and immensely dedicated to providing the very best on the cybersecurity
market. At WithSecure™, we combine that technology andthat unsurpassable human expertise to deliver a world-class
endpoint detection and response solution.

Prevention makes the attackers’ lives harder
Advanced attackers may have the skills to get into your network
no matter what, but there’s no need to roll out the red carpet. By
putting effort into pre-compromise prevention, you’re making it alittle harder for these attackers to breach your network. When they’reforced to put in more effort, their cost structures increase, whichhelps work as a deterrent.
WithSecure™ Elements Endpoint Detection and Response as
a post-compromise solution for detecting advanced attacks stillrequires a strong endpoint protection solution that blocks commodity threats, like ransomware.

6

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

2. Key benefits
With the WithSecuretm Elements Endpoint Detection andResponse solution, you can be prepared to detect advanced
threats and targeted attacks using fileless techniques before
data breaches happen, and always be ready to quickly analyze
and respond to them by utilizing WithSecure’s cutting-edge
technology.
Some of the key benefits the solution delivers for visibility,
detection and response are listed below:

Gain immediate contextual visibility into your IT environment andsecurity status• Improve visibility into IT environment status and security with application andendpoint inventories• Easily spot misuse from proper use by collecting and correlating behavioral
events beyond malware• Respond faster to the identified targeted attacks thanks to alerts with broad
context and host criticality

7WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

Protect your business and its sensitive data bydetecting breaches quickly• Detect and stop targeted attacks quickly to prevent businessinterruptions and impact on company reputation• Be prepared before breaches happen by setting up
advanced threat detection & response capabilities within
days• Identify threats or signs of attack that were done in endpoint
and are still active in memory when EDR functionality is
activated• Meet the regulatory requirements of PCI, HIPAA, and theEuropean Union’s GDPR which requires data breaches to bereported within 72 hours

Respond swiftly with automation and guidance
when under attack, or use full incident data for yourown SOC investigations• Improve your team’s focus with built-in automation and intelligence that support a swift response to the real advanced
threats and targeted attacks• Receive guidance on how to respond when you get alerts,
with the option to automate response actions around theclock (automation features to be introduced as an update)• Overcome skill or resource gaps in your teams by outsourcing advanced threat monitoring to an WithSecure™ certified
managed service provider backed by WithSecure™ experts• Alternatively for customers or partners with threat hunting
capabilities WithSecure™ Elements for Endpoint Detection
and Response can provide the full raw data on the incidents
with additional Event Search for Threat Hunting service

Solution to match your cyber security skills
and resources
WithSecureTM Elements Endpoint Detection and Response can beacquired in multiple different ways that match your cybers security
skills and resources:
1. Fully managed service delivered by WithSecureTM partners:
this option is best for companies that want to be protectedagainst advanced targeted threats but have a strategy tooutsource theircyber security.
2. Managed in-house with WithSecure’s help on incidents: thisoption is best for companies with limited cyber security skills.
Difficult incident cases can be forwarded to WithSecureTM byusing built-in WithSecureTM Elevate feature.
3. Managed in-house: this option fits those companies that have
IT department with cyber security skills on good level. The basic
incident response flow covers detecting the incidents with helpof Broad Context Detections and responding to those threats.
4. Managed in-house with full Threat Hunting capabilities: thisoption fits for those companies with their own Security Operations Center (SOC) that can perform advanced threat hunting
as part of their investigations.

8WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

9

3. Solution overview
The WithSecuretm Elements Endpoint Detection and Response solution consists ofa combination of easily deployable clients on hosts, a cloud-based Elements Security
Center, and optional certified partner managed services. The solution provides
functionality for detecting advanced threats and targeted attacks, and Broad Context
Detections to clarify the overall risk and response. The on-site part of the deployment
includes endpoint monitoring and response client that is installed onto
an organization’s endpoints.
Detections
Sensors
Real Time Behavioral
AnalysisYour
organization

Events

The figure describes on a high level how the WithSecure™
Elements Endpoint Detection and Response solution works:!

1.
WithSecureTM
partner oryour own IT
Broad Context
DetectionTM

Guidance to respond or
automated actions

Optionto elevateLightweight clients monitor different endpoint activities that are carriedout by attackers, and stream behavioral events to our cloud in real-time.
2. Real-time behavioral data analytics flag and monitor both the processes
and other behaviors that have triggered the events.
3. Broad Context Detection™ mechanisms further narrow down the data,placing related events in context with one another, quickly identifying real
attacks and prioritizing them with respect to risk level, host criticality, andprevailing threat landscape.
4. Following a confirmed detection, the solution guides IT and security
teams through the necessary steps to contain and remediate the threat.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.1 Management portal:
Elements Security Center
The Elements Endpoint Detection and Response solution
makes it easy to deploy, manage, and monitor the advanced
threats on your endpoints from a single, intuitive, web-based
console. It gives you immediate contextual visibility into IT
environment and security status across your network —regardless of whether employees are at the office or on the go.
The management portal was designed to simplify and accelerate security management in demanding and multi-siteenvironments.
Below are some examples of how the solution considerably reduces the amount of time and resources needed foradvanced threat monitoring and management:• The solution is designed to work with any endpoint protection solution, and it functions with WithSecure™'s endpoint
security solutions in a single-client and management
infrastructure.
• When combined with WithSecure™ Elements Endpoint
Detection and Response, both malware and advanced
threats become visible and manageable.
• Detections are presented with actionable visualization toprovide a broader context of targeted attacks on a timeline
with all impacted hosts, relevant events and recommended
actions.
• By consolidating the advanced threat management ofendpoints and system tools into one endpoint security portal,
the overall management is streamlined considerably, saving
time.
• As this is a cloud-based service managed by WithSecure™,
there is no server hardware or software to install or maintain –all you need is a browser and an internet connection.
The management portal supports the latest versions of thefollowing browsers: Microsoft Internet Explorer, Microsoft
Edge, Mozilla Firefox, Google Chrome and Safari.
The management portal is available (as of May 2021) toEnglish, Finnish, French, German, Italian, Japanese, Polish,
Portugese, Spanish (LatAm) and Swedish.

The Partner Managed version of the management portal includes
specifically designed features to assist service providers, likeend-customer reporting, a dashboard with a convenient overview
of all the managed companies, and also access to each managed
company’s own dashboard.

10WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.2 Endpoint clients
Endpoint clients are lightweight, discreet monitoring tools
designed for anomaly detection, including new and previously
unidentified events or a sequence of events that most likely
result from malicious activities, deployable on all relevant
Windows and MacOS computers within the organization.
The clients collect behavioral event data from endpoints, aredesigned to work with any endpoint protection solution, andfunction seamlessly with WithSecure's endpoint security
solutions in a single-client and cloud-based management
infrastructure.
The table describes supported operating systems and featureson each operating system.

WithSecure™ Elements
Windows
workstations

Windows
servers

Mac osLinux

Operating systems

7 / 8 / 102019 / 2016 /2012 /2011 /2008 R2

10.12 or newer

Single-client with
WithSecure™

Yes

Yes

Yes

Yes

Behavioral events

Yes

Yes

Yes

Yes

Application visibility

Yes

Yes

No*

No*

Remote host isolation

Yes

Yes

Yes

Yes

* Expected later: The feature is not yet available. ** Available with WithSecure™ Business Suite through manual actions.
More information about system requirements and client deployment in the user guide at https://help.f-secure.com/product.
html#business/edr/latest/en/deployment-latest-en

11WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.3 Application visibility
Gaining extensive visibility into your IT environment and cloudservices will reduce exposure to advanced threats and dataleakage. Our solution’s application visibility allows you to list all
active applications running on endpoints across your organization’s network so you can easily identify unwanted, unknown
and harmful applications.
With application visibility you can identify Potentially Unwanted Applications (PUA) and Unwanted Applications (UA).
'Potentially Unwanted Applications' have behaviors or traits
that you may consider undesirable or unwanted. 'Unwanted
Applications' have behaviors or traits with more severe impact
on your device or data.

Applications identified as 'Potentially Unwanted'(PUA) can:• Affect your privacy or productivity - for example, expose
personal information or perform unauthorized actions• Put undue stress on your device's resources - for example,
use an excessive amount of storage ormemory• Compromise the security of your device or the information
stored on it - for example, expose you to unexpected content
or applications
The impact of these behaviors and traits on your device or data
can range from mild to severe. They are not, however, harmful
enough to warrant classifying the application as malware.

Collecting event data to detect and containthreats
WithSecure™ Elements Endpoint Detection and Response collects
data from a variety of endpoints to help detect and contain threats inyour environment. This data is provided in three different ways:
1. Broad Context DetectionTM. This automa ed threat identifica
tion method is designed to spot real threats from vast amountof behavioral event data collected from company endpoints.
In addition, with the built-in WithSecure™ Elevate feature you
can request professional guidance from our specialized cybersecurity experts in solving tough cases.
2. Event Search. With this built-in feature you can view, search,and explore the event data collected from your company
endpoints that are related to any Broad Context Detections.
3. Event Search for Threat Hunting. This advanced feature isused to explore and interact with all the raw event data collected from the endpoints. Its sophisticated filtering capabilities
lets your cyber security experts at SOC execute proactive
threat hunting to detect and stop the most sophisticatedhidden threats. Event Search for Threat Hunting is an optional
component of WithSecure™ Elements Endpoint Detection andResponse.

12

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.4 Behavioral Analysis

3.5 Broad Context Detection™

As a core functionality for identifying advanced threats among
massive amounts of behavioral data events to spot suspicious
events or a sequence of events that have not been seen before
and most likely malicious.

WithSecure’s proprietary Broad Context Detection™ methodologies are designed to narrow down the number of detections
to a small number of meaningful incidents that may indicatethat systems or data have been compromised.

WithSecure™ uses real-time behavioral, reputational, andbig data analysis with machine learning to collect multiple
suspicious events that can be tied together, for example basedon activities. The behavioral analysis leverages artificial intelligence to detect malicious, hidden activity based on small individual events that are executed as part of the attacker’s tactics,
techniques and procedures. Behavioral analysis is used in
automatic host profile identification that impacts risk scoring ofdetections in relation to the monitored company and host, andthe overall IT environment.

Broad Context Detection™ flags indications of possible
breaches by alerting admins of tactics, techniques and procedures (TTPs) used in targeted attacks. This can for example
include the following possibly suspicious actions:

The artificial intelligence includes machine learning capabilities to be applied to continuously improve detections andreduce false-positives. The behavioral analysis capability is aprime example where WithSecure™ combines data scienceand cyber security expertise – an approach WithSecure™
refers to as “Man and Machine”.

Broad Context Detection™ shows only relevant detections
and assigns them a criticality based on risk level, information
about affected host criticalities, and the prevailing threat landscape. A single event might not be an indication of attack, yet if
several detections happen in a short timeframe may result intohigher severity alert and trigger a Broad Context Detection™
as a warning of a possible incident.

• Abnormal activity of standard programs• Calls to running processes from non-standard executables• Running of unexpected scripts• Unexpected running of system tools from standard
processes

As a result of this approach, IT teams are provided with arelatively short list of confirmed detections, each flagged with
distinct priority levels and recommended response actions.

13

So not only do teams know what to focus on first, but they also
know how to respond and can do so quickly and decisively.
For further information about the Broad Context Detection™,
please refer to our Detecting Advanced Attacks whitepaper.

3.6 Incident management
The solution has a built-in incident management feature toview and manage Broad Context Detections. New detections
will trigger an email alert that contains direct access to theManagement portal to view details and take actions.
The Broad Context Detections are listed on the easy-to-use
dashboard that helps to prioritize the incidents based on theirrisk score, which is automatically calculated based on criticality and confidence levels. Non-critical Broad Context Detections with low risk scores are also listed, since slowly evolving
attacks might eventually become more serious incidents withhigh risk scores.
Actions in incident management are to acknowledge Broad
Context Detections, or mark them to be in progress, monitoring, closed as confirmed, closed as false positive, orclosed as unconfirmed. Marking a Broad Context Detection™ false-positive will automatically close future detections
matching that same detection type, process parameters as"Auto false positive".

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.7 Guidance to respond
Following a confirmed detection, the solution’s built-in guidance helps to take the necessary steps to contain and remediate the threat. The containment and remediation steps include
recommended response actions, like informing users andisolating hosts.
WithSecure™'s cyber security experts have used their own
experience to analyze a range of common threats to train thesolution. As result, the solution can provide easy to understand guidance to respond to a wide range of advanced
threats, and related guidance how to respond. The guidance
to respond makes it easier even for less skilled IT and security
team members to take correct actions to contain and remediate the threat.

The following list contains some example activities which cause a detection.
The list is not only limited to known attacks since the detection data is
continuously being analyzed and more types of attacks are continuously
identified by Broad Context Detection™ methodologies and WithSecure’s threat hunters.
• Directed attack targeting a host
• Lateral movement involving movement between hosts• Spoofing information involved as part of an attack• Persistence for example by using a process on the same host• Privilege escalation for example by brute forcing administrator
privileges• Credentials access resulting into access and control over a targetedmachine/network• Exfiltration to aid adversary to exfiltrate information from the target
machine/network• Abnormal process execution for example with suspicious parameters• Abnormal file access for example multiple document types, non-root
accessing system files• Client tamper attempts for example to change client’s settings or
disabling the client• Injection attempts to another process for example kernel mode orother application• Command and control network connection opened to a remote host
• PowerShell script from attacker location flagged as an unusual location to load a script• PowerShell modified a PowerShell script typically part of achieving
persistence• Abnormal DLL usage with PowerShell used from a process thatloaded the module• Remote connection and execution potentially used for lateral
movementw

14

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.8 Elevate to WithSecure™
WithSecure™ provides an optional threat analysis service incase a detection requires further threat analysis and guidancefrom WithSecure’s cyber security experts. Elevate to WithSecure™ is a premium service that must be ordered in advancefor a set of cases to be analyzed.
The Elevate to WithSecure™ requests through the solution will
grant WithSecure’s threat analysts’ permission to access theentirety of metadata collected from the installed clients arounda specific detection.
WithSecure’s on-shift threat analysts will pick the request
within 2-hour target SLA and start identifying the type of thepotential incident by collecting additional evidence and providing further expert guidance through the solution to validate thethreat, and optionally provide a threat investigation.

• Threat Validation provides additional information about a
Broad Context Detection™ discovered during the last 7
days. This includes an expert-written summary and description of the detection, along with any other relevant data tohelp you determine whether it requires response actions.
• Threat Investigation provides a highly detailed investigation
into a specific Broad Context Detection™, leveraging all
recent and historical data. This option also includes actionable incident response guidance from our cyber security
experts, along with a comprehensive report of the detectedattack type.
The Elevate to WithSecure™ service focuses on analyzing
technical evidence related to the potential incidents in question, such as methods and technologies, network routes, traffic
origins, and timelines. However, the WithSecure™ team only
provides guidance through the solution, and further professional services to support incident response must be agreed
separately. If the customer suspects a crime, we recommend
to contact the relevant authorities and provide the Threat
Investigation report.

15

3.9 Automating actions
Automated response actions are available to reduce theimpact of targeted cyber attacks by automatically containing them outside business hours whenever risk levels arehigh enough. The automation has been designed specifically for teams that are monitoring detections and available torespond to incidents only during business hours to make initial
response action over the night or weekend.

WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

3.10 Advanced Response Actions

3.11 Event Search

Advanced Response Actions can be used to reduce theimpact of targeted cyber attacks and to gather more information of the incidents and the IT environment. Response
actions can be set for multiple endpoints at the same timeincreasing efficiency in responding to the incidents. In addition, endpoints that are currently not online will execute theactions immediately when becoming online.

With this built-in feature you can view, search, and explore theevent data collected from your company endpoints that are
related to any Broad Context Detections. Event Search allows
to filter and search for events based on the time they occurred,and on the device and the organization where the event took
place.

The response actions available for WithSecureTM Endpoint
Detection and Response include:• performing network isolation for the endpoint (this response
can be automated)• scanning the endpoint for malware and other harmful
content,• retrieving different kind of data, logs, process- and task lists• deleting and isolating files, folders, registry data, processes,
and services
By using these response actions, a network administrator
can efficiently stop the data breach before they cause further
damage to the business. Please note that advanced response
actions are not available when used with WithSecureTM Business Suite products.

3.12 Event Search for Threat Hunting
This advanced feature is used to explore and interact with all
the raw event data collected from the endpoints. Its sophisticated filtering capabilities lets your cyber security experts at
SOC execute proactive threat hunting to detect and stop themost sophisticated hidden threats. As the feature includes
much richer set of events (other than those related to the
Broad Context Detections) the amount of data is also muchbigger. For this reason, Event Search for Threat Hunting is
an optional component of WithSecure Elements Endpoint
Detection and Response.

16WithSecure™ Elements – Reduce cyber risk, complexity and inefficiency

17

4. Data security
4.1 Data protection and confidentiality

4.2 Data security measures

4.3 Data centers

The collected behavioral event data from endpoints is stored
within European Union (Ireland) for one year on a rolling basis
during the customer engagement and is deleted within twomonths after termination of engagement.

As a security company, we take the security of our data centersvery seriously and use dozens of security measures to ensure
it, such as:

Our Endpoint Detection and Response solution uses Amazon
Web Services (AWS) data centers to ensure the highest
possible availability and fault tolerance, in addition to better
response times and the ability to scale as needed. AWS statesthat each of their data centers are in alignment with Tier 3+
guidelines. For further information about the AWS datacenters,
please see https://aws.amazon.com/compliance/

The solution is not intended for monitoring non-security-related activities such as profiling employees’ activities, interests,
or interactions. The focus of data collection is not on individual
employees, business documents or email contents. Please
see the solution specific privacy policy for further detail.
As WithSecure™ is based in Finland, we abide by bothFinland’s and the European Union’s strict privacy and security legislations. We are compatible with the European Union
privacy framework, and understand the privacy needs of ourcustomers. WithSecure™ operates under the Finnish implementation of the EU Data Protection directive and the WithSecure™ Elements Endpoint Detection and Response solution
has been designed in accordance with the European Union’s
General Data Protection Regulation (GDPR). For further
information about WithSecure’s compliance with the GDPR,
please see https://www.WithSecure.com/GDPR.

• Security by design: Our systems are designed from theground up to be secure. We embed privacy and security inthe development of our technologies and systems from theearly stages of conceptualization and design to implementation and operation.
• Rigorous access controls: Only a small vetted group of
WithSecure™ employees have access to the customer data.
Access rights and levels are based on their job function androle, using the concept of least privilege and matching that tothe defined responsibilities.
• Strong operational security: Operational security is aneveryday part of our work, including vulnerability management, malware prevention and robust incident management
processes for security events that may affect the confidentiality, integrity, or availability of systems or data.

The collected behavioral event data from endpoints is stored
on AWS in Europe (Ireland). Data retention for one year
is included within the Elements Endpoint Detection andResponse subscription and there are no additional data
storage fees based on the amount of data collected.

Who We Are
WithSecureTM is cyber security’s reliable partner. IT service providers,
MSSPs and businesses along with the largest financial institutions,manufacturers, and thousands of the world’s most advanced
communications and technology providers trust us for outcome-based
cyber security that protects and enables their operations. Our AIdriven protection secures endpoints and cloud collaboration, and ourintelligent detection & response is powered by experts who identify
business risks by proactively hunting for threats and confronting live
attacks. Our consultants partner with enterprises and tech challengers
to build resilience through evidence-based security advice. With morethan 30 years of experience in building technology that meets businessobjectives, we’ve built our portfolio to grow with our partners throughflexible commercial models.
WithSecureTM is part of F-Secure Corporation, founded in 1988, andlisted on the NASDAQ OMX Helsinki Ltd.