Outage in WithSecure
Memory leak in latest WithSecure Elements EDR / WithSecure Countercept Windows sensor
Resolved MinorIncident Report
We have identified a memory leak in the latest WithSecure Countercept and WithSecure Elements Endpoint Detection and Response sensor driver, which is part of the Windows Sensor 2022.5 which was released to production on 16th of January 2023.
The impact varies vastly host to host, some machines would barely notice this while others can degrade in a few days.
This can be identified by observing the non paged memory pool growing.
A workaround is:
For Countercept:
"C:\Program Files (x86)\F-Secure\MDR\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor
For Elements EDR: "C:\Program Files (x86)\F-Secure\PSB\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor
We are currently testing a new sensor version to resolve the issue.
Trusted by 1,000+ teams
Never miss outages in third-party dependencies
Stop finding out about outages from your users. Monitor 6,320+ cloud services and get alerted the second something breaks.
Latest Updates ( sorted recent to last )
RESOLVED
about 3 years ago - at 01/31/2023 11:00AM
This incident has been resolved.
MONITORING
about 3 years ago - at 01/30/2023 10:17AM
We have released a new sensor version to resolve the issue.
The sensor release is currently being distributed to all hosts.
The new version is sensor version is 2022.5.53.
You can verify the installation from the portal:
For WithSecure Countercept: under the version column
For WithSecure Elements EDR: under Device details view
No reboot is necessary to take the update into use.
IDENTIFIED
over 3 years ago - at 01/26/2023 01:47PM
We have identified a memory leak in the latest WithSecure Countercept and WithSecure Elements Endpoint Detection and Response sensor driver, which is part of the Windows Sensor 2022.5 which was released to production on 16th of January 2023.
The impact varies vastly host to host, some machines would barely notice this while others can degrade in a few days.
This can be identified by observing the non paged memory pool growing.
A workaround is:
For Countercept:
"C:\Program Files (x86)\F-Secure\MDR\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor
For Elements EDR: "C:\Program Files (x86)\F-Secure\PSB\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor
We are currently testing a new sensor version to resolve the issue.
Latest WithSecure outages
WithSecure Elements URL sample submission outage - 8 days ago
Axios vulnerability in Policy Manager Webreporting - 16 days ago
Contact Support form not working - about 1 month ago
Never miss outages in third-party dependencies
With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.
Start free trialNo credit card required · Cancel anytime · 6320 services available
Integrations with
