Outage in WithSecure

Memory leak in latest WithSecure Elements EDR / WithSecure Countercept Windows sensor

Resolved Minor
January 26, 2023 - Started almost 2 years ago - Lasted 5 days
Official incident page

Need to monitor WithSecure outages?
Stay on top of outages with IsDown. Monitor the official status pages of all your vendors, SaaS, and tools, including WithSecure, and never miss an outage again.
Start Free Trial

Outage Details

We have identified a memory leak in the latest WithSecure Countercept and WithSecure Elements Endpoint Detection and Response sensor driver, which is part of the Windows Sensor 2022.5 which was released to production on 16th of January 2023. The impact varies vastly host to host, some machines would barely notice this while others can degrade in a few days. This can be identified by observing the non paged memory pool growing. A workaround is: For Countercept: "C:\Program Files (x86)\F-Secure\MDR\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor For Elements EDR: "C:\Program Files (x86)\F-Secure\PSB\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor We are currently testing a new sensor version to resolve the issue.
Components affected
WithSecure Detection Cloud WithSecure Detection Cloud
Latest Updates ( sorted recent to last )
RESOLVED almost 2 years ago - at 01/31/2023 11:00AM

This incident has been resolved.

MONITORING almost 2 years ago - at 01/30/2023 10:17AM

We have released a new sensor version to resolve the issue.

The sensor release is currently being distributed to all hosts.

The new version is sensor version is 2022.5.53.
You can verify the installation from the portal:
For WithSecure Countercept: under the version column
For WithSecure Elements EDR: under Device details view

No reboot is necessary to take the update into use.

IDENTIFIED almost 2 years ago - at 01/26/2023 01:47PM

We have identified a memory leak in the latest WithSecure Countercept and WithSecure Elements Endpoint Detection and Response sensor driver, which is part of the Windows Sensor 2022.5 which was released to production on 16th of January 2023.

The impact varies vastly host to host, some machines would barely notice this while others can degrade in a few days.
This can be identified by observing the non paged memory pool growing.

A workaround is:

For Countercept:
"C:\Program Files (x86)\F-Secure\MDR\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor
For Elements EDR: "C:\Program Files (x86)\F-Secure\PSB\Ultralight\sensor\1670403971\sensor_control.exe" --restart-sensor

We are currently testing a new sensor version to resolve the issue.

Latest WithSecure outages

WithSecure Agent for Mac may not start normally, and the icon may not be visible in the start bar - 6 days ago
Significant delays in WithSecure Elements Detection and Response - 12 days ago
Error message when trying to remove a device from WithSecure Elements portal devices page - about 1 month ago
Cannot download any Advanced Response jobs attachments for all customers outside of the EU tenant - about 2 months ago
Mac Elements EDR 24.3 Update: Sensors Not Sending Events Post-Update - 3 months ago

Be the first to know when WithSecure and other third-party services go down

With IsDown, you can monitor all your critical services' official status pages from one centralized dashboard and receive instant alerts the moment an outage is detected. Say goodbye to constantly checking multiple sites for updates and stay ahead of outages with IsDown.

Start free trial

No credit card required · Cancel anytime · 3278 services available

Integrations with Slack Microsoft Teams Google Chat Datadog PagerDuty Zapier Discord Webhook

Setup in 5 minutes or less

How much time you'll save your team, by having the outages information close to them?

14-day free trial · No credit card required · Cancel anytime

Start today for FREE