WithSecure Inspector Summary
Summary
| Property | Value |
|---|---|
| Production Status | Preview (Beta) |
| Category | Endpoint |
| Discovers | Customer company organizations under the MSP partner account |
Description
Monitors WithSecure Elements endpoint protection (EPP/EDR). Parent enumerates customer company organizations under an MSP partner; each child reports that customer's protected devices, endpoint-security posture (protection status, malware/firewall/EDR module state, client and definition versions, patch posture, disk encryption), open EDR incidents, and recent security events.
Data View Information
Parent Overview Table
- Discovered Organizations — lists each customer company organization discovered under the MSP partner account, with a Summary column set (3 columns total).
Parent Data Tab Headers
- Organization ID
- Organization Name
- Organization Type
Child Overview Table
- Overview — per-customer posture summary: device counts, protection/malware/patch/encryption rollups, open EDR incidents, and recent security events.
Child Data Tab Headers
- Devices (14 columns) — name, type, online state, OS + version, client version, protection status, malware/firewall/device-control/application-control/DataGuard module state, EDR incident counts, patch state, disk-encryption state, IP/MAC addresses, last user, subscription, timestamps.
- Security Posture (11 columns) — per-device security-module state, EDR incident counts, definitions version.
- EDR Incidents (8 columns) — name, severity, risk level/score, status, resolution, timestamps. (EDR-licensed organizations only.)
- Security Events (7 columns) — severity, engine, action, message, device, user, timestamp. (Last 7 days, critical/warning, EPP + EDR.)
Metrics
| Metric | Description |
|---|---|
| WithSecure: Device Count | Total protected devices in the organization. |
| WithSecure: Devices Online | Devices that communicated in the last 12 hours. |
| WithSecure: Devices Critical | Devices in a critical or isolated protection state. |
| WithSecure: Devices With Malware Issues | Devices whose malware protection is not enabled. |
| WithSecure: Devices Missing Critical Updates | Devices missing critical OS updates. |
| WithSecure: Devices Unencrypted | Devices without disk encryption enabled. |
| WithSecure: Open EDR Incidents | Open EDR incidents (Broad Context Detections). |
| WithSecure: Recent Security Events | Security events in the last 7 days (critical/warning). |
| WithSecure: Device Names | Names of all protected devices (for new-device detection). |
| WithSecure: Critical Devices | Names of devices in critical/isolated protection state. |
Actionable Alerts
| Rule | Trigger | Severity |
|---|---|---|
| Device Protection Degraded | More devices become critical/isolated | High |
| Malware Protection Disabled | More devices have malware protection off | High |
| New Open EDR Incident | Open EDR incident count increases | High |
| Devices Missing Critical Updates | More devices missing critical updates | Medium |
| Disk Encryption Disabled | More devices unencrypted | Medium |
| Critical Devices Changed | The set of critical devices changes | Medium |
| New Device Registered | A new device appears | Low |
| Devices Offline Increased | Online device count decreases | Low |
| Recent Security Events Spike | Recent event count increases | Low |
Updated about 7 hours ago
Did this page help you?