Skip to content

Commit 93efb44

Browse files
v-ramonasRamon Ascencio Bribiesca (TATA CONSULTANCY SERVICES LTD)
v-ramonas
and
Ramon Ascencio Bribiesca (TATA CONSULTANCY SERVICES LTD)
authored
[GA] Check Point Email Security (#14733)
* Update CheckPointEmailSecurity_ConnectorDefinition.json * Package solution * Update ReleaseNotes.md * Create README.md * Update README.md --------- Co-authored-by: Ramon Ascencio Bribiesca (TATA CONSULTANCY SERVICES LTD) <v-ramonas+microsoft@microsoft.com>
1 parent fc4fe11 commit 93efb44

6 files changed

Lines changed: 95 additions & 7 deletions

File tree

‎Solutions/Checkpoint Email Security/Data Connectors/CheckPointEmailSecurity_CCF/CheckPointEmailSecurity_ConnectorDefinition.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@
7474
}
7575
],
7676
"availability": {
77-
"isPreview": true,
77+
"isPreview": false,
7878
"status": 1
7979
},
8080
"permissions": {

‎Solutions/Checkpoint Email Security/Data/Solution_CheckPointEmailSecurity.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
"Watchlists": [],
1313
"Playbooks": [],
1414
"BasePath": "C:\\Sentinel\\Azure-Sentinel\\Solutions\\Checkpoint Email Security",
15-
"Version": "3.0.0",
15+
"Version": "3.0.1",
1616
"Metadata": "SolutionMetadata.json",
1717
"TemplateSpec": true,
1818
"Is1PConnector": false

‎Solutions/Checkpoint Email Security/Package/3.0.1.zip‎

12.3 KB
Binary file not shown.

‎Solutions/Checkpoint Email Security/Package/mainTemplate.json‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,11 +47,11 @@
4747
"email": "support@microsoft.com",
4848
"_email": "[variables('email')]",
4949
"_solutionName": "Checkpoint Email Security",
50-
"_solutionVersion": "3.0.0",
50+
"_solutionVersion": "3.0.1",
5151
"solutionId": "azuresentinel.azure-sentinel-solution-checkpoint-email-security",
5252
"_solutionId": "[variables('solutionId')]",
5353
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
54-
"dataConnectorCCPVersion": "3.0.0",
54+
"dataConnectorCCPVersion": "3.0.1",
5555
"_dataConnectorContentIdConnectorDefinition1": "CheckPointEmailSecConnector",
5656
"dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
5757
"_dataConnectorContentIdConnections1": "CheckPointEmailSecConnectorConnections",
@@ -155,7 +155,7 @@
155155
}
156156
],
157157
"availability": {
158-
"isPreview": true,
158+
"isPreview": false,
159159
"status": 1
160160
},
161161
"permissions": {
@@ -1273,7 +1273,7 @@
12731273
}
12741274
],
12751275
"availability": {
1276-
"isPreview": true,
1276+
"isPreview": false,
12771277
"status": 1
12781278
},
12791279
"permissions": {
@@ -1858,7 +1858,7 @@
18581858
"apiVersion": "2023-04-01-preview",
18591859
"location": "[parameters('workspace-location')]",
18601860
"properties": {
1861-
"version": "3.0.0",
1861+
"version": "3.0.1",
18621862
"kind": "Solution",
18631863
"contentSchemaVersion": "3.0.0",
18641864
"displayName": "Checkpoint Email Security",

‎Solutions/Checkpoint Email Security/README.md‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
# Check Point Email Security Solution for Microsoft Sentinel
2+
3+
## Overview
4+
5+
The Check Point Email Security (Harmony Email & Collaboration) solution for Microsoft Sentinel enables you to ingest security events and audit logs from Check Point's Email Security platform using the Codeless Connector Framework (CCF). This connector provides visibility into advanced email threats including:
6+
7+
## Data Collected
8+
9+
The connector ingests data into four custom tables in your Log Analytics workspace:
10+
11+
- Security events including phishing, malware, DLP, and other threat detections with severity levels, confidence indicators, and remediation actions
12+
- Anti-phishing whitelist and exception rules configured in your tenant
13+
- Spam whitelist and exception rules configured in your tenant
14+
- Administrative actions and system events including login/logout, configuration changes, and other audit trail data
15+
16+
### Key Fields in Security Events
17+
18+
- **EventType** - Type of security event (dlp, phishing, malware, etc.)
19+
- **Severity** - Severity level (Low, Medium, High, Highest)
20+
- **ConfidenceIndicator** - Detection confidence (malicious, suspicious)
21+
- **SenderAddress** - Email sender associated with the event
22+
- **State** - Current event state (active, dismissed)
23+
- **Saas** - Source platform (office365_emails, gmail)
24+
25+
## Prerequisites
26+
27+
Before configuring the connector, you need:
28+
29+
1. **Microsoft Sentinel workspace** with read and write permissions
30+
2. **Check Point Infinity Portal account** with access to:
31+
- Harmony Email & Collaboration service
32+
- Logs as a Service capability
33+
34+
### API Credentials Required
35+
36+
You need **two separate API keys** from the Check Point Infinity Portal:
37+
38+
| Credential | Service | Purpose |
39+
|------------|---------|---------|
40+
| Client ID + Client Secret | Harmony Email & Collaboration | Security events and exceptions |
41+
| Audit Client ID + Audit Client Secret | Logs as a Service | Audit logs |
42+
43+
## How to Connect
44+
45+
### Step 1: Generate API Keys in Check Point Infinity Portal
46+
47+
1. Log in to your [Check Point Infinity Portal](https://portal.checkpoint.com)
48+
2. Navigate to **Global Settings** > **API Keys**
49+
3. Create the first API key:
50+
- Select service: **Harmony Email & Collaboration**
51+
- Save the **Client ID** and **Client Secret**
52+
4. Create the second API key:
53+
- Select service: **Logs as a Service**
54+
- Save the **Audit Client ID** and **Audit Client Secret**
55+
56+
### Step 2: Identify Your API Base URL
57+
58+
The API Base URL is region-specific. Use the appropriate URL for your tenant:
59+
60+
| Region | API Base URL |
61+
|--------|--------------|
62+
| US | `https://cloudinfra-gw.portal.checkpoint.com` |
63+
| EU | `https://cloudinfra-gw-eu.portal.checkpoint.com` |
64+
| AP | `https://cloudinfra-gw-ap.portal.checkpoint.com` |
65+
66+
### Step 3: Configure the Connector in Microsoft Sentinel
67+
68+
1. In Microsoft Sentinel, navigate to **Data connectors**
69+
2. Search for **Check Point Email Security (via Codeless Connector Framework)**
70+
3. Click **Open connector page**
71+
4. Click **Add Connection**
72+
5. Enter the following:
73+
- **API Base URL** - Your region-specific base URL
74+
- **Client ID** - From Harmony Email & Collaboration API key
75+
- **Client Secret** - From Harmony Email & Collaboration API key
76+
- **Audit Client ID** - From Logs as a Service API key
77+
- **Audit Client Secret** - From Logs as a Service API key
78+
6. Click **Connect**
79+
80+
### Multi-Tenant Support
81+
82+
This connector supports ingesting data from multiple Check Point Email Security tenants. To add additional tenants, click **Add Connection** and provide the credentials for each tenant separately.
83+
84+
85+
## Resources
86+
87+
- [Check Point Harmony Email & Collaboration Documentation](https://www.checkpoint.com/harmony/email-security/)

‎Solutions/Checkpoint Email Security/ReleaseNotes.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** |
22
|-------------|--------------------------------|--------------------------------------------------------------|
3+
| 3.0.1 | 21-07-2026 | Promote CCF Data Connector to GA. |
34
| 3.0.0 | 08-07-2026 | Initial release. Added **Data Connector** for Check Point Email Security (via Codeless Connector Framework) ingesting Security Events, Anti-Phishing Exceptions, Spam Exceptions, and Audit Logs data streams. |

0 commit comments

Comments
 (0)