The Best Way to Protect Enterprise Email & Collaboration from phishing, malware, account takeover, data loss, etc.

Check Point Harmony Email & Collaboration

Harmony Email & Collaboration (HEC) provides complete
protection for Microsoft 365, Google Workspace and all your
collaboration and file-sharing apps. HEC is designed specifically
for cloud email environments and is the ONLY solution that
prevents, not just detects or responds to, threats from entering the inbox.

What does this pack do?

This pack and its resources implement the integration with
Check Point SMART API allowing:

Collect security events for your secured SaaS periodically.
Retrieve the entity info to attach evidence to your incidents.
Request actions over a specific entity.

Pack Contributors:

Christian Gutierrez

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Check Point Harmony Email & Collaboration

What does this pack do?

This pack and its resources implement the integration with
Check Point SMART API allowing:

Collect security events for your secured SaaS periodically.
Retrieve the entity info to attach evidence to your incidents.
Request actions over a specific entity.

Pack Contributors:

Christian Gutierrez

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Automations

Name	Description
ShowCPScanInfo	Get scan info from Check Point Smart API.
SendCPAction	Send quarantine or restore action and update action task id.
ShowCPEmailInfo	Get email info from Check Point Smart API.
RunCPPhishingCampaign	Search other emails by sender and/or subject and quarantine.

Classifiers

Name	Description
CheckPointHEC Classifier	CheckPointHEC Classifier to CheckPointHEC Security Event Type
CheckPointHEC Incoming Mapper	CheckPointHEC Incoming Mapper

Incident Fields

Name	Description
CheckPointHEC Email Subject	Subject of the email
CheckPointHEC Campaign Task	Campaign task id to get results
CheckPointHEC Email Sender	Sender of the email
CheckPointHEC Saas	Internal SaaS Identifier
CheckPointHEC Type	Detection type (dlp, phishing, malware, spam)
CheckPointHEC Farm	Customer farm
CheckPointHEC Email Info	Email Information
CheckPointHEC Entity	Internal entity ID of email with leak
CheckPointHEC Scan Info	Scan Information
CheckPointHEC Customer	Customer portal name
CheckPointHEC Email Task	Action task id to get results

Incident Types

Name	Description
CheckPointHEC Security Event

Integrations

Name	Description
Check Point Harmony Email and Collaboration (HEC) (Partner Contribution)	The Best Way to Protect Enterprise Email & Collaboration from phishing, malware, account takeover, data loss, etc.

Layouts

Name	Description
CP HEC Security Event Layout	Check Point HEC Incidents Layout

Playbooks

Name	Description
CheckPointHEC Get email for incident	Get email entity for a specific incident.

Automations

Name	Description
SendCPAction	Send quarantine or restore action and update action task id.
ShowCPEmailInfo	Get email info from Check Point Smart API.
RunCPPhishingCampaign	Search other emails by sender and/or subject and quarantine.
ShowCPScanInfo	Get scan info from Check Point Smart API.

Classifiers

Name	Description
CheckPointHEC Classifier	CheckPointHEC Classifier to CheckPointHEC Security Event Type
CheckPointHEC Incoming Mapper	CheckPointHEC Incoming Mapper

Incident Fields

Name	Description
CheckPointHEC Farm	Customer farm
CheckPointHEC Email Info	Email Information
CheckPointHEC Customer	Customer portal name
CheckPointHEC Email Task	Action task id to get results
CheckPointHEC Scan Info	Scan Information
CheckPointHEC Saas	Internal SaaS Identifier
CheckPointHEC Email Subject	Subject of the email
CheckPointHEC Campaign Task	Campaign task id to get results
CheckPointHEC Email Sender	Sender of the email
CheckPointHEC Entity	Internal entity ID of email with leak
CheckPointHEC Type	Detection type (dlp, phishing, malware, spam)

Incident Types

Name	Description
CheckPointHEC Security Event

Integrations

Name	Description
Check Point Harmony Email and Collaboration (HEC) (Partner Contribution)	The Best Way to Protect Enterprise Email & Collaboration from phishing, malware, account takeover, data loss, etc.

Playbooks

Name	Description
CheckPointHEC Get email for incident	Get email entity for a specific incident.

Pack Name	Pack By
Base	By: Cortex XSOAR

Pack Name	Pack By
Common Types	By: Cortex XSOAR

Pack Name	Pack By
Base	By: Cortex XSOAR

1.1.6 - 1815532 (December 16, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Added support to include/exclude accepted/declined restore requests in the fetch incidents of restore request type.

Related pull requests:
- 37670
- 37278

Download

1.1.5 - 1748140 (December 4, 2024)

Scripts

ShowCPEmailInfo

Updated the Docker image to: demisto/python3:3.11.10.115186.

RunCPPhishingCampaign

Updated the Docker image to: demisto/python3:3.11.10.115186.

ShowCPScanInfo

Updated the Docker image to: demisto/python3:3.11.10.115186.

SendCPAction

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37528
- 37524
- 37525
- 37526
- 37527

Download

1.1.4 - R1681986 (November 21, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Added support to manage Anti-Phishing and Anti-Spam exceptions by adding the commands:
- checkpointhec-get-ap-exceptions
- checkpointhec-create-ap-exception
- checkpointhec-update-ap-exception
- checkpointhec-delete-ap-exception
Added support to manage Anti-Malware exceptions by adding the commands:
- checkpointhec-get-cp2-exception
- checkpointhec-create-cp2-exception
- checkpointhec-update-cp2-exception
- checkpointhec-delete-cp2-exception
- checkpointhec-get-cp2-exceptions
- checkpointhec-delete-cp2-exceptions
Added support to manage Anomaly exceptions by adding the commands:
- checkpointhec-get-anomaly-exceptions
- checkpointhec-create-anomaly-exception
- checkpointhec-delete-anomaly-exceptions
Added support to manage Click Time Protection exceptions by adding the commands:
- checkpointhec-get-ctp-lists
- checkpointhec-get-ctp-list
- checkpointhec-get-ctp-list-items
- checkpointhec-get-ctp-list-item
- checkpointhec-create-ctp-list-item
- checkpointhec-update-ctp-list-item
- checkpointhec-delete-ctp-list-item
- checkpointhec-delete-ctp-list-items
- checkpointhec-delete-ctp-lists
Added support to manage URL exceptions by adding the commands:
- checkpointhec-get-avurl-exception
- checkpointhec-create-avurl-exception
- checkpointhec-update-avurl-exception
- checkpointhec-delete-avurl-exception
- checkpointhec-get-avurl-exceptions
- checkpointhec-delete-avurl-exceptions
Added support to manage Smart DLP exceptions by adding the commands:
- checkpointhec-get-avdlp-exception
- checkpointhec-create-avdlp-exception
- checkpointhec-update-avdlp-exception
- checkpointhec-delete-avdlp-exception
- checkpointhec-get-avdlp-exceptions
- checkpointhec-delete-avdlp-exceptions
Added support to collect restore requests as incidents.
Added support to decline restore requests in the command checkpointhec-send-action.
Added support to report emails mis-classification in the command checkpointhec-report-mis-classification.
Updated the docker image to: demisto/python3:3.11.10.113941.

Related pull requests:
- 37054
- 36662

Download

1.1.3 - 1081587 (June 9, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Updated the option for url in the connect section configuration. Now more regions are supported.

Related pull requests:
- 34774
- 34782

Download

1.1.2 - 1040634 (May 23, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Updated the human-readable section in the following commands:
- checkpointhec_get_entity
- checkpointhec_get_events
Updated the Docker image to: demisto/python3:3.10.14.95137.

Scripts

SendCPAction

Fixed an issue where the script would not work properly when there are multiple instances running.
Updated the Docker image to: demisto/python3:3.10.14.95137.

ShowCPEmailInfo

Fixed an issue where the script would not work properly when there are multiple instances running.
Updated the Docker image to: demisto/python3:3.10.14.95137.

ShowCPScanInfo

Fixed an issue where the script would not work properly when there are multiple instances running.
Updated the Docker image to: demisto/python3:3.10.14.95137.

Related pull requests:
- 34460
- 34413

Download

1.1.1 - 987681 (May 1, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Fixed an issue on fetching incidents.

Related pull requests:
- 34115
- 34124

Download

1.1.0 - 970211 (April 21, 2024)

Classifiers

New: CheckPointHEC Classifier

New: Check Point HEC Classifier to CheckPointHEC Security Event Type (Available from Cortex XSOAR 6.9.0).

Incident Fields

CheckPointHEC Campaign Task
CheckPointHEC Customer
New: CheckPointHEC Email Info
CheckPointHEC Email Sender
CheckPointHEC Email Subject
New: CheckPointHEC Email Task
CheckPointHEC Entity
CheckPointHEC Farm
CheckPointHEC Saas
New: CheckPointHEC Scan Info
CheckPointHEC Type

Integrations

Check Point Harmony Email and Collaboration (HEC)

Added a new command checkpoint-get-events.
Improved implementation of filters for command checkpoint-search-emails.
Added support for authentication with Infinity Credentials.
Added support for Google Email application.
Updated the Docker image to: demisto/python3:3.10.14.91134.

Layouts

CP HEC Security Event Layout
Added an external link for email.

Mappers

New: CheckPointHEC Incoming Mapper

New: Check Point HEC Incoming Mapper to CheckPointHEC Security Event Type (Available from Cortex XSOAR 6.9.0).

Playbooks

CheckPointHEC Get email for incident

Updated the playbook based on incident field changes.

Scripts

SendCPAction

Updated the Docker image to: demisto/python3:3.10.14.91134.

RunCPPhishingCampaign

Updated the Docker image to: demisto/python3:3.10.14.91134.

ShowCPScanInfo

Updated the Docker image to: demisto/python3:3.10.14.91134.

ShowCPEmailInfo

Updated the Docker image to: demisto/python3:3.10.14.91134.

Related pull requests:
- 33755
- 34046

Download

1.0.6 - 767481 (January 17, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Updated the Docker image to: demisto/python3:3.10.13.84405.

Related pull requests:
- 32259

Download

1.0.5 - 743135 (January 4, 2024)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Updated the Docker image to: demisto/python3:3.10.13.83255.

Related pull requests:
- 31967

Download

1.0.4 - 719071 (December 26, 2023)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Updated the metadata keywords for the pack for an improved search for the pack on the XSIAM marketplace.

Related pull requests:
- 31714

Download

1.0.3 - R7232090 (December 21, 2023)

Incident Fields

New: CP HEC Campaign Task
CP HEC Customer
New: CP HEC Email Sender
New: CP HEC Email Subject
CP HEC Entity
New: CP HEC Farm
CP HEC Saas
New: CP HEC Task
CP HEC Type

Incident Types

CheckPointHEC Security Event

Integrations

Check Point Harmony Email and Collaboration (HEC)

Updated the Docker image to: demisto/python3:3.10.13.72123.
Added a new command checkpointhec-get-email-info to get email info.
Added a new command checkpointhec-get-scan-info to get email scan info.
Added a new command checkpointhec-search-emails to search emails by sender and/or subject.
Added a new command checkpointhec-send-action to quarantine/restore emails.
Added a new command checkpointhec-get-action-result to get the result of the quarantine/restore actions.
Added a new command checkpointhec-send-notification to send email notification with the information about if end user was exposed to email.

Layouts

CP HEC Security Event Layout
Added a new section with actions for emails.
Added a new section with email info in table format.
Added a new section with scan info in JSON format.

Scripts

New: RunCPPhishingCampaign

New: Search other emails by sender and/or subject and quarantine.

New: SendCPAction

New: Send quarantine or restore action and update action task id.

New: ShowCPEmailInfo

New: Get email info from Check Point Smart API.

New: ShowCPScanInfo

New: Get scan info from Check Point Smart API.

Related pull requests:
- 29400
- 28916

Download

Certification	Certified	Read more
Supported By	Partner
Created	July 13, 2023
Last Release	December 16, 2024

Check Point Harmony Email and Collaboration (HEC)

Check Point Harmony Email & Collaboration

What does this pack do?

Pack Contributors:

Check Point Harmony Email & Collaboration

What does this pack do?

Pack Contributors:

Integrations

Check Point Harmony Email and Collaboration (HEC)

Scripts

ShowCPEmailInfo

RunCPPhishingCampaign

ShowCPScanInfo

SendCPAction

Integrations

Check Point Harmony Email and Collaboration (HEC)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Scripts

SendCPAction

ShowCPEmailInfo

ShowCPScanInfo

Integrations

Check Point Harmony Email and Collaboration (HEC)

Classifiers

New: CheckPointHEC Classifier

Incident Fields

Integrations

Check Point Harmony Email and Collaboration (HEC)

Layouts

Mappers

New: CheckPointHEC Incoming Mapper

Playbooks

CheckPointHEC Get email for incident

Scripts

SendCPAction

RunCPPhishingCampaign

ShowCPScanInfo

ShowCPEmailInfo

Integrations

Check Point Harmony Email and Collaboration (HEC)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Integrations

Check Point Harmony Email and Collaboration (HEC)

Incident Fields

Incident Types

Integrations

Check Point Harmony Email and Collaboration (HEC)

Layouts

Scripts

New: RunCPPhishingCampaign

New: SendCPAction

New: ShowCPEmailInfo

New: ShowCPScanInfo

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER