Checkpoint Harmony Email

Overview

The Check Point Harmony Email integration enables AirMDR to collect and analyze Harmony Email & Collaboration security events using REST APIs. This helps SOC teams investigate email-based threats such as phishing, malware, suspicious URLs, DLP violations, spam, and shadow IT activity.

Supported Versions

Component	Supported Details
Product	Check Point Harmony Email & Collaboration
Platform	Check Point Infinity Portal
Authentication	Client ID and Client Secret
API Method	REST API
AirMDR Requirement	Remote Agent or AirMDR integration connector with outbound HTTPS access
Port	TCP 443

Authentication

Check Point Harmony Email uses Client ID and Client Secret to generate an API access token. The access token is then used in the Authorization header for API requests.

Create a dedicated API key for AirMDR. Do not reuse an API key shared with another third-party tool.

Pre-requisites

Users must have Administrator access to the Check Point Infinity Portal.

Ability to create and manage API Keys (Client ID & Client Secret).

AirMDR Remote Agent installed and active (if required by deployment model).

Configure Check Point Harmony Email (API Key Generation)

Access Infinity Portal

Log in to the Check Point Infinity Portal
Navigate to:
Account Settings → API Keys.

Create a New API Key

Click New
Select New Account API Key
In the Create a New API Key window:
- Choose Email & Collaboration as the service.

Generate Credentials

Enter a Description:
For example: AirMDR - Harmony Email Integration
Select an Expiration Date (recommended as per policy).
Assign appropriate role/permissions (if prompted).
Use least-privilege access while assigning permissions.

Generate Credentials

Click Create
Copy and securely store:
- Client ID
- Client Secret (Secret Key)
- Authentication URL (if displayed)
The Client Secret is visible only once. Store it securely before closing the window.

The Client ID can be viewed later from the API Keys table, but the Client Secret Key and Authentication URL cannot be retrieved after closing the creation window.

Identify Region and Base URL

Determine Tenant Region

Identify your tenant region from the Infinity Portal URL
Use the region where your Check Point Harmony Email tenant is hosted.
For Example:
- us.portal.checkpoint.com → USA region

Map Region to Base URL (For reference)

Region	Base URL
India	`https://cloudinfra-gw.in.portal.checkpoint.com/app/hec-api/`
USA	`https://cloudinfra-gw-us.portal.checkpoint.com/app/hec-api/`
Europe	`https://cloudinfra-gw.portal.checkpoint.com/app/hec-api/`
UK	`https://cloudinfra-gw.uk.portal.checkpoint.com/app/hec-api/`
Australia	`https://cloudinfra-gw.ap.portal.checkpoint.com/app/hec-api/`
Canada	`https://cloudinfra-gw.ca.portal.checkpoint.com/app/hec-api/`
UAE	`https://cloudinfra-gw.me.portal.checkpoint.com/app/hec-api/`

Validate API Authentication

Use the following sample request to verify that the Client ID and Client Secret are working:

Example POST Request using cURL:

curl -X POST "https://cloudinfra-gw.portal.checkpoint.com/auth/external" \
  -H "Content-Type: application/json" \
  -d '{
    "clientId": "<CLIENT_ID>",
    "accessKey": "<CLIENT_SECRET>"
  }'

Replace the authentication host based on the region shown in your Check Point API key details.

Response Sample

{
  "token": "<ACCESS_TOKEN>",
  "expiresIn": 3600
}

Configure Check Point Harmony Email in AirMDR Integrations Dashboard

Navigate to AirMDR, provide the credentials and click Login
Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select Integrations.
Use the search option, enter the keyword “Check Point Harmony Email”, select the Connections tab, and click + Create button.
Enter an unique name to the Instance (e.g., your org name-Check Point Harmony Email) to easily identify the user connection by AirMDR.
Enter the application credentials like Client ID, and Client Secret in the Authentication Details field params, and click Save.

Skills provided by this Integration

Skill ID	Purpose
Quarantine Checkpoint Harmony Entities	Quarantine one or more entities by ID in Checkpoint Harmony Email. Use this to isolate suspicious or malicious emails.
Restore Checkpoint Harmony Entities	Restore one or more previously quarantined entities by ID in Checkpoint Harmony Email. Use this to release false-positive quarantines.
Get Checkpoint Harmony Entity Details	Fetch detailed information for a specific entity in Checkpoint Harmony Email, including email headers, attachments, and security verdicts.
Search Checkpoint Harmony Entities	Search for entities in Checkpoint Harmony Email by sender, domain, subject, or recipient. Supports threat hunting with date range or duration filters.
Get Checkpoint Harmony Security Events	Search and retrieve security events from Checkpoint Harmony Email by type, severity, date range or duration. Supports filtering by event type, severity, Saas provider, and confidence indicator.

To view the details of Input Parameters and Output for the respective skills

Go to AirMDR → Check Point Harmony Email Integration page.
Select the Skills tab and click on the required listed skills.

Additional Information

🧰 Error Handling

Error	Possible Cause	Recovery
Authentication failed	Invalid Client ID or Client Secret	Regenerate API key and update AirMDR
Secret not retrievable	API key window was closed	Create a new API key
Region mismatch	Wrong base URL selected	Verify tenant region and update base URL
403 Forbidden	API key lacks required service/role	Recreate key with Email & Collaboration service
404 Not Found	Incorrect endpoint	Validate region-specific base URL
Connection timeout	Remote Agent cannot reach Check Point	Check DNS, firewall, proxy, and TCP 443
No events received	Polling window too narrow or no new events	Increase lookback interval and verify Harmony Email activity

🔄 Managing or Deleting the API Key

To Delete the API Key:

Identify the Key

Ensure the API key is no longer in use by AirMDR or any other integration
Deleting an active API key will immediately break the integration.

Delete the API Key

In Settings → API Keys, locate the target key
Click the Delete option (trash icon or action menu)
Confirm the deletion when prompted

Post-Deletion Validation

After deleting or rotating an API key:

Verify AirMDR integration status:
- Should not show authentication errors

Check logs for failures:

authentication failed: invalid clientId or accessKey

Confirm new key is functioning correctly

🛑 Security & Access Best Practices

Use a dedicated API key exclusively for AirMDR integration
Store Client Secret securely (avoid plaintext in scripts, logs, or shared documents)

👉 Support & Maintenance

📧 Contact AirMDR Support through your designated support channel.
🔁 Rotate credentials regularly.
🔄 Reconnect in AirMDR when secrets are changed.

Getting Started

AirMDR Detections

Integrations

API Reference

AirMDR Product Suite

Checkpoint Harmony Email

Overview

Supported Versions

Authentication

Pre-requisites

Configure Check Point Harmony Email (API Key Generation)

Determine Tenant Region

Validate API Authentication

Configure Check Point Harmony Email in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

Identify the Key

Delete the API Key

Post-Deletion Validation

​Overview

​Supported Versions

​Authentication

​Pre-requisites

​Configure Check Point Harmony Email (API Key Generation)

​Determine Tenant Region

​Validate API Authentication

​Configure Check Point Harmony Email in AirMDR Integrations Dashboard

​Skills provided by this Integration

​Additional Information

​Identify the Key

​Delete the API Key

​Post-Deletion Validation

Overview

Supported Versions

Authentication

Pre-requisites

Configure Check Point Harmony Email (API Key Generation)

Determine Tenant Region

Validate API Authentication

Configure Check Point Harmony Email in AirMDR Integrations Dashboard

Skills provided by this Integration

Additional Information

Identify the Key

Delete the API Key

Post-Deletion Validation