> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airmdr.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Checkpoint Harmony Email

> Check Point Harmony Email is a cloud-based email and collaboration security solution that protects against phishing, malware, account compromise, and data loss across platforms like Microsoft 365 and Google Workspace.
It provides advanced threat detection, real-time prevention, and visibility into email and SaaS-based attacks to help security teams investigate and respond effectively.

## Overview

The Check Point Harmony Email integration enables AirMDR to collect and analyze Harmony Email & Collaboration security events using REST APIs. This helps SOC teams investigate email-based threats such as phishing, malware, suspicious URLs, DLP violations, spam, and shadow IT activity.

## Supported Versions

| Component          | Supported Details                                                       |
| :----------------- | :---------------------------------------------------------------------- |
| Product            | Check Point Harmony Email & Collaboration                               |
| Platform           | Check Point Infinity Portal                                             |
| Authentication     | Client ID and Client Secret                                             |
| API Method         | REST API                                                                |
| AirMDR Requirement | Remote Agent or AirMDR integration connector with outbound HTTPS access |
| Port               | TCP 443                                                                 |

## Authentication

Check Point Harmony Email uses **Client ID** and **Client Secret** to generate an API access token. The access token is then used in the `Authorization` header for API requests.

<Note>
  Create a dedicated API key for AirMDR. Do not reuse an API key shared with another third-party tool.
</Note>

### Pre-requisites

> <Check>
>   Users must have Administrator access to the **Check Point Infinity Portal**.
> </Check>
>
> <Check>
>   Ability to create and manage **API Keys (Client ID & Client Secret)**.
> </Check>
>
> <Check>
>   AirMDR Remote Agent installed and active (if required by deployment model).
> </Check>

### Configure Check Point Harmony Email (API Key Generation)

<Steps>
  <Step title="Access Infinity Portal">
    1. Log in to the [**Check Point Infinity Portal**](https://portal.checkpoint.com/signin)
    2. Navigate to:\
       **Account Settings → API Keys**.
  </Step>

  <Step title="Create a New API Key">
    1. Click **New**
    2. Select **New Account API Key**
    3. In the **Create a New API Key** window:
       * Choose **Email & Collaboration** as the service.
  </Step>

  <Step title="Generate Credentials">
    1. Enter a **Description**:\
       For example: `AirMDR - Harmony Email Integration` 
    2. Select an **Expiration Date** (recommended as per policy).
    3. Assign appropriate **role/permissions** (if prompted).
           <Tip>
             Use least-privilege access while assigning permissions.
           </Tip>
  </Step>

  <Step title="Generate Credentials">
    1. Click **Create**
    2. Copy and securely store:
       * **Client ID**
       * **Client Secret (Secret Key)**
       * **Authentication URL (if displayed)**
           <Warning>
             **The Client Secret is visible only once. Store it securely before closing the window.**
           </Warning>
           <Warning>
             **The Client ID can be viewed later from the API Keys table, but the Client Secret Key and Authentication URL cannot be retrieved after closing the creation window.**
           </Warning>
  </Step>

  <Step title="Identify Region and Base URL">
    #### Determine Tenant Region

    * Identify your tenant region from the Infinity Portal URL
    * Use the region where your Check Point Harmony Email tenant is hosted.\
      For Example:
      * `us.portal.checkpoint.com` → USA region

    <Accordion title="Map Region to Base URL (For reference)">
      | Region    | Base URL                                                      |
      | :-------- | :------------------------------------------------------------ |
      | India     | `https://cloudinfra-gw.in.portal.checkpoint.com/app/hec-api/` |
      | USA       | `https://cloudinfra-gw-us.portal.checkpoint.com/app/hec-api/` |
      | Europe    | `https://cloudinfra-gw.portal.checkpoint.com/app/hec-api/`    |
      | UK        | `https://cloudinfra-gw.uk.portal.checkpoint.com/app/hec-api/` |
      | Australia | `https://cloudinfra-gw.ap.portal.checkpoint.com/app/hec-api/` |
      | Canada    | `https://cloudinfra-gw.ca.portal.checkpoint.com/app/hec-api/` |
      | UAE       | `https://cloudinfra-gw.me.portal.checkpoint.com/app/hec-api/` |
    </Accordion>
  </Step>
</Steps>

### Validate API Authentication

Use the following sample request to verify that the Client ID and Client Secret are working:

<AccordionGroup>
  <Accordion title="Example POST Request using cURL:">
    ```text theme={null}
    curl -X POST "https://cloudinfra-gw.portal.checkpoint.com/auth/external" \
      -H "Content-Type: application/json" \
      -d '{
        "clientId": "<CLIENT_ID>",
        "accessKey": "<CLIENT_SECRET>"
      }'
    ```

    <Note>
      Replace the authentication host based on the region shown in your Check Point API key details.
    </Note>
  </Accordion>

  <Accordion title="Response Sample">
    ```text theme={null}
    {
      "token": "<ACCESS_TOKEN>",
      "expiresIn": 3600
    }
    ```
  </Accordion>
</AccordionGroup>

### Configure Check Point Harmony Email in AirMDR Integrations Dashboard

1. Navigate to [AirMDR](https://app.airmdr.com/auth/login), provide the credentials and click **Login**
2. Navigate to the AirMDR Integrations Dashboard in the left navigation pane and select **Integrations**.
3. Use the search option, enter the keyword "**Check Point Harmony Email**", select the **Connections** tab, and click **+ Create** button.
4. Enter an unique name to the Instance (e.g., `your org name-Check Point Harmony Email`) to easily identify the user connection by AirMDR.
5. Enter the application credentials like **Client ID,** and **Client Secret** in the Authentication Details field params, and click **Save**.

### Skills provided by this Integration

| **Skill ID**                           | **Purpose**                                                                                                                                                                                       |
| :------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Quarantine Checkpoint Harmony Entities | Quarantine one or more entities by ID in Checkpoint Harmony Email. Use this to isolate suspicious or malicious emails.                                                                            |
| Restore Checkpoint Harmony Entities    | Restore one or more previously quarantined entities by ID in Checkpoint Harmony Email. Use this to release false-positive quarantines.                                                            |
| Get Checkpoint Harmony Entity Details  | Fetch detailed information for a specific entity in Checkpoint Harmony Email, including email headers, attachments, and security verdicts.                                                        |
| Search Checkpoint Harmony Entities     | Search for entities in Checkpoint Harmony Email by sender, domain, subject, or recipient. Supports threat hunting with date range or duration filters.                                            |
| Get Checkpoint Harmony Security Events | Search and retrieve security events from Checkpoint Harmony Email by type, severity, date range or duration. Supports filtering by event type, severity, Saas provider, and confidence indicator. |

<Tip>
  To view the details of Input Parameters and Output for the respective skills

  * Go to [AirMDR → Check Point Harmony Email](https://app.airmdr.com/integrationsv2/98698852-8316-41ef-9bad-c106831112a9/skills?search=check) Integration page.
  * Select the **Skills** tab and click on the required listed skills.
</Tip>

## Additional Information

<AccordionGroup>
  <Accordion title="🧰 Error Handling">
    | Error                  | Possible Cause                             | Recovery                                                     |
    | :--------------------- | :----------------------------------------- | :----------------------------------------------------------- |
    | Authentication failed  | Invalid Client ID or Client Secret         | Regenerate API key and update AirMDR                         |
    | Secret not retrievable | API key window was closed                  | Create a new API key                                         |
    | Region mismatch        | Wrong base URL selected                    | Verify tenant region and update base URL                     |
    | 403 Forbidden          | API key lacks required service/role        | Recreate key with Email & Collaboration service              |
    | 404 Not Found          | Incorrect endpoint                         | Validate region-specific base URL                            |
    | Connection timeout     | Remote Agent cannot reach Check Point      | Check DNS, firewall, proxy, and TCP 443                      |
    | No events received     | Polling window too narrow or no new events | Increase lookback interval and verify Harmony Email activity |
  </Accordion>

  <Accordion title="🔄 Managing or Deleting the API Key">
    To Delete the API Key:

    #### Identify the Key

    * Ensure the API key is **no longer in use** by AirMDR or any other integration
          <Warning>
            Deleting an active API key will immediately break the integration.
          </Warning>

    #### Delete the API Key

    1. In **Settings → API Keys**, locate the target key
    2. Click the **Delete** option (trash icon or action menu)
    3. Confirm the deletion when prompted

    ### Post-Deletion Validation

    After deleting or rotating an API key:

    * Verify AirMDR integration status:
      * Should not show authentication errors
    * Check logs for failures:
      ```text theme={null}
      authentication failed: invalid clientId or accessKey
      ```
    * Confirm new key is functioning correctly
  </Accordion>

  <Accordion title="🛑 Security & Access Best Practices">
    * Use a **dedicated API key** exclusively for AirMDR integration
    * Store **Client Secret securely** (avoid plaintext in scripts, logs, or shared documents)
  </Accordion>

  <Accordion title="👉 Support & Maintenance">
    * 📧 Contact [**AirMDR Support**](mailto:support@airmdr.com) through your designated support channel.
    * 🔁 Rotate credentials regularly.
    * 🔄 Reconnect in AirMDR when secrets are changed.
  </Accordion>
</AccordionGroup>