⚠️ CheckPoint Harmony Email and Collaboration

⚠️ Unpublished: This item is from a solution that is not yet published on Azure Marketplace or not installed in Content Hub.

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Solutions Index

Attribute	Value
Publisher	Harmony Email and Collaboration
Support Tier	Partner
Support Link	https://supportcenter.checkpoint.com/product/495
Categories	Security - Threat Intelligence
Version	3.0.0
Author	Checkpoint - support@checkpoint.com
First Published	2025-04-29
Solution Folder	Checkpoint Harmony Email and Collaboration

The Check Point Harmony Email and Collaboration solution for Microsoft Sentinel enables ingestion of security events from the Check Point Harmony Email and Collaboration API into Microsoft Sentinel using Microsoft Sentinel’s Codeless Connector Platform. The connector supports DCR-based ingestion-time transformations to parse incoming security event data into custom columns, reducing the need for query-time parsing and improving query performance.

Underlying Microsoft Technologies used:

This solution takes a dependency on the following Microsoft technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:

a. Microsoft Sentinel

b. Microsoft Sentinel Codeless Connector Platform (CCP)

c. Azure Monitor Logs custom logs and Data Collection Rules (DCR)

d. Data Collection Rule ingestion-time transformations

Data Connectors
Tables Used
Content Items

Data Connectors

This solution provides 1 data connector(s):

CheckpointHEC_CL On Demand Email Security (via Codeless Connector Platform)

Tables Used

This solution uses 1 table(s):

Table	Used By Connectors	Used By Content
`CheckpointHEC_CL`	CheckpointHEC_CL On Demand Email Security (via Codeless Connector Platform)	Analytics, Hunting

Content Items

This solution includes 7 content item(s):

Content Type	Count
Hunting Queries	5
Analytic Rules	1
Playbooks	1

Analytic Rules

Name	Severity	Tactics	Tables Used
Checkpoint - Pending Phishing emails	High	InitialAccess	`CheckpointHEC_CL`

Hunting Queries

Name	Tactics	Tables Used
DLP Detections	InitialAccess	`CheckpointHEC_CL`
Event breakdown per user	InitialAccess	`CheckpointHEC_CL`
Event count last 24 hours	InitialAccess	`CheckpointHEC_CL`
Phishing emails per internal user	InitialAccess	`CheckpointHEC_CL`
Spam emails	InitialAccess	`CheckpointHEC_CL`

Playbooks

Name	Description	Tables Used
Quarantine-Email	-	-

Release Notes

Version	Date Modified (DD-MM-YYYY)	Change History
3.0.0	11-03-2026	Initial Solution Release — includes Data Connector (CCP/Push), Analytic Rule, Hunting Queries (5), and Playbook (Quarantine)