CheckpointHEC_CL

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index

Attribute Value
Ingestion API Supported ✓ Yes

Contents

Schema (33 columns)

Source: Data Collection Rule definition

Column Name Type
email_raw dynamic
EmailAttachmentCount int
EmailAttachmentsPayloads dynamic
EmailBbc dynamic
EmailBodyContentType string
EmailCc dynamic
EmailDirection string
EmailDkimResults string
EmailDmarcResults string
EmailEmailId string
EmailFromEmail string
EmailFromName string
EmailLinks dynamic
EmailMessageId string
EmailReplyTo dynamic
EmailSaasSpamVerdict string
EmailSenderClientIp string
EmailSenderServerIp string
EmailSpfResults string
EmailSubject string
EmailTo dynamic
EmailType string
event_raw dynamic
EventAction string
EventCategory string
EventConfidenceIndicator string
EventConfidenceLevel int
EventCurrentState string
EventDescription string
EventEventId string
EventPolicyRuleId int
EventProvider string
TimeGenerated datetime

Schema References

Official Microsoft Learn documentation for field/column information:

Solutions (1)

This table is used by the following solutions:

Connectors (1)

This table is ingested by the following connectors:

Connector Selection Criteria
CheckpointHEC_CL On Demand Email Security (via Codeless Connector Platform)

Content Items Using This Table (6)

Analytic Rules (1)

In solution CheckPoint Harmony Email and Collaboration:

Analytic Rule Selection Criteria
Checkpoint - Pending Phishing emails

Hunting Queries (5)

In solution CheckPoint Harmony Email and Collaboration:

Hunting Query Selection Criteria
DLP Detections
Event breakdown per user
Event count last 24 hours
Phishing emails per internal user
Spam emails

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Tables Index