Check Point Harmony Email & Collaboration

The Dropzone AI platform integrates with Check Point Harmony Email & Collaboration APIs. This document describes how to set up OAuth credentials in the Check Point Infinity Portal and install them into the Dropzone platform.

The integration automatically ingests the following email security alert types from Check Point Harmony:

• phishing - Phishing email alerts
• malware - Malware email alerts
• suspicious_phishing - Suspicious phishing email alerts
• suspicious_malware - Suspicious malware email alerts
• anomaly - Admin-blacklisted emails and other anomalies

Create Oath credentials

Check Point Harmony requires an Account API Key to enable. To create an Account API Key, do the following:

• In your Check Point Infinity Portal, navigate to ⚙️ > API Keys

• Navigate to New > New account API key

• Under "Service," select Email & Collaboration

• In the Expiration field, select an expiration date and time for the API Key

• In the Description field, enter a memorable description for the API Key, such as "Dropzone AI"

• Click "Create"

• Copy the Client ID, Secret Key, and Authentication URL shown for use later in the Dropzone UI where they are called "Client ID," "Secret Key," and "Authentication URL (API Endpoint)" respectively

• Click "Close"

For additional information, see the Check Point Infinity Portal API Keys Documentation.

Enable Check Point Harmony

The Alert source integration allows Dropzone AI to pull alerts from Check Point Harmony Email & Collaboration for investigation.

You'll need the following information:

To enable the Alert Source integration, do the following:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Check Point, then click "Configure"

• Input the Client ID, Secret Key, and Authentication URL

• Under "Enabled Severities," select which severity levels to ingest from Check Point Harmony
• Under "Enabled States," select which event states to ingest from Check Point Harmony

• Input your desired poll interval and lookback

• If you wish to further filter alerts using the Python CEL package, check the box labeled "Use advanced filtering"
• Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
• Contact your Dropzone AI support representative for more information about this feature

• Click "Test & Save" to finish

You should begin ingesting alerts immediately.

If you have any errors engage your Dropzone AI support representative.