Data Source
Check Point Harmony Email and Collaboration (HEC) — formerly Avanan — is a cloud email and SaaS application security platform covering Microsoft 365, Google Workspace, and other SaaS services. This solution ingests security events (phishing detections, DLP violations, spam classifications) via the Harmony API into the custom table CheckpointHEC_CL.
Ingestion Mechanism
The connector uses the Codeless Connector Framework (CCF) with a DCR-based push pipeline:
- CCF polling config (CheckpointHEC_PollingConfig.json) — REST API poller against the Harmony Smart API (/event/query, v1.0)
- DCR (CheckpointHEC_DCR.json) — routes ingested data to the CheckpointHEC_CL custom table
- Authentication — OAuth2 client credentials (clientId / clientSecret) with token caching and expiry management
- Azure Function App (AzureFunctions/) — a companion Function App (Python) exposes Quarantine and Restore HTTP-triggered functions for SOAR response actions. Supports both checkpoint and avanan brand identifiers (the vendor rebranded; both API flavors are handled via separate client classes).
The requirements.txt targets Python 3 and pulls azure-functions, requests, python-jose, and cached-property.
Detection Surface Unlocked
Analytic Rules (1 added)
CheckpointHECPhishingNotQuarantined — detects phishing events that were identified by HEC but not automatically quarantined. Fires when a phishing event in CheckpointHEC_CL has a non-quarantined state, surfacing emails that reached user inboxes despite being flagged.
- Primary table: CheckpointHEC_CL
- MITRE: T1566 (Phishing)
- Entity mapping: Account (email recipient), URL (email link), Email (message)
Hunting Queries (5 added)
| Query | Description |
|---|---|
| CheckpointPhishing | All phishing events across the fleet |
| CheckpointHighConfidenceSpam | High-confidence spam classifications |
| CheckpointDLPEvent | Data loss prevention policy violations (exfiltration signals) |
| CheckpointEventPerUser | Per-user event breakdown for anomaly pivoting |
| CheckpointEventRecapLastDay | 24-hour event recap for SOC briefings |
Playbook (1 added)
Quarantine — Logic App (quarantine.json) triggered from a Sentinel incident. Calls the Azure Function App quarantine endpoint to isolate the flagged email entity via the HEC API. Supports both entityQuarantine and eventQuarantine action modes.
MITRE Coverage
| Technique | Tactic | Coverage |
|---|---|---|
| T1566 | Initial Access — Phishing | Analytic Rule + Hunting Queries detect phishing events not quarantined by HEC |
Affected Files
.script/tests/KqlvalidationsTests/CustomTables/CheckpointHEC_CL.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/Checkpoint Harmony Email and Collaboration/Analytic Rules/CheckpointHECPhishingNotQuarantined.yaml
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Quarantine/__init__.py
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Quarantine/function.json
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Restore/__init__.py
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/Restore/function.json
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/__init__.py
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/host.json
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/requirements.txt
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/utils/__init__.py
Solutions/Checkpoint Harmony Email and Collaboration/AzureFunctions/utils/client.py
Solutions/Checkpoint Harmony Email and Collaboration/Data Connectors/CheckpointHEC_DCR.json
Solutions/Checkpoint Harmony Email and Collaboration/Data Connectors/CheckpointHEC_Definition.json
Solutions/Checkpoint Harmony Email and Collaboration/Data Connectors/CheckpointHEC_PollingConfig.json
Solutions/Checkpoint Harmony Email and Collaboration/Data Connectors/CheckpointHEC_Table.json
Solutions/Checkpoint Harmony Email and Collaboration/Hunting Queries/CheckpointDLPEvent.yaml
Solutions/Checkpoint Harmony Email and Collaboration/Hunting Queries/CheckpointEventPerUser.yaml
Solutions/Checkpoint Harmony Email and Collaboration/Hunting Queries/CheckpointEventRecapLastDay.yaml
Solutions/Checkpoint Harmony Email and Collaboration/Hunting Queries/CheckpointHighConfidenceSpam.yaml
Solutions/Checkpoint Harmony Email and Collaboration/Hunting Queries/CheckpointPhishing.yaml
Solutions/Checkpoint Harmony Email and Collaboration/Package/testParameters.json
Solutions/Checkpoint Harmony Email and Collaboration/Playbooks/Quarantine/quarantine.json
(packaging artefacts: 3.0.0.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_Checkpoint HEC.json, createUiDefinition.json, mainTemplate.json)