What Changed
The sole functional change is flipping isPreview to false in the connector definition JSON, promoting the Check Point Email Security CCF connector from preview to General Availability. A README was added as part of the GA review process.
Security Impact (Visibility and Fidelity)
This is a supportability milestone, not a data-path fix. If you deployed this connector during preview (v3.0.0, released 2026-07-08), ingestion behaviour is unchanged.
The connector ingests into four custom tables via CCF:
- Security events - phishing, malware, DLP detections with Severity (Low/Medium/High/Highest), ConfidenceIndicator (malicious/suspicious), SenderAddress, and State (active/dismissed)
- Anti-phishing exceptions - whitelist/exception rules in effect at the tenant
- Spam exceptions - spam whitelist and exception rules
- Audit logs - administrative actions (login/logout, configuration changes) via the Logs as a Service API
Two separate API key pairs are required: one scoped to Harmony Email & Collaboration (security events + exceptions) and one scoped to Logs as a Service (audit logs). Both are issued from the Check Point Infinity Portal. The connector supports multi-tenant deployments by allowing multiple connection entries.
API base URL is region-specific: US, EU, and AP endpoints are available. Ensure the correct regional endpoint is configured for each tenant connection.
Affected Files
Solutions/Checkpoint Email Security/Data Connectors/CheckPointEmailSecurity_CCF/CheckPointEmailSecurity_ConnectorDefinition.json
Solutions/Checkpoint Email Security/README.md
(packaging artefacts: 3.0.1.zip, ReleaseNotes.md, Solution_CheckPointEmailSecurity.json, mainTemplate.json)