Data Source

Check Point Exposure Management (Infinity External Risk Management / Argos) ThreatCloud Intelligence Feed – a commercial threat intelligence feed exposing indicators (IPs, domains, URLs, file hashes) enriched with:

  • Confidence score, severity, and malicious classification
  • Kill-chain stage
  • Blocking and uniqueness flags
  • Malware type associations
  • CVE and campaign associations

The feed API endpoint polls POST against argosurl/ioc-intel/feed-api/v1/feed/jsonl using JSON Lines format.

Ingestion Mechanism

CCF (Codeless Connector Framework) polling connector:

  • Polls every 60 minutes using an incremental added_to_feed_after cursor
  • DCR transform sets TimeGenerated = coalesce(todatetime(added_to_feed), now()) and flags fallback rows via ingestion_used_fallback_time
  • Destination table: emiocintel_CL (18 columns including TimeGenerated)
  • Separate solutionId/offerId: azure-sentinel-checkpoint-em-threatcloud-intelligence-feed

This solution co-exists with the existing Check Point Cyberint IOC solution (table iocsent_CL, daily-batch endpoint) without conflict.

Detection Surface Unlocked

With emiocintel_CL populated, detection engineers can:

  • Join ThreatCloud indicators against network/DNS/web session tables for IoC matching
  • Filter by kill-chain stage to prioritize active exploitation indicators
  • Correlate CVE associations with vulnerability scanner data for targeted exposure correlation
  • Use the ingestion_used_fallback_time flag to identify indicators where timestamp fidelity is uncertain

Bundled Playbook

CPEM_IOCIntelligenceEnrichment (Enrichment trigger – fires on incident creation):

  • Extracts IP, FileHash, DNS, and URL entities from the incident
  • Enriches each entity against the Check Point Exposure Management API
  • Writes a structured comment back to the incident containing: malicious classification, confidence, severity, activity status, kill-chain stage, malware types, CVE associations, campaign names

The playbook requires an Argos URL, API token, and Customer Name configured at deployment.

This PR also includes minor fixes to two sibling solutions:

  • Check Point Cyberint Alerts v3.1.2: Updated support contact URL; CPEM Importer playbook rewritten (v3.0) to use SecurityAlert + bridge analytic rule pipeline instead of direct incident creation, restoring the alert object the CPEM Exporter playbook depends on.
  • Check Point Cyberint IOC v3.0.4: Updated support contact URL and documentation links.

Affected Files

Solutions/Check Point Cyberint Alerts/Data Connectors/CyberintArgosAlertsLogs_ccp/CyberintArgosAlertsLogs_PollingConfig.json
Solutions/Check Point Cyberint Alerts/Package/testParameters.json
Solutions/Check Point Cyberint Alerts/Playbooks/Enrichment/CPEM_FetchAttachments/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Enrichment/CPEM_IOCEnrichment/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Response/CPEM_CredentialLeakResponse/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Response/CPEM_PhishingTakedown/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Response/CPEM_VulnerabilityMonitoring/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_InboundSync/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_InboundSync/readme.md
Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_ManualStatusUpdate/azuredeploy.json
Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_OutboundSync/azuredeploy.json
Solutions/Check Point Cyberint Alerts/README.md
Solutions/Check Point Cyberint Alerts/docs/sentinel-playbook-template-rendering-fixes.md
Solutions/Check Point Cyberint IOC/Data Connectors/CyberintArgosIOCLogs_ccp/CyberintArgosIOCLogs_PollingConfig.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/Data Connectors/CPEMIOCIntelligenceLogs_ccp/CPEMIOCIntelligenceLogs_DCR.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/Data Connectors/CPEMIOCIntelligenceLogs_ccp/CPEMIOCIntelligenceLogs_PollingConfig.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/Data Connectors/CPEMIOCIntelligenceLogs_ccp/CPEMIOCIntelligenceLogs_Table.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/Data Connectors/CPEMIOCIntelligenceLogs_ccp/CPEMIOCIntelligenceLogs_connectorDefinition.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/Package/testParameters.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/Playbooks/CPEM_IOCIntelligenceEnrichment/azuredeploy.json
Solutions/Check Point EM ThreatCloud Intelligence Feed/README.md
(packaging artefacts: 3.0.0.zip, 3.0.4.zip, 3.1.2.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_CPEMIOCIntelligence.json, Solution_Cyberint.json, createUiDefinition.json, mainTemplate.json)