Users/v dhbedu/checkpoint email security - #14972
Open
v-dhbedu_microsoft (dhanunjaya1054) wants to merge 5 commits into
Open
Users/v dhbedu/checkpoint email security#14972v-dhbedu_microsoft (dhanunjaya1054) wants to merge 5 commits into
v-dhbedu_microsoft (dhanunjaya1054) wants to merge 5 commits into
Conversation
…nector The RestApiPoller for CheckPointEmailSecurityEvents was configured with pagingInfoPlacement=QueryString for a POST endpoint. The Check Point event/query API expects the scrollId pagination token in the POST request body under requestData, not in the URL query string. This caused the connector to re-fetch page 1 on every paginated call, producing thousands of duplicate records per event (reported as 8,000+ duplicates for a single event). Fix: - Changed pagingInfoPlacement from QueryString to Body - Changed NextPageParaName from scrollId to requestData.scrollId so the token is correctly nested inside the requestData object in the POST body Bumped solution version to 3.0.2.
- Increase queryWindowInMin from 5 to 1440 (1 day) for AntiPhishing and Spam exception poller endpoints to reduce duplicate re-ingestion volume, since Check Point's exceptions API returns a full snapshot with no delta/time filter. - Add deduplicated Parser functions (CheckPointEmailSecAntiPhishingExceptions, CheckPointEmailSecuritySpamExceptions) that dedupe by EntityId via arg_max(TimeGenerated, *). - Update connector UI (graphQueries, sampleQueries, dataTypes) to reference the new parser aliases instead of raw _CL tables, so the connector blade displays deduplicated data. - Bump solution version to 3.1.0 and update ReleaseNotes.md. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
v-dhbedu_microsoft (dhanunjaya1054)
requested review from
a team
as code owners
August 25, 2026 06:06
Investigated whether pagingType: PersistentToken could genuinely fix
the exception-endpoint duplicate issue (as opposed to just reducing
poll frequency). Confirmed via Check Point's official API docs
(managing-exceptions.html) that GET /exceptions/{excType} only accepts
'excType' as a request parameter - there is no documented way to send
scrollId back in on a request, and the sample response even shows an
empty scrollId value. This confirms scrollId is purely an intra-request
depth-pagination cursor for one full snapshot listing, not a cross-poll
incremental/delta checkpoint like AirlockDigital, Atlassian, or Cyren
use PersistentToken for. PersistentToken would not have reduced
duplicates for this vendor endpoint and could risk sending an
unrecognized/stale scrollId on the next poll.
Reverted pagingType back to the original NextPageToken for both
AntiPhishing and Spam exception endpoints. The real duplicate fix
remains the deduplicated Parser functions + 1-day queryWindowInMin
already in place.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Per request, collapsed the incremental 3.0.3/3.0.4/3.0.5/3.1.0/3.1.1 package history back into a single v3.0.2 release containing all accumulated changes: - Events pagination fix (scrollId in request body, not query string) - Exception endpoint duplicate mitigation (queryWindowInMin: 1440) - Deduplicated Parser functions for AntiPhishing/Spam exceptions - Connector UI (sampleQueries/dataTypes/graphQueries) updated to use parser aliases instead of raw duplicate-laden tables - Reverted exception endpoint pagingType to NextPageToken (verified against Check Point's API docs that PersistentToken has no cross-poll delta capability for this endpoint) Removed package zips 3.0.3.zip through 3.1.1.zip. Consolidated ReleaseNotes.md into a single 3.0.2 entry describing all changes. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
v-atulyadav
added
Solution
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Required items, please complete
Change(s):
Reason for Change(s):
Version Updated:
Testing Completed: