![](\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/Azure_Sentinel.svg\")
\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Checkpoint%20Email%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Check Point Email Security (Harmony Email & Collaboration)](https://www.checkpoint.com/harmony/email-security/) Solution for Microsoft Sentinel enables you to ingest security events, anti-phishing exceptions, spam exceptions, and audit logs from Check Point's Email Security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). This solution provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)\n\n**Data Connectors:** 1\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
+ "description": "\n\n**Note:** Please refer to the following before installing the solution: \n\n• Review the solution [Release Notes](https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/Checkpoint%20Email%20Security/ReleaseNotes.md)\n\n • There may be [known issues](https://aka.ms/sentinelsolutionsknownissues) pertaining to this Solution, please refer to them before installing.\n\nThe [Check Point Email Security (Harmony Email & Collaboration)](https://www.checkpoint.com/harmony/email-security/) Solution for Microsoft Sentinel enables you to ingest security events, anti-phishing exceptions, spam exceptions, and audit logs from Check Point's Email Security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). This solution provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery.\n\n**Underlying Microsoft Technologies used:**\n\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:\n\na. [Codeless Connector Platform (CCP)](https://docs.microsoft.com/azure/sentinel/create-codeless-connector?tabs=deploy-via-arm-template%2Cconnect-via-the-azure-portal)\n\n**Data Connectors:** 1, **Parsers:** 2\n\n[Learn more about Microsoft Sentinel](https://aka.ms/azuresentinel) | [Learn more about Solutions](https://aka.ms/azuresentinelsolutionsdoc)",
"subscription": {
"resourceProviders": [
"Microsoft.OperationsManagement/solutions",
diff --git a/Solutions/Checkpoint Email Security/Package/mainTemplate.json b/Solutions/Checkpoint Email Security/Package/mainTemplate.json
index b1d50c11cd7..c469b177b1f 100644
--- a/Solutions/Checkpoint Email Security/Package/mainTemplate.json
+++ b/Solutions/Checkpoint Email Security/Package/mainTemplate.json
@@ -47,17 +47,31 @@
"email": "support@microsoft.com",
"_email": "[variables('email')]",
"_solutionName": "Checkpoint Email Security",
- "_solutionVersion": "3.0.1",
+ "_solutionVersion": "3.0.2",
"solutionId": "azuresentinel.azure-sentinel-solution-checkpoint-email-security",
"_solutionId": "[variables('solutionId')]",
"workspaceResourceId": "[resourceId('microsoft.OperationalInsights/Workspaces', parameters('workspace'))]",
- "dataConnectorCCPVersion": "3.0.1",
+ "dataConnectorCCPVersion": "3.0.2",
"_dataConnectorContentIdConnectorDefinition1": "CheckPointEmailSecConnector",
"dataConnectorTemplateNameConnectorDefinition1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnectorDefinition1')))]",
"_dataConnectorContentIdConnections1": "CheckPointEmailSecConnectorConnections",
"dataConnectorTemplateNameConnections1": "[concat(parameters('workspace'),'-dc-',uniquestring(variables('_dataConnectorContentIdConnections1')))]",
"dataCollectionEndpointId1": "[concat('/subscriptions/',parameters('subscription'),'/resourceGroups/',parameters('resourceGroupName'),'/providers/Microsoft.Insights/dataCollectionEndpoints/',parameters('workspace'))]",
"blanks": "[replace('b', 'b', '')]",
+ "parserObject1": {
+ "_parserName1": "[concat(parameters('workspace'),'/','CheckPointEmailSecAntiPhishingExceptions')]",
+ "_parserId1": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CheckPointEmailSecAntiPhishingExceptions')]",
+ "parserTemplateSpecName1": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('CheckPointEmailSecAntiPhishingExceptions-Parser')))]",
+ "parserVersion1": "1.0.0",
+ "parserContentId1": "CheckPointEmailSecAntiPhishingExceptions-Parser"
+ },
+ "parserObject2": {
+ "_parserName2": "[concat(parameters('workspace'),'/','CheckPointEmailSecuritySpamExceptions')]",
+ "_parserId2": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CheckPointEmailSecuritySpamExceptions')]",
+ "parserTemplateSpecName2": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat(parameters('workspace'),'-pr-',uniquestring('CheckPointEmailSecuritySpamExceptions-Parser')))]",
+ "parserVersion2": "1.0.0",
+ "parserContentId2": "CheckPointEmailSecuritySpamExceptions-Parser"
+ },
"_solutioncontentProductId": "[concat(take(variables('_solutionId'),50),'-','sl','-', uniqueString(concat(variables('_solutionId'),'-','Solution','-',variables('_solutionId'),'-', variables('_solutionVersion'))))]"
},
"resources": [
@@ -100,12 +114,12 @@
{
"metricName": "Total anti-phishing exceptions received",
"legend": "Check Point Anti-Phishing Exceptions",
- "baseQuery": "CheckPointEmailSecAntiPhishingExceptions_CL"
+ "baseQuery": "CheckPointEmailSecAntiPhishingExceptions"
},
{
"metricName": "Total spam exceptions received",
"legend": "Check Point Spam Exceptions",
- "baseQuery": "CheckPointEmailSecuritySpamExceptions_CL"
+ "baseQuery": "CheckPointEmailSecuritySpamExceptions"
},
{
"metricName": "Total audit logs received",
@@ -120,11 +134,11 @@
},
{
"description": "Get sample of Check Point Anti-Phishing Exceptions",
- "query": "CheckPointEmailSecAntiPhishingExceptions_CL\n | take 10"
+ "query": "CheckPointEmailSecAntiPhishingExceptions\n | take 10"
},
{
"description": "Get sample of Check Point Spam Exceptions",
- "query": "CheckPointEmailSecuritySpamExceptions_CL\n | take 10"
+ "query": "CheckPointEmailSecuritySpamExceptions\n | take 10"
},
{
"description": "Get sample of Check Point Audit Logs",
@@ -137,12 +151,12 @@
"lastDataReceivedQuery": "CheckPointEmailSecurityEvents_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
},
{
- "name": "CheckPointEmailSecAntiPhishingExceptions_CL",
- "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
+ "name": "CheckPointEmailSecAntiPhishingExceptions",
+ "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions\n| where TimeGenerated > ago(2d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
},
{
- "name": "CheckPointEmailSecuritySpamExceptions_CL",
- "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
+ "name": "CheckPointEmailSecuritySpamExceptions",
+ "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions\n| where TimeGenerated > ago(2d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
},
{
"name": "CheckPointEmailSecurityAuditLogs_CL",
@@ -1218,12 +1232,12 @@
{
"metricName": "Total anti-phishing exceptions received",
"legend": "Check Point Anti-Phishing Exceptions",
- "baseQuery": "CheckPointEmailSecAntiPhishingExceptions_CL"
+ "baseQuery": "CheckPointEmailSecAntiPhishingExceptions"
},
{
"metricName": "Total spam exceptions received",
"legend": "Check Point Spam Exceptions",
- "baseQuery": "CheckPointEmailSecuritySpamExceptions_CL"
+ "baseQuery": "CheckPointEmailSecuritySpamExceptions"
},
{
"metricName": "Total audit logs received",
@@ -1238,11 +1252,11 @@
},
{
"description": "Get sample of Check Point Anti-Phishing Exceptions",
- "query": "CheckPointEmailSecAntiPhishingExceptions_CL\n | take 10"
+ "query": "CheckPointEmailSecAntiPhishingExceptions\n | take 10"
},
{
"description": "Get sample of Check Point Spam Exceptions",
- "query": "CheckPointEmailSecuritySpamExceptions_CL\n | take 10"
+ "query": "CheckPointEmailSecuritySpamExceptions\n | take 10"
},
{
"description": "Get sample of Check Point Audit Logs",
@@ -1255,12 +1269,12 @@
"lastDataReceivedQuery": "CheckPointEmailSecurityEvents_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
},
{
- "name": "CheckPointEmailSecAntiPhishingExceptions_CL",
- "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
+ "name": "CheckPointEmailSecAntiPhishingExceptions",
+ "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions\n| where TimeGenerated > ago(2d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
},
{
- "name": "CheckPointEmailSecuritySpamExceptions_CL",
- "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
+ "name": "CheckPointEmailSecuritySpamExceptions",
+ "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions\n| where TimeGenerated > ago(2d)\n| summarize Time = max(TimeGenerated)\n| where isnotempty(Time)"
},
{
"name": "CheckPointEmailSecurityAuditLogs_CL",
@@ -1634,7 +1648,7 @@
"pagingType": "NextPageToken",
"nextPageTokenJsonPath": "$.responseEnvelope.scrollId",
"NextPageParaName": "scrollId",
- "pagingInfoPlacement": "QueryString"
+ "pagingInfoPlacement": "RequestBody"
},
"connectorDefinitionName": "CheckPointEmailSecConnector",
"dataType": "CheckPointEmailSecurityEvents",
@@ -1678,12 +1692,11 @@
"apiEndpoint": "[[concat(parameters('apiUrl'),'/app/hec-api/v1.0/exceptions/whitelist')]",
"httpMethod": "GET",
"rateLimitQPS": 1,
- "queryWindowInMin": 5,
+ "queryWindowInMin": 1440,
"retryCount": 3,
- "timeoutInSeconds": 30,
+ "timeoutInSeconds": 60,
"headers": {
"Accept": "application/json",
- "Content-Type": "application/json",
"x-av-req-id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
}
},
@@ -1741,12 +1754,11 @@
"apiEndpoint": "[[concat(parameters('apiUrl'),'/app/hec-api/v1.0/exceptions/spam_whitelist')]",
"httpMethod": "GET",
"rateLimitQPS": 10,
- "queryWindowInMin": 5,
+ "queryWindowInMin": 1440,
"retryCount": 3,
- "timeoutInSeconds": 30,
+ "timeoutInSeconds": 60,
"headers": {
"Accept": "application/json",
- "Content-Type": "application/json",
"x-av-req-id": "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
}
},
@@ -1807,10 +1819,9 @@
"queryWindowInMin": 5,
"queryTimeFormat": "UnixTimestampInMills",
"retryCount": 3,
- "timeoutInSeconds": 30,
+ "timeoutInSeconds": 60,
"headers": {
- "Accept": "application/json",
- "Content-Type": "application/json"
+ "Accept": "application/json"
},
"queryParameters": {
"fromDate": "{_QueryWindowStartTime}",
@@ -1853,17 +1864,281 @@
"version": "[variables('dataConnectorCCPVersion')]"
}
},
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('parserObject1').parserTemplateSpecName1]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "CheckPointEmailSecAntiPhishingExceptions Data Parser with template version 3.0.2",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('parserObject1').parserVersion1]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[variables('parserObject1')._parserName1]",
+ "apiVersion": "2025-07-01",
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for Check Point Email Security Anti-Phishing Exceptions",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CheckPointEmailSecAntiPhishingExceptions",
+ "query": "union isfuzzy=true\n (\n CheckPointEmailSecAntiPhishingExceptions_CL\n | extend EntityId = tostring(column_ifexists('EntityId', ''))\n | summarize arg_max(TimeGenerated, *) by EntityId\n )\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject1')._parserId1]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CheckPointEmailSecAntiPhishingExceptions')]",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "kind": "Parser",
+ "version": "[variables('parserObject1').parserVersion1]",
+ "source": {
+ "name": "Checkpoint Email Security",
+ "kind": "Solution",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "contentKind": "Parser",
+ "displayName": "Parser for Check Point Email Security Anti-Phishing Exceptions",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject1').parserContentId1,'-', '1.0.0')))]",
+ "version": "[variables('parserObject1').parserVersion1]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "[variables('parserObject1')._parserName1]",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for Check Point Email Security Anti-Phishing Exceptions",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CheckPointEmailSecAntiPhishingExceptions",
+ "query": "union isfuzzy=true\n (\n CheckPointEmailSecAntiPhishingExceptions_CL\n | extend EntityId = tostring(column_ifexists('EntityId', ''))\n | summarize arg_max(TimeGenerated, *) by EntityId\n )\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject1')._parserId1,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject1')._parserId1]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CheckPointEmailSecAntiPhishingExceptions')]",
+ "contentId": "[variables('parserObject1').parserContentId1]",
+ "kind": "Parser",
+ "version": "[variables('parserObject1').parserVersion1]",
+ "source": {
+ "kind": "Solution",
+ "name": "Checkpoint Email Security",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/contentTemplates",
+ "apiVersion": "2023-04-01-preview",
+ "name": "[variables('parserObject2').parserTemplateSpecName2]",
+ "location": "[parameters('workspace-location')]",
+ "dependsOn": [
+ "[extensionResourceId(resourceId('Microsoft.OperationalInsights/workspaces', parameters('workspace')), 'Microsoft.SecurityInsights/contentPackages', variables('_solutionId'))]"
+ ],
+ "properties": {
+ "description": "CheckPointEmailSecuritySpamExceptions Data Parser with template version 3.0.2",
+ "mainTemplate": {
+ "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
+ "contentVersion": "[variables('parserObject2').parserVersion2]",
+ "parameters": {},
+ "variables": {},
+ "resources": [
+ {
+ "name": "[variables('parserObject2')._parserName2]",
+ "apiVersion": "2025-07-01",
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for Check Point Email Security Spam Exceptions",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CheckPointEmailSecuritySpamExceptions",
+ "query": "union isfuzzy=true\n (\n CheckPointEmailSecuritySpamExceptions_CL\n | extend EntityId = tostring(column_ifexists('EntityId', ''))\n | summarize arg_max(TimeGenerated, *) by EntityId\n )\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject2')._parserId2]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CheckPointEmailSecuritySpamExceptions')]",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "kind": "Parser",
+ "version": "[variables('parserObject2').parserVersion2]",
+ "source": {
+ "name": "Checkpoint Email Security",
+ "kind": "Solution",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ }
+ ]
+ },
+ "packageKind": "Solution",
+ "packageVersion": "[variables('_solutionVersion')]",
+ "packageName": "[variables('_solutionName')]",
+ "packageId": "[variables('_solutionId')]",
+ "contentSchemaVersion": "3.0.0",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "contentKind": "Parser",
+ "displayName": "Parser for Check Point Email Security Spam Exceptions",
+ "contentProductId": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]",
+ "id": "[concat(take(variables('_solutionId'),50),'-','pr','-', uniqueString(concat(variables('_solutionId'),'-','Parser','-',variables('parserObject2').parserContentId2,'-', '1.0.0')))]",
+ "version": "[variables('parserObject2').parserVersion2]"
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/savedSearches",
+ "apiVersion": "2025-07-01",
+ "name": "[variables('parserObject2')._parserName2]",
+ "location": "[parameters('workspace-location')]",
+ "properties": {
+ "eTag": "*",
+ "displayName": "Parser for Check Point Email Security Spam Exceptions",
+ "category": "Microsoft Sentinel Parser",
+ "functionAlias": "CheckPointEmailSecuritySpamExceptions",
+ "query": "union isfuzzy=true\n (\n CheckPointEmailSecuritySpamExceptions_CL\n | extend EntityId = tostring(column_ifexists('EntityId', ''))\n | summarize arg_max(TimeGenerated, *) by EntityId\n )\n",
+ "functionParameters": "",
+ "version": 2,
+ "tags": [
+ {
+ "name": "description",
+ "value": ""
+ }
+ ]
+ }
+ },
+ {
+ "type": "Microsoft.OperationalInsights/workspaces/providers/metadata",
+ "apiVersion": "2022-01-01-preview",
+ "location": "[parameters('workspace-location')]",
+ "name": "[concat(parameters('workspace'),'/Microsoft.SecurityInsights/',concat('Parser-', last(split(variables('parserObject2')._parserId2,'/'))))]",
+ "dependsOn": [
+ "[variables('parserObject2')._parserId2]"
+ ],
+ "properties": {
+ "parentId": "[resourceId('Microsoft.OperationalInsights/workspaces/savedSearches', parameters('workspace'), 'CheckPointEmailSecuritySpamExceptions')]",
+ "contentId": "[variables('parserObject2').parserContentId2]",
+ "kind": "Parser",
+ "version": "[variables('parserObject2').parserVersion2]",
+ "source": {
+ "kind": "Solution",
+ "name": "Checkpoint Email Security",
+ "sourceId": "[variables('_solutionId')]"
+ },
+ "author": {
+ "name": "Microsoft",
+ "email": "[variables('_email')]"
+ },
+ "support": {
+ "name": "Microsoft Corporation",
+ "email": "support@microsoft.com",
+ "tier": "Microsoft",
+ "link": "https://support.microsoft.com"
+ }
+ }
+ },
{
"type": "Microsoft.OperationalInsights/workspaces/providers/contentPackages",
"apiVersion": "2023-04-01-preview",
"location": "[parameters('workspace-location')]",
"properties": {
- "version": "3.0.1",
+ "version": "3.0.2",
"kind": "Solution",
"contentSchemaVersion": "3.0.0",
"displayName": "Checkpoint Email Security",
"publisherDisplayName": "Microsoft Sentinel, Microsoft Corporation",
- "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Check Point Email Security (Harmony Email & Collaboration) Solution for Microsoft Sentinel enables you to ingest security events, anti-phishing exceptions, spam exceptions, and audit logs from Check Point's Email Security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). This solution provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery.
\nUnderlying Microsoft Technologies used:
\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:
\n\nData Connectors: 1
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", + "descriptionHtml": "Note: Please refer to the following before installing the solution:
\n• Review the solution Release Notes
\n• There may be known issues pertaining to this Solution, please refer to them before installing.
\nThe Check Point Email Security (Harmony Email & Collaboration) Solution for Microsoft Sentinel enables you to ingest security events, anti-phishing exceptions, spam exceptions, and audit logs from Check Point's Email Security platform into Microsoft Sentinel using the Codeless Connector Framework (CCF). This solution provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery.
\nUnderlying Microsoft Technologies used:
\nThis solution takes a dependency on the following technologies, and some of these dependencies either may be in Preview state or might result in additional ingestion or operational costs:
\n\nData Connectors: 1, Parsers: 2
\nLearn more about Microsoft Sentinel | Learn more about Solutions
\n", "contentKind": "Solution", "contentProductId": "[variables('_solutioncontentProductId')]", "id": "[variables('_solutioncontentProductId')]", @@ -1892,6 +2167,16 @@ "kind": "DataConnector", "contentId": "[variables('_dataConnectorContentIdConnections1')]", "version": "[variables('dataConnectorCCPVersion')]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject1').parserContentId1]", + "version": "[variables('parserObject1').parserVersion1]" + }, + { + "kind": "Parser", + "contentId": "[variables('parserObject2').parserContentId2]", + "version": "[variables('parserObject2').parserVersion2]" } ] }, diff --git a/Solutions/Checkpoint Email Security/Parsers/CheckPointEmailSecAntiPhishingExceptions.yaml b/Solutions/Checkpoint Email Security/Parsers/CheckPointEmailSecAntiPhishingExceptions.yaml new file mode 100644 index 00000000000..d776ff60838 --- /dev/null +++ b/Solutions/Checkpoint Email Security/Parsers/CheckPointEmailSecAntiPhishingExceptions.yaml @@ -0,0 +1,15 @@ +id: a2c77c57-d8a1-4ac7-95a6-9d4f17a6f412 +Function: + Title: Parser for Check Point Email Security Anti-Phishing Exceptions + Version: '1.0.0' + LastUpdated: '2026-08-24' +Category: Microsoft Sentinel Parser +FunctionName: CheckPointEmailSecAntiPhishingExceptions +FunctionAlias: CheckPointEmailSecAntiPhishingExceptions +FunctionQuery: | + union isfuzzy=true + ( + CheckPointEmailSecAntiPhishingExceptions_CL + | extend EntityId = tostring(column_ifexists('EntityId', '')) + | summarize arg_max(TimeGenerated, *) by EntityId + ) diff --git a/Solutions/Checkpoint Email Security/Parsers/CheckPointEmailSecuritySpamExceptions.yaml b/Solutions/Checkpoint Email Security/Parsers/CheckPointEmailSecuritySpamExceptions.yaml new file mode 100644 index 00000000000..702b340de73 --- /dev/null +++ b/Solutions/Checkpoint Email Security/Parsers/CheckPointEmailSecuritySpamExceptions.yaml @@ -0,0 +1,15 @@ +id: 92de0b35-e8eb-4426-a03a-59f8fd81865e +Function: + Title: Parser for Check Point Email Security Spam Exceptions + Version: '1.0.0' + LastUpdated: '2026-08-24' +Category: Microsoft Sentinel Parser +FunctionName: CheckPointEmailSecuritySpamExceptions +FunctionAlias: CheckPointEmailSecuritySpamExceptions +FunctionQuery: | + union isfuzzy=true + ( + CheckPointEmailSecuritySpamExceptions_CL + | extend EntityId = tostring(column_ifexists('EntityId', '')) + | summarize arg_max(TimeGenerated, *) by EntityId + ) diff --git a/Solutions/Checkpoint Email Security/ReleaseNotes.md b/Solutions/Checkpoint Email Security/ReleaseNotes.md index 944d52ad4c5..e5f75aef2fe 100644 --- a/Solutions/Checkpoint Email Security/ReleaseNotes.md +++ b/Solutions/Checkpoint Email Security/ReleaseNotes.md @@ -1,4 +1,5 @@ -| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | -|-------------|--------------------------------|--------------------------------------------------------------| +| **Version** | **Date Modified (DD-MM-YYYY)** | **Change History** | +|-------------|--------------------------------|--------------------| +| 3.0.2 | 24-08-2026 | Fixed duplicate event ingestion in the `CheckPointEmailSecurityEvents` data stream (pagination `scrollId` moved from URL query string to the POST request body under `requestData`, since the poller was re-fetching page 1 on every paginated call). Fixed duplicate records in the Anti-Phishing and Spam exception data streams: Check Point's `/exceptions/{excType}` API returns the full exception list on every call with no delta/time filter, so Sentinel's append-only ingestion re-ingested the same full snapshot on every poll. Increased `queryWindowInMin` to 1440 (1 day) for these two endpoints to reduce re-ingestion volume, and added deduplicated Parser functions (`CheckPointEmailSecAntiPhishingExceptions`, `CheckPointEmailSecuritySpamExceptions`) that dedupe by `EntityId`; the connector's `sampleQueries`, `dataTypes`, and graph queries now reference these parser views instead of the raw duplicate-laden tables. | | 3.0.1 | 21-07-2026 | Promote CCF Data Connector to GA. | | 3.0.0 | 08-07-2026 | Initial release. Added **Data Connector** for Check Point Email Security (via Codeless Connector Framework) ingesting Security Events, Anti-Phishing Exceptions, Spam Exceptions, and Audit Logs data streams. |