CheckPointHEC

The Best Way to Protect Enterprise Email & Collaboration from phishing, malware, account takeover, data loss, etc.

Email · Check Point Harmony Email and Collaboration (HEC)

Details

IDCheckPointHEC
ProviderCheckPoint Software Technologies Ltd.
CategoryEmail
From Version6.9.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM

README

The Best Way to Protect Enterprise Email & Collaboration from phishing, malware, account takeover, data loss, etc.
This integration was integrated and tested with version 1.1.14 of CheckPointHEC

Configure Check Point Harmony Email and Collaboration (HEC) in Cortex

Parameter Description Required
Smart API URL or Check Point Infinity API URL The URL of the Smart API or Check Point Infinity API. True
Fetch incidents   False
Incident type   False
Client ID The client ID of the Smart API or Check Point Infinity API. True
Client Secret The client secret of the Smart API or Check Point Infinity API. True
First fetch time The time range for the first fetch. The default is 1 hour. False
SaaS Application Get incidents from the selected SaaS. False
State Get incidents with only the selected states. False
Severity Get incidents with only the selected severities. False
Threat Type Get incidents with only the selected types. False
Maximum number of incidents per fetch The maximum number of incidents to retrieve per fetch. False
Collect restore requests Collect restore requests as incidents. False
Include denied requests Include denied restore requests in the results, do not check with “Include accepted requests”. False
Include accepted requests Include accepted restore requests in the results, do not check with “Include denied requests”. False
Trust any certificate (not secure) Trust server certificate. False
Use system proxy settings Use system proxy settings. False
Incidents Fetch Interval The interval in minutes to fetch incidents. The default is 1 minute. False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

checkpointhec-get-entity

Retrieve specific entity.

Base Command

checkpointhec-get-entity

Input

Argument Name Description Required
entity Entity id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.Entity.internetMessageId String Email message id in internet.
CheckPointHEC.Entity.received String Datetime email was received in iso 8601 format.
CheckPointHEC.Entity.size String Email size.
CheckPointHEC.Entity.emailLinks unknown Links in email.
CheckPointHEC.Entity.attachmentCount Number Number of attachments in email.
CheckPointHEC.Entity.attachments unknown File attachments in email.
CheckPointHEC.Entity.mode String Internal policy rule.
CheckPointHEC.Entity.recipients unknown Recipient email addresses.
CheckPointHEC.Entity.subject String Email subject.
CheckPointHEC.Entity.fromEmail String Email sender.
CheckPointHEC.Entity.fromDomain String Domain where the email was sent from.
CheckPointHEC.Entity.fromUser unknown Sender user details.
CheckPointHEC.Entity.fromName String Sender name.
CheckPointHEC.Entity.to unknown Email main recipients.
CheckPointHEC.Entity.toUser unknown User details for main recipients.
CheckPointHEC.Entity.cc unknown Email carbon copy recipients.
CheckPointHEC.Entity.ccUser unknown User details for carbon copy recipients.
CheckPointHEC.Entity.bcc unknown Email blind carbon copy recipients.
CheckPointHEC.Entity.bccUser unknown User details for blind carbon copy recipients.
CheckPointHEC.Entity.replyToEmail String Email reply.
CheckPointHEC.Entity.replyToNickname String Email reply nickname.
CheckPointHEC.Entity.isRead Boolean Email has been read.
CheckPointHEC.Entity.isDeleted Boolean Email has been deleted.
CheckPointHEC.Entity.isIncoming Boolean Email is from external organization.
CheckPointHEC.Entity.isInternal Boolean Email is from same organization.
CheckPointHEC.Entity.isOutgoing Boolean Email is to an external organization.
CheckPointHEC.Entity.isQuarantined Boolean Email has been quarantined.
CheckPointHEC.Entity.isQuarantineNotification Boolean Email is a notification of another quarantined email.
CheckPointHEC.Entity.isRestored Boolean Email is restored from quarantine.
CheckPointHEC.Entity.isRestoreRequested Boolean Email is a request to restore.
CheckPointHEC.Entity.isRestoreDeclined Boolean Email is a declined restore request.
CheckPointHEC.Entity.saasSpamVerdict String Spam verdict.
CheckPointHEC.Entity.SpfResult String Sender Policy Framework check result.
CheckPointHEC.Entity.restoreRequestTime String Restore request datetime in iso 8601 format.
CheckPointHEC.Entity.isUserExposed Boolean Email reached user inbox.

checkpointhec-get-email-info

Retrieve specific email entity

Base Command

checkpointhec-get-email-info

Input

Argument Name Description Required
entity Email entity id. Required

Context Output

Path Type Description
CheckPointHEC.Email.fromEmail String Email sender.
CheckPointHEC.Email.to unknown Email main recipients.
CheckPointHEC.Email.replyToEmail String Email reply.
CheckPointHEC.Email.replyToNickname String Email reply nickname.
CheckPointHEC.Email.recipients unknown Recipient email addresses.
CheckPointHEC.Email.subject String Email subject.
CheckPointHEC.Email.cc unknown Email carbon copy recipients.
CheckPointHEC.Email.bcc unknown Email blind carbon copy recipients.
CheckPointHEC.Email.isRead Boolean Email has been read.
CheckPointHEC.Email.received String Datetime email was received in iso 8601 format.
CheckPointHEC.Email.isDeleted Boolean Email has been deleted.
CheckPointHEC.Email.isIncoming Boolean Email is from external organization.
CheckPointHEC.Email.isOutgoing Boolean Email is to an external organization.
CheckPointHEC.Email.internetMessageId String Email message id in internet.
CheckPointHEC.Email.isUserExposed Boolean Email reached user inbox

checkpointhec-get-scan-info

Retrieve specific email scan with positive threats.

Base Command

checkpointhec-get-scan-info

Input

Argument Name Description Required
entity Scanned entity id. Required
include_clean Include clean scans. Possible values are: True, False. Default is False. Optional

Context Output

Path Type Description
CheckPointHEC.ScanResult.ap unknown Anti-phishing scan results.
CheckPointHEC.ScanResult.dlp unknown Data Loss Prevention scan results.
CheckPointHEC.ScanResult.clicktimeProtection unknown Click Time Protection scan results.
CheckPointHEC.ScanResult.shadowIt unknown Shadow IT scan results.
CheckPointHEC.ScanResult.av unknown Antivirus scan results.

checkpointhec-search-emails

Search for emails.

Base Command

checkpointhec-search-emails

Input

Argument Name Description Required
date_last Emails not older than (1 day, 2 weeks, etc.). The arguments date_last and date_from with date_to are mutually exclusive and cannot be specified together in the same request. Optional
date_from Start date to get emails in ISO 8601 format. The arguments date_last and date_from with date_to are mutually exclusive and cannot be specified together in the same request. Optional
date_to End date to get emails in ISO 8601 format. The arguments date_last and date_from with date_to are mutually exclusive and cannot be specified together in the same request. Optional
saas SaaS application to retrieve emails from. Possible values are: Microsoft Exchange, Gmail. Optional
direction Email precedence. Possible values are: Internal, Incoming, Outgoing. Optional
subject_contains Emails with subject containing the given value. The arguments subject_contains and subject_match are mutually exclusive and cannot be specified together in the same request. Optional
subject_match Emails with subject matching the given value. The arguments subject_contains and subject_match are mutually exclusive and cannot be specified together in the same request. Optional
sender_contains Emails with sender email containing the given value. The arguments sender_contains and sender_match are mutually exclusive and cannot be specified together in the same request. Optional
sender_match Emails with sender email matching the given value. The arguments sender_contains and sender_match are mutually exclusive and cannot be specified together in the same request. Optional
domain Emails with sender domain matching the given value. Optional
cp_detection Detection by Check Point. Possible values are: Phishing, Suspected Phishing, Malware, Suspected Malware, Spam, Clean, DLP, Malicious URL Click, Malicious URL. Optional
ms_detection Detection by Microsoft. Possible values are: Malware, High Confidence Phishing, Phishing, High Confidence Spam, Spam, Bulk, Clean. Optional
detection_op Detection operator. Possible values are: OR, AND. Optional
server_ip Sender server ip. Optional
recipients_contains Emails with recipients containing the given value. The arguments recipients_contains and recipients_match are mutually exclusive and cannot be specified together in the same request. Optional
recipients_match Emails with recipients matching the given value. The arguments recipients_contains and recipients_match are mutually exclusive and cannot be specified together in the same request. Optional
links Emails with links in body matching the given value. Optional
message_id Get specific email by id. Optional
cp_quarantined_state Quarantine authored by Check Point. Possible values are: Quarantined (Any source), Not Quarantined, Quarantined by Check Point, Quarantined by CP Analyst, Quarantined by Admin. Optional
ms_quarantined_state Quarantine authored by Microsoft. Possible values are: Quarantined, Not Quarantined, Not Quarantined Delivered to Inbox, Not Quarantined Delivered to Junk. Optional
quarantined_state_op Quarantine state operator. Possible values are: OR, AND. Optional
name_contains Emails with sender name containing the given value. The arguments name_contains and name_match are mutually exclusive and cannot be specified together in the same request. Optional
name_match Emails with sender name matching the given value. The arguments name_contains and name_match are mutually exclusive and cannot be specified together in the same request. Optional
client_ip Sender client IP. Optional
attachment_md5 Attachment MD5 checksum. Optional

Context Output

Path Type Description
CheckPointHEC.Entity.internetMessageId String Email message id in internet.
CheckPointHEC.Entity.received String Datetime email was received in iso 8601 format.
CheckPointHEC.Entity.size String Email size.
CheckPointHEC.Entity.emailLinks unknown Links in email.
CheckPointHEC.Entity.attachmentCount Number Number of attachments in email.
CheckPointHEC.Entity.attachments unknown File attachments in email.
CheckPointHEC.Entity.mode String Internal policy rule.
CheckPointHEC.Entity.recipients unknown Recipient email addresses.
CheckPointHEC.Entity.subject String Email subject.
CheckPointHEC.Entity.fromEmail String Email sender.
CheckPointHEC.Entity.fromDomain String Domain where the email was sent from.
CheckPointHEC.Entity.fromUser unknown Sender user details.
CheckPointHEC.Entity.fromName String Sender name.
CheckPointHEC.Entity.to unknown Email main recipients.
CheckPointHEC.Entity.toUser unknown User details for main recipients.
CheckPointHEC.Entity.cc unknown Email carbon copy recipients.
CheckPointHEC.Entity.ccUser unknown User details for carbon copy recipients.
CheckPointHEC.Entity.bcc unknown Email blind carbon copy recipients.
CheckPointHEC.Entity.bccUser unknown User details for blind carbon copy recipients.
CheckPointHEC.Entity.replyToEmail String Email reply.
CheckPointHEC.Entity.replyToNickname String Email reply nickname.
CheckPointHEC.Entity.isRead Boolean Email has been read.
CheckPointHEC.Entity.isDeleted Boolean Email has been deleted.
CheckPointHEC.Entity.isIncoming Boolean Email is from external organization.
CheckPointHEC.Entity.isInternal Boolean Email is from same organization.
CheckPointHEC.Entity.isOutgoing Boolean Email is to an external organization.
CheckPointHEC.Entity.isQuarantined Boolean Email has been quarantined.
CheckPointHEC.Entity.isQuarantineNotification Boolean Email is a notification of another quarantined email.
CheckPointHEC.Entity.isRestored Boolean Email is restored from quarantine.
CheckPointHEC.Entity.isRestoreRequested Boolean Email is a request to restore.
CheckPointHEC.Entity.isRestoreDeclined Boolean Email is a declined restore request.
CheckPointHEC.Entity.saasSpamVerdict String Spam verdict.
CheckPointHEC.Entity.SpfResult String Sender Policy Framework check result.
CheckPointHEC.Entity.restoreRequestTime String Restore request datetime in iso 8601 format.
CheckPointHEC.Entity.isUserExposed Boolean Email reached user inbox.

checkpointhec-send-action

Action for one or more emails.

Base Command

checkpointhec-send-action

Input

Argument Name Description Required
entity One or multiple Email ids to apply action over. Required
saas SaaS application to apply action over. Possible values are: Microsoft Exchange, Gmail. Required
action Action to perform. Possible values are: quarantine, restore, decline_restore_request. Required
restore_decline_reason Reason to decline restore request. Optional

Context Output

Path Type Description
CheckPointHEC.Task.task String Task id of the sent action.

checkpointhec-get-action-result

Get task info related to a sent action

Base Command

checkpointhec-get-action-result

Input

Argument Name Description Required
farm Customer farm. Required
customer Customer portal name. Required
task Task id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.ActionResult.actions unknown Action information for each sent entity
CheckPointHEC.ActionResult.created String Date when action was created in iso 8601 format
CheckPointHEC.ActionResult.customer String Customer portal name
CheckPointHEC.ActionResult.failed Number Number of failed actions
CheckPointHEC.ActionResult.id Number Action task id
CheckPointHEC.ActionResult.name String Action name
CheckPointHEC.ActionResult.owner String Action owner
CheckPointHEC.ActionResult.progress Number Number of actions in progress
CheckPointHEC.ActionResult.sequential Boolean Actions are in sequence
CheckPointHEC.ActionResult.status String Action status
CheckPointHEC.ActionResult.succeed Number Number of succeed actions
CheckPointHEC.ActionResult.total Number Total of actions
CheckPointHEC.ActionResult.type String Action internal name
CheckPointHEC.ActionResult.updated String Date when action last updated in iso 8601 format

checkpointhec-send-notification

Send notification about user exposition for the specific entity to the list of emails

Base Command

checkpointhec-send-notification

Input

Argument Name Description Required
entity Email entity id. Required
emails List of emails to send notification. Required

Context Output

Path Type Description
CheckPointHEC.Notification.ok Boolean Result of the operation.

checkpointhec-get-events

Retrieve security events.

Base Command

checkpointhec-get-events

Input

Argument Name Description Required
start_date Start date in ISO 8601 format. Required
end_date End date in ISO 8601 format, now by default. Optional
saas_apps SaaS application to retrieve events from. Possible values are: Microsoft Exchange, Gmail. Optional
states Event states to be retrieved. Possible values are: New, Remediated, Detected, Exception, Dismissed. Optional
severities Severity levels to be retrieved. Possible values are: Critical, High, Medium, Low, Very Low. Optional
threat_types Threat types to be retrieved. Possible values are: DLP, Malware, Phishing, Anomaly, Suspicious Phishing, Suspicious Malware, Shadow IT, Alert, Spam, Malicious URL, Malicious URL Click. Optional
limit Number of events to be returned. Optional

Context Output

Path Type Description
CheckPointHEC.Event.eventId String Security event id.
CheckPointHEC.Event.customerId String Customer portal name.
CheckPointHEC.Event.saas String SaaS internal name.
CheckPointHEC.Event.entityId String Email entity id related to the security event.
CheckPointHEC.Event.state String Security event state.
CheckPointHEC.Event.type String Security event threat type.
CheckPointHEC.Event.confidenceIndicator String Security event threat type.
CheckPointHEC.Event.eventCreated String Security event creation date.
CheckPointHEC.Event.severity String Security event severity 1 - 5.
CheckPointHEC.Event.description String Security event description.
CheckPointHEC.Event.data String Security event data information.
CheckPointHEC.Event.additionalData String Security event additional data information if available.
CheckPointHEC.Event.availableEventActions unknown Actions available for the security event.
CheckPointHEC.Event.actions unknown Performed actions related to the security event.
CheckPointHEC.Event.senderAddress String Sender of email related to the security event.
CheckPointHEC.Event.entityLink String Email link.

checkpointhec-get-ctp-list

Get Click Time Protection list.

Base Command

checkpointhec-get-ctp-list

Input

Argument Name Description Required
list_id List id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.CTPList.listid String List id.
CheckPointHEC.CTPList.listname String List name.
CheckPointHEC.CTPList.listitem String List of items in the list.

checkpointhec-delete-avurl-exceptions

Delete Avanan URL exceptions.

Base Command

checkpointhec-delete-avurl-exceptions

Input

Argument Name Description Required
exc_type Exception type. Possible values are: allow-url, allow-domain, block-url, block-domain. Required
exc_str_list List of exception strings to delete. Required
entity_type Entity type. Optional
entity_id Entity id. Optional

Context Output

There is no context output for this command.

checkpointhec-delete-avdlp-exception

Delete Avanan URL exception.

Base Command

checkpointhec-delete-avdlp-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, text_content, sender_email, recipient_email. Required
exc_str Exception string. Required
entity_type Entity type. Optional
entity_id Entity id. Optional

Context Output

There is no context output for this command.

checkpointhec-get-anomaly-exceptions

Get Anomaly exceptions.

Base Command

checkpointhec-get-anomaly-exceptions

Input

There are no input arguments for this command.

Context Output

Path Type Description
CheckPointHEC.AnomalyException.id String Anomaly exception id.
CheckPointHEC.AnomalyException.anomaly_type String Anomaly type.
CheckPointHEC.AnomalyException.insert_time String Anomaly exception creation time.
CheckPointHEC.AnomalyException.update_time String Anomaly exception update time.
CheckPointHEC.AnomalyException.added_by String Anomaly exception creator.
CheckPointHEC.AnomalyException.event_id String Security event id.
CheckPointHEC.AnomalyException.customer_domain String Customer domain.
CheckPointHEC.AnomalyException.comments String Anomaly exception comment.
CheckPointHEC.AnomalyException.enabled Boolean Anomaly exception enabled.
CheckPointHEC.AnomalyException.exception_rule String Anomaly exception rule.
CheckPointHEC.AnomalyException.expiration_date String Anomaly exception expiration date.

checkpointhec-update-cp2-exception

Update Anti-Malware exception.

Base Command

checkpointhec-update-cp2-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, macro_hash, file_type, ppat_sender_name. Required
exc_str Exception string. Required
comment Exception comment. Optional
exc_payload_condition Exception payload condition. Possible values are: with_or_without_link, with_link, without_link. Optional

Context Output

There is no context output for this command.

checkpointhec-create-avdlp-exception

Create Avanan DLP exception.

Base Command

checkpointhec-create-avdlp-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, text_content, sender_email, recipient_email. Required
exc_str Exception string. Required
entity_type Entity type. Optional
entity_id Entity id. Optional
comment Exception comment. Optional
exc_payload_condition Exception payload condition. Possible values are: with_or_without_link, with_link, without_link. Optional
file_name File name. Optional
created_by_email Exception creator email. Optional
is_exclusive Exclusive exception. Possible values are: yes, no. Optional

Context Output

There is no context output for this command.

checkpointhec-delete-ctp-list-items

Delete Click Time Protection list items.

Base Command

checkpointhec-delete-ctp-list-items

Input

Argument Name Description Required
list_item_ids List of item ids to delete. Required

Context Output

There is no context output for this command.

checkpointhec-update-avdlp-exception

Update Avanan URL exception.

Base Command

checkpointhec-update-avdlp-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, text_content, sender_email, recipient_email. Required
exc_str Exception string. Required
comment Exception comment. Optional
exc_payload_condition Exception payload condition. Possible values are: with_or_without_link, with_link, without_link. Optional

Context Output

There is no context output for this command.

checkpointhec-get-ap-exceptions

Get Anti-Phishing and Anti-Spam exceptions or exception.

Base Command

checkpointhec-get-ap-exceptions

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: whitelist, blacklist, spam_whitelist. Required
exc_id Exception id to retrieve. Optional

Context Output

Path Type Description
CheckPointHEC.AntiPhishingException.added_by Number Exception added by user id.
CheckPointHEC.AntiPhishingException.affected_count String Affected count.
CheckPointHEC.AntiPhishingException.allowed_links String Allowed links.
CheckPointHEC.AntiPhishingException.attachment_md5 String Email attachment MD5.
CheckPointHEC.AntiPhishingException.auto_classify_as String Auto classify as.
CheckPointHEC.AntiPhishingException.comment String Exception description.
CheckPointHEC.AntiPhishingException.customer_domain String Customer name.
CheckPointHEC.AntiPhishingException.edited_by String Exception edited by.
CheckPointHEC.AntiPhishingException.email_link String Email link.
CheckPointHEC.AntiPhishingException.email_link_matching String Email link field condition.
CheckPointHEC.AntiPhishingException.entity_id Number Entity id.
CheckPointHEC.AntiPhishingException.exception_type String Exception type.
CheckPointHEC.AntiPhishingException.expiration_time String Exception expiration time.
CheckPointHEC.AntiPhishingException.from_domain String From domain.
CheckPointHEC.AntiPhishingException.from_domain_ends_with String From domain field ends with.
CheckPointHEC.AntiPhishingException.from_domain_matching String From domain field condition.
CheckPointHEC.AntiPhishingException.from_email String Email sender.
CheckPointHEC.AntiPhishingException.from_email_matching String From email field condition.
CheckPointHEC.AntiPhishingException.from_name_matching String From name field condition.
CheckPointHEC.AntiPhishingException.headers String Email headers.
CheckPointHEC.AntiPhishingException.ignoring_spf_check Boolean Ignore SPF check.
CheckPointHEC.AntiPhishingException.insert_time String Exception creation time.
CheckPointHEC.AntiPhishingException.max_confidence String Maximum confidence.
CheckPointHEC.AntiPhishingException.max_confidence_spam String Maximum confidence for spam.
CheckPointHEC.AntiPhishingException.message_headers String Message headers.
CheckPointHEC.AntiPhishingException.nickname String Sender name.
CheckPointHEC.AntiPhishingException.owner_email String Exception owner email.
CheckPointHEC.AntiPhishingException.override Boolean Override.
CheckPointHEC.AntiPhishingException.recipient String Email recipient.
CheckPointHEC.AntiPhishingException.recipient_matching String Recipient field condition.
CheckPointHEC.AntiPhishingException.sender_client_ip String Sender client IP.
CheckPointHEC.AntiPhishingException.sender_ip String Sender IP.
CheckPointHEC.AntiPhishingException.signature_key String Signature key.
CheckPointHEC.AntiPhishingException.subject String Email subject.
CheckPointHEC.AntiPhishingException.subject_matching String Subject field condition.
CheckPointHEC.AntiPhishingException.update_time String Exception update.
CheckPointHEC.AntiPhishingException.user_label String User label.

checkpointhec-create-avurl-exception

Create Avanan URL exception.

Base Command

checkpointhec-create-avurl-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: allow-url, allow-domain, block-url, block-domain. Required
exc_str Exception string. Required
entity_type Entity type. Optional
entity_id Entity id. Optional
comment Exception comment. Optional
exc_payload_condition Exception payload condition. Possible values are: with_or_without_link, with_link, without_link. Optional
file_name File name. Optional
created_by_email Exception creator email. Optional
is_exclusive Exclusive exception. Possible values are: yes, no. Optional

Context Output

There is no context output for this command.

checkpointhec-get-avdlp-exceptions

Get Avanan DLP exceptions.

Base Command

checkpointhec-get-avdlp-exceptions

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: hash, text_content, sender_email, recipient_email. Required
filter_str Search string. Optional
filter_index Search index. Possible values are: insert_time, entity_type_id, exception_str, file_name, created_by_email, comment. Optional
sort_dir Sort direction. Possible values are: asc, desc. Optional
last_evaluated_key Last evaluated key. Optional
insert_time_gte Insert time field condition. Possible values are: yes, no. Optional
limit Number of exceptions to retrieve. Optional

Context Output

Path Type Description
CheckPointHEC.AvananDLPException.insert_time String Exception insert time.
CheckPointHEC.AvananDLPException.farm_customer_exception_type String Farm, customer and exception type info.
CheckPointHEC.AvananDLPException.exception_str String Exception string, for id purposes.
CheckPointHEC.AvananDLPException.created_by_email String Exception email creator.
CheckPointHEC.AvananDLPException.comment String Exception comment.
CheckPointHEC.AvananDLPException.exception_payload String Exception payload information.

checkpointhec-delete-ctp-lists

Delete Click Time Protection lists.

Base Command

checkpointhec-delete-ctp-lists

Input

There are no input arguments for this command.

Context Output

There is no context output for this command.

checkpointhec-create-anomaly-exception

Create Anomaly exception.

Base Command

checkpointhec-create-anomaly-exception

Input

Argument Name Description Required
request_json Anomaly exception request json. Required
added_by User id exception creator. Optional

Context Output

There is no context output for this command.

checkpointhec-delete-cp2-exception

Delete Anti-Malware exception.

Base Command

checkpointhec-delete-cp2-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, macro_hash, file_type, ppat_sender_name. Required
exc_str Exception string. Required
entity_type Entity type. Optional
entity_id Entity id. Optional

Context Output

There is no context output for this command.

checkpointhec-delete-anomaly-exceptions

Delete Anomaly exceptions.

Base Command

checkpointhec-delete-anomaly-exceptions

Input

Argument Name Description Required
rule_ids Exceptions to delete. Required

Context Output

There is no context output for this command.

checkpointhec-report-mis-classification

Report email mis-classification.

Base Command

checkpointhec-report-mis-classification

Input

Argument Name Description Required
entities Email entity ids. Required
classification New classification. Possible values are: Clean Email, Spam, Phishing, Legit Marketing Email. Required
confident Confidence level. Possible values are: Not so sure, Medium Confidence, High Confidence. Required

Context Output

There is no context output for this command.

checkpointhec-get-avdlp-exception

Get Avanan DLP exception.

Base Command

checkpointhec-get-avdlp-exception

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: hash, text_content, sender_email, recipient_email. Required
exc_str Exception id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.AvananDLPException.insert_time String Exception insert time.
CheckPointHEC.AvananDLPException.farm_customer_exception_type String Farm, customer and exception type info.
CheckPointHEC.AvananDLPException.exception_str String Exception string, for id purposes.
CheckPointHEC.AvananDLPException.created_by_email String Exception email creator.
CheckPointHEC.AvananDLPException.comment String Exception comment.
CheckPointHEC.AvananDLPException.exception_payload String Exception payload information.

checkpointhec-delete-ctp-list-item

Delete Click Time Protection list item.

Base Command

checkpointhec-delete-ctp-list-item

Input

Argument Name Description Required
item_id Item id to delete. Required

Context Output

There is no context output for this command.

checkpointhec-get-ctp-list-item

Get Click Time Protection list item.

Base Command

checkpointhec-get-ctp-list-item

Input

Argument Name Description Required
item_id Item id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.CTPListItem.created_at String List item creation time.
CheckPointHEC.CTPListItem.created_by String List item creator.
CheckPointHEC.CTPListItem.listid String List id.
CheckPointHEC.CTPListItem.listitemid String List item id.
CheckPointHEC.CTPListItem.listitemname String List item name.
CheckPointHEC.CTPListItem.listname String List name.

checkpointhec-update-avurl-exception

Update Avanan URL exception.

Base Command

checkpointhec-update-avurl-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: allow-url, allow-domain, block-url, block-domain. Required
exc_str Exception string. Required
comment Exception comment. Optional
exc_payload_condition Exception payload condition. Possible values are: with_or_without_link, with_link, without_link. Optional

Context Output

There is no context output for this command.

checkpointhec-create-ctp-list-item

Create Click Time Protection list item.

Base Command

checkpointhec-create-ctp-list-item

Input

Argument Name Description Required
list_id List id. Required
list_item_name List item name. Required
created_by List item creator. Required

Context Output

There is no context output for this command.

checkpointhec-delete-ap-exception

Delete Anti-Phishing and Anti-Spam exception.

Base Command

checkpointhec-delete-ap-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: whitelist, blacklist, spam_whitelist. Required
exc_id Exception id. Required

Context Output

There is no context output for this command.

checkpointhec-delete-avurl-exception

Delete Avanan URL exception.

Base Command

checkpointhec-delete-avurl-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: allow-url, allow-domain, block-url, block-domain. Required
exc_str Exception string. Required
entity_type Entity type. Optional
entity_id Entity id. Optional

Context Output

There is no context output for this command.

checkpointhec-get-cp2-exception

Get Anti-Malware exception.

Base Command

checkpointhec-get-cp2-exception

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: hash, macro_hash, file_type, ppat_sender_name. Required
exc_str Exception id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.AntiMalwareException.insert_time String Exception insert time.
CheckPointHEC.AntiMalwareException.farm_customer_exception_type String Farm, customer and exception type info.
CheckPointHEC.AntiMalwareException.exception_str String Exception string, for id purposes.
CheckPointHEC.AntiMalwareException.created_by_email String Exception email creator.
CheckPointHEC.AntiMalwareException.comment String Exception comment.
CheckPointHEC.AntiMalwareException.exception_payload String Exception payload information.

checkpointhec-update-ap-exception

Update Anti-Phishing and Anti-Spam exception.

Base Command

checkpointhec-update-ap-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: whitelist, blacklist, spam_whitelist. Required
exc_id Exception id. Required
entity_id Entity id. Optional
attachment_md5 Attachment MD5 checksum. Optional
from_email Email sender. Optional
nickname Sender name. Optional
recipient Email recipient. Optional
sender_client_ip Sender client IP. Optional
from_domain_ends_with From domain ends with. Optional
sender_ip Sender IP. Optional
email_link Email link or links separated by comma. Optional
subject Email subject. Optional
comment Exception comment. Optional
action_needed Action needed. Optional
ignoring_spf_check Ignoring SPF check. Optional
subject_matching Subject field condition. Possible values are: matching, contains, exact. Optional
email_link_matching Email link field condition. Possible values are: matching, contains, exact. Optional
from_name_matching From name field condition. Possible values are: matching, contains, exact. Optional
from_domain_matching From domain field condition. Possible values are: contains, ends_with, exact. Optional
from_email_matching From email field condition. Possible values are: matching, contains, exact. Optional
recipient_matching Recipient field condition. Possible values are: matching, contains, exact. Optional

Context Output

There is no context output for this command.

checkpointhec-create-cp2-exception

Create Anti-Malware exception.

Base Command

checkpointhec-create-cp2-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, macro_hash, file_type, ppat_sender_name. Required
exc_str Exception string. Required
entity_type Entity type. Optional
entity_id Entity id. Optional
comment Exception comment. Optional
exc_payload_condition Exception payload condition. Possible values are: with_or_without_link, with_link, without_link. Optional
file_name File name. Optional
created_by_email Exception creator email. Optional
is_exclusive Exclusive exception. Possible values are: yes, no. Optional

Context Output

There is no context output for this command.

checkpointhec-delete-cp2-exceptions

Delete Anti-Malware exceptions.

Base Command

checkpointhec-delete-cp2-exceptions

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, macro_hash, file_type, ppat_sender_name. Required
exc_str_list List of exception strings to delete. Required
entity_type Entity type. Optional
entity_id Entity id. Optional

Context Output

There is no context output for this command.

checkpointhec-get-ctp-lists

Get Click Time Protection lists.

Base Command

checkpointhec-get-ctp-lists

Input

There are no input arguments for this command.

Context Output

Path Type Description
CheckPointHEC.CTPList.listid String List id.
CheckPointHEC.CTPList.listname String List name.
CheckPointHEC.CTPList.listitem unknown List item in the list.

checkpointhec-update-ctp-list-item

Update Click Time Protection list item.

Base Command

checkpointhec-update-ctp-list-item

Input

Argument Name Description Required
item_id Item id to update. Required
list_id List id. Required
list_item_name List item name. Required
created_by List item creator. Required

Context Output

There is no context output for this command.

checkpointhec-create-ap-exception

Create Anti-Phishing and Anti-Spam exception.

Base Command

checkpointhec-create-ap-exception

Input

Argument Name Description Required
exc_type Exception type. Possible values are: whitelist, blacklist, spam_whitelist. Required
entity_id Entity id. Optional
attachment_md5 Attachment MD5 checksum. Optional
from_email Email sender. Optional
nickname Sender name. Optional
recipient Email recipient. Optional
sender_client_ip Sender client IP. Optional
from_domain_ends_with From domain ends with. Optional
sender_ip Sender IP. Optional
email_link Email link or links separated by comma. Optional
subject Email subject. Optional
comment Exception comment. Optional
action_needed Action needed. Optional
ignoring_spf_check Ignoring SPF check. Optional
subject_matching Subject field condition. Possible values are: matching, contains, exact. Optional
email_link_matching Email link field condition. Possible values are: matching, contains, exact. Optional
from_name_matching From name field condition. Possible values are: matching, contains, exact. Optional
from_domain_matching From domain field condition. Possible values are: contains, ends_with, exact. Optional
from_email_matching From email field condition. Possible values are: matching, contains, exact. Optional
recipient_matching Recipient field condition. Possible values are: matching, contains, exact. Optional

Context Output

There is no context output for this command.

checkpointhec-get-avurl-exceptions

Get Avanan URL exceptions.

Base Command

checkpointhec-get-avurl-exceptions

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: allow-url, allow-domain, block-url, block-domain. Required
filter_str Search string. Optional
filter_index Search index. Possible values are: insert_time, entity_type_id, exception_str, file_name, created_by_email, comment. Optional
sort_dir Sort direction. Possible values are: asc, desc. Optional
last_evaluated_key Last evaluated key. Optional
insert_time_gte Insert time field condition. Possible values are: yes, no. Optional
limit Number of exceptions to retrieve. Optional

Context Output

Path Type Description
CheckPointHEC.AvananURLException.insert_time String Exception insert time.
CheckPointHEC.AvananURLException.farm_customer_exception_type String Farm, customer and exception type info.
CheckPointHEC.AvananURLException.exception_str String Exception string, for id purposes.
CheckPointHEC.AvananURLException.created_by_email String Exception email creator.
CheckPointHEC.AvananURLException.comment String Exception comment.
CheckPointHEC.AvananURLException.exception_payload String Exception payload information.

checkpointhec-get-ctp-list-items

Get Click Time Protection list items.

Base Command

checkpointhec-get-ctp-list-items

Input

There are no input arguments for this command.

Context Output

Path Type Description
CheckPointHEC.CTPListItem.created_at String List item creation time.
CheckPointHEC.CTPListItem.created_by String List item creator.
CheckPointHEC.CTPListItem.listid String List id.
CheckPointHEC.CTPListItem.listitemid String List item id.
CheckPointHEC.CTPListItem.listitemname String List item name.
CheckPointHEC.CTPListItem.listname String List name.

checkpointhec-get-cp2-exceptions

Get Anti-Malware exceptions.

Base Command

checkpointhec-get-cp2-exceptions

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: hash, macro_hash, file_type, ppat_sender_name. Required
filter_str Search string. Optional
filter_index Search index. Possible values are: insert_time, entity_type_id, exception_str, file_name, created_by_email, comment. Optional
sort_dir Sort direction. Possible values are: asc, desc. Optional
last_evaluated_key Last evaluated key. Optional
insert_time_gte Insert time field condition. Possible values are: yes, no. Optional
limit Number of exceptions to retrieve. Optional

Context Output

Path Type Description
CheckPointHEC.AntiMalwareException.insert_time String Exception insert time.
CheckPointHEC.AntiMalwareException.farm_customer_exception_type String Farm, customer and exception type info.
CheckPointHEC.AntiMalwareException.exception_str String Exception string, for id purposes.
CheckPointHEC.AntiMalwareException.created_by_email String Exception email creator.
CheckPointHEC.AntiMalwareException.comment String Exception comment.
CheckPointHEC.AntiMalwareException.exception_payload String Exception payload information.

checkpointhec-get-avurl-exception

Get Avanan URL exception.

Base Command

checkpointhec-get-avurl-exception

Input

Argument Name Description Required
exc_type List name of exceptions to retrieve. Possible values are: allow-url, allow-domain, block-url, block-domain. Required
exc_str Exception id to retrieve. Required

Context Output

Path Type Description
CheckPointHEC.AvananURLException.insert_time String Exception insert time.
CheckPointHEC.AvananURLException.farm_customer_exception_type String Farm, customer and exception type info.
CheckPointHEC.AvananURLException.exception_str String Exception string, for id purposes.
CheckPointHEC.AvananURLException.created_by_email String Exception email creator.
CheckPointHEC.AvananURLException.comment String Exception comment.
CheckPointHEC.AvananURLException.exception_payload String Exception payload information.

checkpointhec-delete-avdlp-exceptions

Delete Avanan DLP exceptions.

Base Command

checkpointhec-delete-avdlp-exceptions

Input

Argument Name Description Required
exc_type Exception type. Possible values are: hash, text_content, sender_email, recipient_email. Required
exc_str_list List of exception strings to delete. Required
entity_type Entity type. Optional
entity_id Entity id. Optional

Context Output

There is no context output for this command.

checkpointhec-download-email

Download email file.

Base Command

checkpointhec-download-email

Input

Argument Name Description Required
entity_id Email entity id, currently available in the incident’s mirror external id. Required
original Whether to download original email or with modifications. Possible values are: True, False. Default is False. Optional

Context Output

There is no context output for this command.

checkpointhec-download-large-email

Download large email file.

Base Command

checkpointhec-download-large-email

Input

Argument Name Description Required
entity_id Email entity id, currently available in the incident’s mirror external id. Required

Context Output

There is no context output for this command.

Configuration parameters

  • url — Smart API URL or Check Point Infinity API URL (required)
  • isFetch — Fetch incidents
  • incidentType — Incident type
  • client_id — (required)
  • client_secret — (required)
  • first_fetch — First fetch time
  • saas_apps — SaaS Application
  • event_state — State
  • event_severity — Severity
  • threat_type — Threat Type
  • max_fetch — Maximum number of incidents per fetch
  • collect_restore_requests — Collect restore requests
  • include_denied_requests — Include denied requests
  • include_accepted_requests — Include accepted requests
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • incidentFetchInterval — Incidents Fetch Interval

Commands (44)

  • checkpointhec-create-anomaly-exception

    Create Anomaly exception.

  • checkpointhec-create-ap-exception

    Create Anti-Phishing and Anti-Spam exception.

  • checkpointhec-create-avdlp-exception

    Create Avanan DLP exception.

  • checkpointhec-create-avurl-exception

    Create Avanan URL exception.

  • checkpointhec-create-cp2-exception

    Create Anti-Malware exception.

  • checkpointhec-create-ctp-list-item

    Create Click Time Protection list item.

  • checkpointhec-delete-anomaly-exceptions

    Delete Anomaly exceptions.

  • checkpointhec-delete-ap-exception

    Delete Anti-Phishing and Anti-Spam exception.

  • checkpointhec-delete-avdlp-exception

    Delete Avanan URL exception.

  • checkpointhec-delete-avdlp-exceptions

    Delete Avanan DLP exceptions.

  • checkpointhec-delete-avurl-exception

    Delete Avanan URL exception.

  • checkpointhec-delete-avurl-exceptions

    Delete Avanan URL exceptions.

  • checkpointhec-delete-cp2-exception

    Delete Anti-Malware exception.

  • checkpointhec-delete-cp2-exceptions

    Delete Anti-Malware exceptions.

  • checkpointhec-delete-ctp-list-item

    Delete Click Time Protection list item.

  • checkpointhec-delete-ctp-list-items

    Delete Click Time Protection list items.

  • checkpointhec-delete-ctp-lists

    Delete Click Time Protection lists.

  • checkpointhec-download-email

    Download email file.

  • checkpointhec-download-large-email

    Download large email file.

  • checkpointhec-get-action-result

    Get task info related to a sent action.

  • checkpointhec-get-anomaly-exceptions

    Get Anomaly exceptions.

  • checkpointhec-get-ap-exceptions

    Get Anti-Phishing and Anti-Spam exceptions or exception.

  • checkpointhec-get-avdlp-exception

    Get Avanan DLP exception.

  • checkpointhec-get-avdlp-exceptions

    Get Avanan DLP exceptions.

  • checkpointhec-get-avurl-exception

    Get Avanan URL exception.

  • checkpointhec-get-avurl-exceptions

    Get Avanan URL exceptions.

  • checkpointhec-get-cp2-exception

    Get Anti-Malware exception.

  • checkpointhec-get-cp2-exceptions

    Get Anti-Malware exceptions.

  • checkpointhec-get-ctp-list

    Get Click Time Protection list.

  • checkpointhec-get-ctp-list-item

    Get Click Time Protection list item.

  • checkpointhec-get-ctp-list-items

    Get Click Time Protection list items.

  • checkpointhec-get-ctp-lists

    Get Click Time Protection lists.

  • checkpointhec-get-entity

    Retrieve specific entity.

  • checkpointhec-get-events

    Retrieve security events.

  • checkpointhec-get-scan-info

    Retrieve specific email scan with positive threats.

  • checkpointhec-report-mis-classification

    Report email mis-classification.

  • checkpointhec-search-emails

    Search for emails.

  • checkpointhec-send-action

    Action for one or more emails.

  • checkpointhec-send-notification

    Send notification about user exposition for the specific entity to the list of emails.

  • checkpointhec-update-ap-exception

    Update Anti-Phishing and Anti-Spam exception.

  • checkpointhec-update-avdlp-exception

    Update Avanan URL exception.

  • checkpointhec-update-avurl-exception

    Update Avanan URL exception.

  • checkpointhec-update-cp2-exception

    Update Anti-Malware exception.

  • checkpointhec-update-ctp-list-item

    Update Click Time Protection list item.

Source

CheckPointHEC.py CheckPointHEC_test.py CheckPointHEC.yml CheckPointHEC_description.md command_examples.txt
Download History Raw 
category: Email
provider: CheckPoint Software Technologies Ltd.
commonfields:
  id: CheckPointHEC
  version: -1
configuration:
- section: Connect
  display: Smart API URL or Check Point Infinity API URL
  name: url
  defaultvalue: ""
  type: 15
  options:
  - https://smart-api-production-1-us.avanan.net
  - https://smart-api-production-1-eu.avanan.net
  - https://smart-api-production-5-ap.avanan.net
  - https://smart-api-production-1-ca.avanan.net
  - https://smart-api-production-1-euw2.avanan.net
  - https://smart-api-production-1-mec1.avanan.net
  - https://smart-api-production-1-aps1.avanan.net
  - https://smart-api-production-1-apse1.avanan.net
  - https://cloudinfra-gw-us.portal.checkpoint.com
  - https://cloudinfra-gw.portal.checkpoint.com
  - https://cloudinfra-gw.ca.portal.checkpoint.com
  - https://cloudinfra-gw.ap.portal.checkpoint.com
  - https://cloudinfra-gw.uk.portal.checkpoint.com
  - https://cloudinfra-gw.ae.portal.checkpoint.com
  - https://cloudinfra-gw.in.portal.checkpoint.com
  - https://cloudinfra-gw.sg.portal.checkpoint.com
  required: true
  additionalinfo: The URL of the Smart API or Check Point Infinity API.
- section: Collect
  display: Fetch incidents
  name: isFetch
  type: 8
  required: false
- section: Collect
  display: Incident type
  name: incidentType
  type: 13
  required: false
- section: Connect
  display: ""
  name: client_id
  type: 9
  required: true
  displaypassword: Client ID
  hiddenusername: true
  additionalinfo: The client ID of the Smart API or Check Point Infinity API.
- display: ""
  section: Connect
  displaypassword: Client Secret
  name: client_secret
  type: 9
  required: true
  hiddenusername: true
  additionalinfo: The client secret of the Smart API or Check Point Infinity API.
- display: "First fetch time"
  name: first_fetch
  type: 0
  required: false
  section: Collect
  defaultvalue: 1 hour
  additionalinfo: The time range for the first fetch. The default is 1 hour.
- display: SaaS Application
  name: saas_apps
  section: Collect
  type: 16
  required: false
  options:
  - Microsoft Exchange
  - Gmail
  additionalinfo: Get incidents from the selected SaaS.
- display: State
  section: Collect
  name: event_state
  type: 16
  required: false
  options:
  - New
  - Remediated
  - Detected
  - Exception
  - Dismissed
  additionalinfo: Get incidents with only the selected states.
- display: Severity
  section: Collect
  name: event_severity
  type: 16
  required: false
  options:
  - Critical
  - High
  - Medium
  - Low
  - Very Low
  additionalinfo: Get incidents with only the selected severities.
- display: Threat Type
  section: Collect
  name: threat_type
  type: 16
  required: false
  options:
  - DLP
  - Malware
  - Phishing
  - Anomaly
  - Suspicious Phishing
  - Suspicious Malware
  - Shadow IT
  - Alert
  - Spam
  - Malicious URL
  - Malicious URL Click
  - Graymail
  additionalinfo: Get incidents with only the selected types.
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "10"
  type: 0
  required: false
  section: Collect
  additionalinfo: The maximum number of incidents to retrieve per fetch.
- section: Collect
  display: Collect restore requests
  name: collect_restore_requests
  type: 8
  required: false
  additionalinfo: Collect restore requests as incidents.
- section: Collect
  display: Include denied requests
  name: include_denied_requests
  type: 8
  required: false
  additionalinfo: Include denied restore requests in the results, do not check with "Include accepted requests".
- display: Include accepted requests
  name: include_accepted_requests
  type: 8
  required: false
  section: Collect
  additionalinfo: Include accepted restore requests in the results, do not check with "Include denied requests".
- display: Trust any certificate (not secure)
  additionalinfo: Trust server certificate.
  name: insecure
  type: 8
  required: false
  section: Connect
  advanced: true
- section: Connect
  additionalinfo: Use system proxy settings.
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- display: Incidents Fetch Interval
  section: Collect
  additionalinfo: The interval in minutes to fetch incidents. The default is 1 minute.
  name: incidentFetchInterval
  defaultvalue: "1"
  type: 19
  required: false
description: The Best Way to Protect Enterprise Email & Collaboration from phishing, malware, account takeover, data loss, etc.
display: 'Check Point Harmony Email and Collaboration (HEC)'
name: CheckPointHEC
script:
  commands:
  - name: checkpointhec-get-entity
    arguments:
    - name: entity
      description: Entity id to retrieve.
      required: true
    description: Retrieve specific entity.
    outputs:
    - contextPath: CheckPointHEC.Entity.internetMessageId
      description: Email message id in internet.
      type: String
    - contextPath: CheckPointHEC.Entity.received
      description: Datetime email was received in iso 8601 format.
      type: String
    - contextPath: CheckPointHEC.Entity.size
      description: Email size.
      type: String
    - contextPath: CheckPointHEC.Entity.emailLinks
      description: Links in email.
    - contextPath: CheckPointHEC.Entity.attachmentCount
      description: Number of attachments in email.
      type: Number
    - contextPath: CheckPointHEC.Entity.attachments
      description: File attachments in email.
    - contextPath: CheckPointHEC.Entity.mode
      description: Internal policy rule.
      type: String
    - contextPath: CheckPointHEC.Entity.recipients
      description: Recipient email addresses.
    - contextPath: CheckPointHEC.Entity.subject
      description: Email subject.
      type: String
    - contextPath: CheckPointHEC.Entity.fromEmail
      description: Email sender.
      type: String
    - contextPath: CheckPointHEC.Entity.fromDomain
      description: Domain where the email was sent from.
      type: String
    - contextPath: CheckPointHEC.Entity.fromUser
      description: Sender user details.
    - contextPath: CheckPointHEC.Entity.fromName
      description: Sender name.
      type: String
    - contextPath: CheckPointHEC.Entity.to
      description: Email main recipients.
    - contextPath: CheckPointHEC.Entity.toUser
      description: User details for main recipients.
    - contextPath: CheckPointHEC.Entity.cc
      description: Email carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.ccUser
      description: User details for carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.bcc
      description: Email blind carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.bccUser
      description: User details for blind carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.replyToEmail
      description: Email reply.
      type: String
    - contextPath: CheckPointHEC.Entity.replyToNickname
      description: Email reply nickname.
      type: String
    - contextPath: CheckPointHEC.Entity.isRead
      description: Email has been read.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isDeleted
      description: Email has been deleted.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isIncoming
      description: Email is from external organization.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isInternal
      description: Email is from same organization.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isOutgoing
      description: Email is to an external organization.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isQuarantined
      description: Email has been quarantined.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isQuarantineNotification
      description: Email is a notification of another quarantined email.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isRestored
      description: Email is restored from quarantine.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isRestoreRequested
      description: Email is a request to restore.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isRestoreDeclined
      description: Email is a declined restore request.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.saasSpamVerdict
      description: Spam verdict.
      type: String
    - contextPath: CheckPointHEC.Entity.SpfResult
      description: Sender Policy Framework check result.
      type: String
    - contextPath: CheckPointHEC.Entity.restoreRequestTime
      description: Restore request datetime in iso 8601 format.
      type: String
    - contextPath: CheckPointHEC.Entity.isUserExposed
      description: Email reached user inbox.
      type: Boolean
  - name: checkpointhec-get-events
    arguments:
    - name: start_date
      description: Start date in ISO 8601 format.
      required: true
    - name: end_date
      description: End date in ISO 8601 format, now by default.
      required: false
    - name: saas_apps
      description: SaaS application to retrieve events from.
      auto: PREDEFINED
      predefined:
      - Microsoft Exchange
      - Gmail
      isArray: true
      required: false
    - name: states
      description: Event states to be retrieved.
      auto: PREDEFINED
      predefined:
      - New
      - Remediated
      - Detected
      - Exception
      - Dismissed
      isArray: true
      required: false
    - name: severities
      description: Severity levels to be retrieved.
      auto: PREDEFINED
      predefined:
      - Critical
      - High
      - Medium
      - Low
      - Very Low
      isArray: true
      required: false
    - name: threat_types
      description: Threat types to be retrieved.
      auto: PREDEFINED
      predefined:
      - DLP
      - Malware
      - Phishing
      - Anomaly
      - Suspicious Phishing
      - Suspicious Malware
      - Shadow IT
      - Alert
      - Spam
      - Malicious URL
      - Malicious URL Click
      isArray: true
      required: false
    - name: limit
      description: Number of events to be returned.
      required: false
    description: Retrieve security events.
    outputs:
    - contextPath: CheckPointHEC.Event.eventId
      description: Security event id.
      type: String
    - contextPath: CheckPointHEC.Event.customerId
      description: Customer portal name.
      type: String
    - contextPath: CheckPointHEC.Event.saas
      description: SaaS internal name.
      type: String
    - contextPath: CheckPointHEC.Event.entityId
      description: Email entity id related to the security event.
      type: String
    - contextPath: CheckPointHEC.Event.state
      description: Security event state.
      type: String
    - contextPath: CheckPointHEC.Event.type
      description: Security event threat type.
      type: String
    - contextPath: CheckPointHEC.Event.confidenceIndicator
      description: Security event threat type.
      type: String
    - contextPath: CheckPointHEC.Event.eventCreated
      description: Security event creation date.
      type: String
    - contextPath: CheckPointHEC.Event.severity
      description: Security event severity 1 - 5.
      type: String
    - contextPath: CheckPointHEC.Event.description
      description: Security event description.
      type: String
    - contextPath: CheckPointHEC.Event.data
      description: Security event data information.
      type: String
    - contextPath: CheckPointHEC.Event.additionalData
      description: Security event additional data information if available.
      type: String
    - contextPath: CheckPointHEC.Event.availableEventActions
      description: Actions available for the security event.
    - contextPath: CheckPointHEC.Event.actions
      description: Performed actions related to the security event.
    - contextPath: CheckPointHEC.Event.senderAddress
      description: Sender of email related to the security event.
      type: String
    - contextPath: CheckPointHEC.Event.entityLink
      description: Email link.
      type: String
  - name: checkpointhec-get-scan-info
    arguments:
    - name: entity
      description: Scanned entity id.
      required: true
    - name: include_clean
      defaultValue: 'False'
      description: Include clean scans.
      type: Boolean
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      required: false
    description: Retrieve specific email scan with positive threats.
    outputs:
    - contextPath: CheckPointHEC.ScanResult.ap
      description: Anti-phishing scan results.
    - contextPath: CheckPointHEC.ScanResult.dlp
      description: Data Loss Prevention scan results.
    - contextPath: CheckPointHEC.ScanResult.clicktimeProtection
      description: Click Time Protection scan results.
    - contextPath: CheckPointHEC.ScanResult.shadowIt
      description: Shadow IT scan results.
    - contextPath: CheckPointHEC.ScanResult.av
      description: Antivirus scan results.
  - name: checkpointhec-search-emails
    description: Search for emails.
    arguments:
    - name: date_last
      description: Emails not older than (1 day, 2 weeks, etc.). The arguments `date_last` and `date_from` with `date_to` are mutually exclusive and cannot be specified together in the same request.
    - name: date_from
      description: Start date to get emails in ISO 8601 format. The arguments `date_last` and `date_from` with `date_to` are mutually exclusive and cannot be specified together in the same request.
    - name: date_to
      description: End date to get emails in ISO 8601 format. The arguments `date_last` and `date_from` with `date_to` are mutually exclusive and cannot be specified together in the same request.
    - name: saas
      description: SaaS application to retrieve emails from.
      auto: PREDEFINED
      predefined:
      - Microsoft Exchange
      - Gmail
    - name: direction
      description: Email precedence.
      auto: PREDEFINED
      predefined:
      - Internal
      - Incoming
      - Outgoing
    - name: subject_contains
      description: Emails with subject containing the given value. The arguments `subject_contains` and `subject_match` are mutually exclusive and cannot be specified together in the same request.
    - name: subject_match
      description: Emails with subject matching the given value. The arguments `subject_contains` and `subject_match` are mutually exclusive and cannot be specified together in the same request.
    - name: sender_contains
      description: Emails with sender email containing the given value. The arguments `sender_contains` and `sender_match` are mutually exclusive and cannot be specified together in the same request.
    - name: sender_match
      description: Emails with sender email matching the given value. The arguments `sender_contains` and `sender_match` are mutually exclusive and cannot be specified together in the same request.
    - name: domain
      description: Emails with sender domain matching the given value.
    - name: cp_detection
      description: Detection by Check Point.
      isArray: true
      auto: PREDEFINED
      predefined:
      - Phishing
      - Suspected Phishing
      - Malware
      - Suspected Malware
      - Spam
      - Clean
      - DLP
      - Malicious URL Click
      - Malicious URL
    - name: ms_detection
      description: Detection by Microsoft.
      isArray: true
      auto: PREDEFINED
      predefined:
      - Malware
      - High Confidence Phishing
      - Phishing
      - High Confidence Spam
      - Spam
      - Bulk
      - Clean
    - name: detection_op
      description: Detection operator.
      auto: PREDEFINED
      predefined:
      - OR
      - AND
    - name: server_ip
      description: Sender server ip.
    - name: recipients_contains
      description: Emails with recipients containing the given value. The arguments `recipients_contains` and `recipients_match` are mutually exclusive and cannot be specified together in the same request.
    - name: recipients_match
      description: Emails with recipients matching the given value. The arguments `recipients_contains` and `recipients_match` are mutually exclusive and cannot be specified together in the same request.
    - name: links
      description: Emails with links in body matching the given value.
    - name: message_id
      description: Get specific email by id.
    - name: cp_quarantined_state
      description: Quarantine authored by Check Point.
      auto: PREDEFINED
      predefined:
      - Quarantined (Any source)
      - Not Quarantined
      - Quarantined by Check Point
      - Quarantined by CP Analyst
      - Quarantined by Admin
    - name: ms_quarantined_state
      description: Quarantine authored by Microsoft.
      auto: PREDEFINED
      predefined:
      - Quarantined
      - Not Quarantined
      - Not Quarantined Delivered to Inbox
      - Not Quarantined Delivered to Junk
    - name: quarantined_state_op
      description: Quarantine state operator.
      auto: PREDEFINED
      predefined:
      - OR
      - AND
    - name: name_contains
      description: Emails with sender name containing the given value. The arguments `name_contains` and `name_match` are mutually exclusive and cannot be specified together in the same request.
    - name: name_match
      description: Emails with sender name matching the given value. The arguments `name_contains` and `name_match` are mutually exclusive and cannot be specified together in the same request.
    - name: client_ip
      description: Sender client IP.
    - name: attachment_md5
      description: Attachment MD5 checksum.
    outputs:
    - contextPath: CheckPointHEC.Entity.internetMessageId
      description: Email message id in internet.
      type: String
    - contextPath: CheckPointHEC.Entity.received
      description: Datetime email was received in iso 8601 format.
      type: String
    - contextPath: CheckPointHEC.Entity.size
      description: Email size.
      type: String
    - contextPath: CheckPointHEC.Entity.emailLinks
      description: Links in email.
    - contextPath: CheckPointHEC.Entity.attachmentCount
      description: Number of attachments in email.
      type: Number
    - contextPath: CheckPointHEC.Entity.attachments
      description: File attachments in email.
    - contextPath: CheckPointHEC.Entity.mode
      description: Internal policy rule.
      type: String
    - contextPath: CheckPointHEC.Entity.recipients
      description: Recipient email addresses.
    - contextPath: CheckPointHEC.Entity.subject
      description: Email subject.
      type: String
    - contextPath: CheckPointHEC.Entity.fromEmail
      description: Email sender.
      type: String
    - contextPath: CheckPointHEC.Entity.fromDomain
      description: Domain where the email was sent from.
      type: String
    - contextPath: CheckPointHEC.Entity.fromUser
      description: Sender user details.
    - contextPath: CheckPointHEC.Entity.fromName
      description: Sender name.
      type: String
    - contextPath: CheckPointHEC.Entity.to
      description: Email main recipients.
    - contextPath: CheckPointHEC.Entity.toUser
      description: User details for main recipients.
    - contextPath: CheckPointHEC.Entity.cc
      description: Email carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.ccUser
      description: User details for carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.bcc
      description: Email blind carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.bccUser
      description: User details for blind carbon copy recipients.
    - contextPath: CheckPointHEC.Entity.replyToEmail
      description: Email reply.
      type: String
    - contextPath: CheckPointHEC.Entity.replyToNickname
      description: Email reply nickname.
      type: String
    - contextPath: CheckPointHEC.Entity.isRead
      description: Email has been read.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isDeleted
      description: Email has been deleted.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isIncoming
      description: Email is from external organization.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isInternal
      description: Email is from same organization.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isOutgoing
      description: Email is to an external organization.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isQuarantined
      description: Email has been quarantined.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isQuarantineNotification
      description: Email is a notification of another quarantined email.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isRestored
      description: Email is restored from quarantine.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isRestoreRequested
      description: Email is a request to restore.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.isRestoreDeclined
      description: Email is a declined restore request.
      type: Boolean
    - contextPath: CheckPointHEC.Entity.saasSpamVerdict
      description: Spam verdict.
      type: String
    - contextPath: CheckPointHEC.Entity.SpfResult
      description: Sender Policy Framework check result.
      type: String
    - contextPath: CheckPointHEC.Entity.restoreRequestTime
      description: Restore request datetime in iso 8601 format.
      type: String
    - contextPath: CheckPointHEC.Entity.isUserExposed
      description: Email reached user inbox.
      type: Boolean
  - name: checkpointhec-send-action
    arguments:
    - name: entity
      description: One or multiple Email ids to apply action over.
      required: true
      isArray: true
    - name: saas
      description: SaaS application to apply action over.
      required: true
      auto: PREDEFINED
      predefined:
      - Microsoft Exchange
      - Gmail
    - name: action
      description: Action to perform.
      required: true
      auto: PREDEFINED
      predefined:
      - quarantine
      - restore
      - decline_restore_request
    - name: restore_decline_reason
      description: Reason to decline restore request.
      required: false
    description: Action for one or more emails.
    outputs:
    - contextPath: CheckPointHEC.Task.task
      description: Task id of the sent action.
      type: String
  - name: checkpointhec-get-action-result
    arguments:
    - name: task
      description: Task id to retrieve.
      required: true
    description: Get task info related to a sent action.
    outputs:
    - contextPath: CheckPointHEC.ActionResult.actions
      description: Action information for each sent entity.
    - contextPath: CheckPointHEC.ActionResult.created
      description: Date when action was created in iso 8601 format.
      type: String
    - contextPath: CheckPointHEC.ActionResult.customer
      description: Customer portal name.
      type: String
    - contextPath: CheckPointHEC.ActionResult.failed
      description: Number of failed actions.
      type: Number
    - contextPath: CheckPointHEC.ActionResult.id
      description: Action task id.
      type: Number
    - contextPath: CheckPointHEC.ActionResult.name
      description: Action name.
      type: String
    - contextPath: CheckPointHEC.ActionResult.owner
      description: Action owner.
      type: String
    - contextPath: CheckPointHEC.ActionResult.progress
      description: Number of actions in progress.
      type: Number
    - contextPath: CheckPointHEC.ActionResult.sequential
      description: Actions are in sequence.
      type: Boolean
    - contextPath: CheckPointHEC.ActionResult.status
      description: Action status.
      type: String
    - contextPath: CheckPointHEC.ActionResult.succeed
      description: Number of succeed actions.
      type: Number
    - contextPath: CheckPointHEC.ActionResult.total
      description: Total of actions.
      type: Number
    - contextPath: CheckPointHEC.ActionResult.type
      description: Action internal name.
      type: String
    - contextPath: CheckPointHEC.ActionResult.updated
      description: Date when action last updated in iso 8601 format.
      type: String
  - name: checkpointhec-send-notification
    arguments:
    - name: entity
      description: Email entity id.
      required: true
    - name: emails
      description: List of emails to send notification.
      isArray: true
      required: true
    description: Send notification about user exposition for the specific entity to the list of emails.
    outputs:
    - contextPath: CheckPointHEC.Notification.ok
      description: Result of the operation.
      type: Boolean
  - name: checkpointhec-report-mis-classification
    description: Report email mis-classification.
    arguments:
    - name: entities
      description: Email entity ids.
      required: true
      isArray: true
    - name: classification
      description: New classification.
      required: true
      auto: PREDEFINED
      predefined:
      - Clean Email
      - Spam
      - Phishing
      - Legit Marketing Email
    - name: confident
      description: Confidence level.
      required: true
      auto: PREDEFINED
      predefined:
      - Not so sure
      - Medium Confidence
      - High Confidence
  - name: checkpointhec-get-ap-exceptions
    description: Get Anti-Phishing and Anti-Spam exceptions or exception.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - whitelist
      - blacklist
      - spam_whitelist
      required: true
    - name: exc_id
      description: Exception id to retrieve.
      required: false
    outputs:
    - contextPath: CheckPointHEC.AntiPhishingException.added_by
      description: Exception added by user id.
      type: Number
    - contextPath: CheckPointHEC.AntiPhishingException.affected_count
      description: Affected count.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.allowed_links
      description: Allowed links.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.attachment_md5
      description: Email attachment MD5.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.auto_classify_as
      description: Auto classify as.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.comment
      description: Exception description.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.customer_domain
      description: Customer name.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.edited_by
      description: Exception edited by.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.email_link
      description: Email link.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.email_link_matching
      description: Email link field condition.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.entity_id
      description: Entity id.
      type: Number
    - contextPath: CheckPointHEC.AntiPhishingException.exception_type
      description: Exception type.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.expiration_time
      description: Exception expiration time.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.from_domain
      description: From domain.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.from_domain_ends_with
      description: From domain field ends with.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.from_domain_matching
      description: From domain field condition.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.from_email
      description: Email sender.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.from_email_matching
      description: From email field condition.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.from_name_matching
      description: From name field condition.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.headers
      description: Email headers.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.ignoring_spf_check
      description: Ignore SPF check.
      type: Boolean
    - contextPath: CheckPointHEC.AntiPhishingException.insert_time
      description: Exception creation time.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.max_confidence
      description: Maximum confidence.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.max_confidence_spam
      description: Maximum confidence for spam.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.message_headers
      description: Message headers.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.nickname
      description: Sender name.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.owner_email
      description: Exception owner email.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.override
      description: Override.
      type: Boolean
    - contextPath: CheckPointHEC.AntiPhishingException.recipient
      description: Email recipient.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.recipient_matching
      description: Recipient field condition.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.sender_client_ip
      description: Sender client IP.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.sender_ip
      description: Sender IP.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.signature_key
      description: Signature key.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.subject
      description: Email subject.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.subject_matching
      description: Subject field condition.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.update_time
      description: Exception update.
      type: String
    - contextPath: CheckPointHEC.AntiPhishingException.user_label
      description: User label.
      type: String
  - name: checkpointhec-create-ap-exception
    description: Create Anti-Phishing and Anti-Spam exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - whitelist
      - blacklist
      - spam_whitelist
      required: true
    - name: entity_id
      description: Entity id.
      required: false
    - name: attachment_md5
      description: Attachment MD5 checksum.
      required: false
    - name: from_email
      description: Email sender.
      required: false
    - name: nickname
      description: Sender name.
      required: false
    - name: recipient
      description: Email recipient.
      required: false
    - name: sender_client_ip
      description: Sender client IP.
      required: false
    - name: from_domain_ends_with
      description: From domain ends with.
      required: false
    - name: sender_ip
      description: Sender IP.
      required: false
    - name: email_link
      description: Email link or links separated by comma.
      required: false
    - name: subject
      description: Email subject.
      required: false
    - name: comment
      description: Exception comment.
      required: false
    - name: action_needed
      description: Action needed.
      required: false
    - name: ignoring_spf_check
      description: Ignoring SPF check.
      required: false
    - name: subject_matching
      description: Subject field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: email_link_matching
      description: Email link field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: from_name_matching
      description: From name field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: from_domain_matching
      description: From domain field condition.
      auto: PREDEFINED
      predefined:
      - contains
      - ends_with
      - exact
      required: false
    - name: from_email_matching
      description: From email field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: recipient_matching
      description: Recipient field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
  - name: checkpointhec-update-ap-exception
    description: Update Anti-Phishing and Anti-Spam exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - whitelist
      - blacklist
      - spam_whitelist
      required: true
    - name: exc_id
      description: Exception id.
      required: true
    - name: entity_id
      description: Entity id.
      required: false
    - name: attachment_md5
      description: Attachment MD5 checksum.
      required: false
    - name: from_email
      description: Email sender.
      required: false
    - name: nickname
      description: Sender name.
      required: false
    - name: recipient
      description: Email recipient.
      required: false
    - name: sender_client_ip
      description: Sender client IP.
      required: false
    - name: from_domain_ends_with
      description: From domain ends with.
      required: false
    - name: sender_ip
      description: Sender IP.
      required: false
    - name: email_link
      description: Email link or links separated by comma.
      required: false
    - name: subject
      description: Email subject.
      required: false
    - name: comment
      description: Exception comment.
      required: false
    - name: action_needed
      description: Action needed.
      required: false
    - name: ignoring_spf_check
      description: Ignoring SPF check.
      required: false
    - name: subject_matching
      description: Subject field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: email_link_matching
      description: Email link field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: from_name_matching
      description: From name field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: from_domain_matching
      description: From domain field condition.
      auto: PREDEFINED
      predefined:
      - contains
      - ends_with
      - exact
      required: false
    - name: from_email_matching
      description: From email field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
    - name: recipient_matching
      description: Recipient field condition.
      auto: PREDEFINED
      predefined:
      - matching
      - contains
      - exact
      required: false
  - name: checkpointhec-delete-ap-exception
    description: Delete Anti-Phishing and Anti-Spam exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - whitelist
      - blacklist
      - spam_whitelist
      required: true
    - name: exc_id
      description: Exception id.
      required: true
  - name: checkpointhec-get-cp2-exception
    description: Get Anti-Malware exception.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - hash
      - macro_hash
      - file_type
      - ppat_sender_name
      required: true
    - name: exc_str
      description: Exception id to retrieve.
      required: true
    outputs:
    - contextPath: CheckPointHEC.AntiMalwareException.insert_time
      description: Exception insert time.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.farm_customer_exception_type
      description: Farm, customer and exception type info.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.exception_str
      description: Exception string, for id purposes.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.created_by_email
      description: Exception email creator.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.comment
      description: Exception comment.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.exception_payload
      description: Exception payload information.
      type: String
  - name: checkpointhec-create-cp2-exception
    description: Create Anti-Malware exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - macro_hash
      - file_type
      - ppat_sender_name
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
    - name: comment
      description: Exception comment.
      required: false
    - name: exc_payload_condition
      description: Exception payload condition.
      auto: PREDEFINED
      predefined:
      - with_or_without_link
      - with_link
      - without_link
      required: false
    - name: file_name
      description: File name.
      required: false
    - name: created_by_email
      description: Exception creator email.
      required: false
    - name: is_exclusive
      description: Exclusive exception.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      required: false
  - name: checkpointhec-update-cp2-exception
    description: Update Anti-Malware exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - macro_hash
      - file_type
      - ppat_sender_name
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: comment
      description: Exception comment.
      required: false
    - name: exc_payload_condition
      description: Exception payload condition.
      auto: PREDEFINED
      predefined:
      - with_or_without_link
      - with_link
      - without_link
      required: false
  - name: checkpointhec-delete-cp2-exception
    description: Delete Anti-Malware exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - macro_hash
      - file_type
      - ppat_sender_name
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
  - name: checkpointhec-get-cp2-exceptions
    description: Get Anti-Malware exceptions.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - hash
      - macro_hash
      - file_type
      - ppat_sender_name
      required: true
    - name: filter_str
      description: Search string.
      required: false
    - name: filter_index
      description: Search index.
      auto: PREDEFINED
      predefined:
      - insert_time
      - entity_type_id
      - exception_str
      - file_name
      - created_by_email
      - comment
      required: false
    - name: sort_dir
      description: Sort direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      required: false
    - name: last_evaluated_key
      description: Last evaluated key.
      required: false
    - name: insert_time_gte
      description: Insert time field condition.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      required: false
    - name: limit
      description: Number of exceptions to retrieve.
      required: false
    outputs:
    - contextPath: CheckPointHEC.AntiMalwareException.insert_time
      description: Exception insert time.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.farm_customer_exception_type
      description: Farm, customer and exception type info.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.exception_str
      description: Exception string, for id purposes.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.created_by_email
      description: Exception email creator.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.comment
      description: Exception comment.
      type: String
    - contextPath: CheckPointHEC.AntiMalwareException.exception_payload
      description: Exception payload information.
      type: String
  - name: checkpointhec-delete-cp2-exceptions
    description: Delete Anti-Malware exceptions.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - macro_hash
      - file_type
      - ppat_sender_name
      required: true
    - name: exc_str_list
      description: List of exception strings to delete.
      isArray: true
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
  - name: checkpointhec-get-anomaly-exceptions
    description: Get Anomaly exceptions.
    outputs:
    - contextPath: CheckPointHEC.AnomalyException.id
      description: Anomaly exception id.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.anomaly_type
      description: Anomaly type.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.insert_time
      description: Anomaly exception creation time.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.update_time
      description: Anomaly exception update time.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.added_by
      description: Anomaly exception creator.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.event_id
      description: Security event id.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.customer_domain
      description: Customer domain.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.comments
      description: Anomaly exception comment.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.enabled
      description: Anomaly exception enabled.
      type: Boolean
    - contextPath: CheckPointHEC.AnomalyException.exception_rule
      description: Anomaly exception rule.
      type: String
    - contextPath: CheckPointHEC.AnomalyException.expiration_date
      description: Anomaly exception expiration date.
      type: String
  - name: checkpointhec-create-anomaly-exception
    description: Create Anomaly exception.
    arguments:
    - name: request_json
      description: Anomaly exception request json.
      required: true
      type: keyValue
    - name: added_by
      description: User id exception creator.
      required: false
  - name: checkpointhec-delete-anomaly-exceptions
    description: Delete Anomaly exceptions.
    arguments:
    - name: rule_ids
      description: Exceptions to delete.
      isArray: true
      required: true
  - name: checkpointhec-get-ctp-lists
    description: Get Click Time Protection lists.
    outputs:
    - contextPath: CheckPointHEC.CTPList.listid
      description: List id.
      type: String
    - contextPath: CheckPointHEC.CTPList.listname
      description: List name.
      type: String
    - contextPath: CheckPointHEC.CTPList.listitem
      description: List item in the list.
  - name: checkpointhec-get-ctp-list
    description: Get Click Time Protection list.
    arguments:
    - name: list_id
      description: List id to retrieve.
      required: true
    outputs:
    - contextPath: CheckPointHEC.CTPList.listid
      description: List id.
      type: String
    - contextPath: CheckPointHEC.CTPList.listname
      description: List name.
      type: String
    - contextPath: CheckPointHEC.CTPList.listitem
      description: List of items in the list.
      type: String
  - name: checkpointhec-get-ctp-list-items
    description: Get Click Time Protection list items.
    outputs:
    - contextPath: CheckPointHEC.CTPListItem.created_at
      description: List item creation time.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.created_by
      description: List item creator.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listid
      description: List id.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listitemid
      description: List item id.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listitemname
      description: List item name.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listname
      description: List name.
      type: String
  - name: checkpointhec-get-ctp-list-item
    description: Get Click Time Protection list item.
    arguments:
    - name: item_id
      description: Item id to retrieve.
      required: true
    outputs:
    - contextPath: CheckPointHEC.CTPListItem.created_at
      description: List item creation time.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.created_by
      description: List item creator.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listid
      description: List id.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listitemid
      description: List item id.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listitemname
      description: List item name.
      type: String
    - contextPath: CheckPointHEC.CTPListItem.listname
      description: List name.
      type: String
  - name: checkpointhec-create-ctp-list-item
    description: Create Click Time Protection list item.
    arguments:
    - name: list_id
      description: List id.
      required: true
    - name: list_item_name
      description: List item name.
      required: true
    - name: created_by
      description: List item creator.
      required: true
  - name: checkpointhec-update-ctp-list-item
    description: Update Click Time Protection list item.
    arguments:
    - name: item_id
      description: Item id to update.
      required: true
    - name: list_id
      description: List id.
      required: true
    - name: list_item_name
      description: List item name.
      required: true
    - name: created_by
      description: List item creator.
      required: true
  - name: checkpointhec-delete-ctp-list-item
    description: Delete Click Time Protection list item.
    arguments:
    - name: item_id
      description: Item id to delete.
      required: true
  - name: checkpointhec-delete-ctp-list-items
    description: Delete Click Time Protection list items.
    arguments:
    - name: list_item_ids
      description: List of item ids to delete.
      isArray: true
      required: true
  - name: checkpointhec-delete-ctp-lists
    description: Delete Click Time Protection lists.
  - name: checkpointhec-get-avurl-exception
    description: Get Avanan URL exception.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - allow-url
      - allow-domain
      - block-url
      - block-domain
      required: true
    - name: exc_str
      description: Exception id to retrieve.
      required: true
    outputs:
    - contextPath: CheckPointHEC.AvananURLException.insert_time
      description: Exception insert time.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.farm_customer_exception_type
      description: Farm, customer and exception type info.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.exception_str
      description: Exception string, for id purposes.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.created_by_email
      description: Exception email creator.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.comment
      description: Exception comment.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.exception_payload
      description: Exception payload information.
      type: String
  - name: checkpointhec-create-avurl-exception
    description: Create Avanan URL exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - allow-url
      - allow-domain
      - block-url
      - block-domain
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
    - name: comment
      description: Exception comment.
      required: false
    - name: exc_payload_condition
      description: Exception payload condition.
      auto: PREDEFINED
      predefined:
      - with_or_without_link
      - with_link
      - without_link
      required: false
    - name: file_name
      description: File name.
      required: false
    - name: created_by_email
      description: Exception creator email.
      required: false
    - name: is_exclusive
      description: Exclusive exception.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      required: false
  - name: checkpointhec-update-avurl-exception
    description: Update Avanan URL exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - allow-url
      - allow-domain
      - block-url
      - block-domain
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: comment
      description: Exception comment.
      required: false
    - name: exc_payload_condition
      description: Exception payload condition.
      auto: PREDEFINED
      predefined:
      - with_or_without_link
      - with_link
      - without_link
      required: false
  - name: checkpointhec-delete-avurl-exception
    description: Delete Avanan URL exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - allow-url
      - allow-domain
      - block-url
      - block-domain
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
  - name: checkpointhec-get-avurl-exceptions
    description: Get Avanan URL exceptions.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - allow-url
      - allow-domain
      - block-url
      - block-domain
      required: true
    - name: filter_str
      description: Search string.
      required: false
    - name: filter_index
      description: Search index.
      auto: PREDEFINED
      predefined:
      - insert_time
      - entity_type_id
      - exception_str
      - file_name
      - created_by_email
      - comment
      required: false
    - name: sort_dir
      description: Sort direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      required: false
    - name: last_evaluated_key
      description: Last evaluated key.
      required: false
    - name: insert_time_gte
      description: Insert time field condition.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      required: false
    - name: limit
      description: Number of exceptions to retrieve.
      required: false
    outputs:
    - contextPath: CheckPointHEC.AvananURLException.insert_time
      description: Exception insert time.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.farm_customer_exception_type
      description: Farm, customer and exception type info.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.exception_str
      description: Exception string, for id purposes.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.created_by_email
      description: Exception email creator.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.comment
      description: Exception comment.
      type: String
    - contextPath: CheckPointHEC.AvananURLException.exception_payload
      description: Exception payload information.
      type: String
  - name: checkpointhec-delete-avurl-exceptions
    description: Delete Avanan URL exceptions.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - allow-url
      - allow-domain
      - block-url
      - block-domain
      required: true
    - name: exc_str_list
      description: List of exception strings to delete.
      isArray: true
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
  - name: checkpointhec-get-avdlp-exception
    description: Get Avanan DLP exception.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - hash
      - text_content
      - sender_email
      - recipient_email
      required: true
    - name: exc_str
      description: Exception id to retrieve.
      required: true
    outputs:
    - contextPath: CheckPointHEC.AvananDLPException.insert_time
      description: Exception insert time.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.farm_customer_exception_type
      description: Farm, customer and exception type info.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.exception_str
      description: Exception string, for id purposes.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.created_by_email
      description: Exception email creator.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.comment
      description: Exception comment.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.exception_payload
      description: Exception payload information.
      type: String
  - name: checkpointhec-create-avdlp-exception
    description: Create Avanan DLP exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - text_content
      - sender_email
      - recipient_email
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
    - name: comment
      description: Exception comment.
      required: false
    - name: exc_payload_condition
      description: Exception payload condition.
      auto: PREDEFINED
      predefined:
      - with_or_without_link
      - with_link
      - without_link
      required: false
    - name: file_name
      description: File name.
      required: false
    - name: created_by_email
      description: Exception creator email.
      required: false
    - name: is_exclusive
      description: Exclusive exception.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      required: false
  - name: checkpointhec-update-avdlp-exception
    description: Update Avanan URL exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - text_content
      - sender_email
      - recipient_email
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: comment
      description: Exception comment.
      required: false
    - name: exc_payload_condition
      description: Exception payload condition.
      auto: PREDEFINED
      predefined:
      - with_or_without_link
      - with_link
      - without_link
      required: false
  - name: checkpointhec-delete-avdlp-exception
    description: Delete Avanan URL exception.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - text_content
      - sender_email
      - recipient_email
      required: true
    - name: exc_str
      description: Exception string.
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
  - name: checkpointhec-get-avdlp-exceptions
    description: Get Avanan DLP exceptions.
    arguments:
    - name: exc_type
      description: List name of exceptions to retrieve.
      auto: PREDEFINED
      predefined:
      - hash
      - text_content
      - sender_email
      - recipient_email
      required: true
    - name: filter_str
      description: Search string.
      required: false
    - name: filter_index
      description: Search index.
      auto: PREDEFINED
      predefined:
      - insert_time
      - entity_type_id
      - exception_str
      - file_name
      - created_by_email
      - comment
      required: false
    - name: sort_dir
      description: Sort direction.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
      required: false
    - name: last_evaluated_key
      description: Last evaluated key.
      required: false
    - name: insert_time_gte
      description: Insert time field condition.
      auto: PREDEFINED
      predefined:
      - yes
      - no
      required: false
    - name: limit
      description: Number of exceptions to retrieve.
      required: false
    outputs:
    - contextPath: CheckPointHEC.AvananDLPException.insert_time
      description: Exception insert time.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.farm_customer_exception_type
      description: Farm, customer and exception type info.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.exception_str
      description: Exception string, for id purposes.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.created_by_email
      description: Exception email creator.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.comment
      description: Exception comment.
      type: String
    - contextPath: CheckPointHEC.AvananDLPException.exception_payload
      description: Exception payload information.
      type: String
  - name: checkpointhec-delete-avdlp-exceptions
    description: Delete Avanan DLP exceptions.
    arguments:
    - name: exc_type
      description: Exception type.
      auto: PREDEFINED
      predefined:
      - hash
      - text_content
      - sender_email
      - recipient_email
      required: true
    - name: exc_str_list
      description: List of exception strings to delete.
      isArray: true
      required: true
    - name: entity_type
      description: Entity type.
      required: false
    - name: entity_id
      description: Entity id.
      required: false
  - name: checkpointhec-download-email
    description: Download email file.
    arguments:
    - name: entity_id
      description: Email entity id, currently available in the incident's mirror external id.
      required: true
    - name: original
      defaultValue: 'False'
      type: Boolean
      description: Whether to download original email or with modifications.
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      required: false
  - name: checkpointhec-download-large-email
    description: Download large email file.
    arguments:
    - name: entity_id
      description: Email entity id, currently available in the incident's mirror external id.
      required: true
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.9.0
tests:
- No tests (auto formatted)
sectionorder:
- Connect
- Collect