CheckPointNDR

Details

ID	`CheckPointNDR`
Provider	CheckPoint Software Technologies
Category	Analytics & SIEM
From Version	6.9.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Collect network security events from Check Point Infinity NDR for your secured SaaS periodically
This integration was integrated and tested with version 1.1.0 of CheckPointNDR

Configure Check Point Network Detection and Response (Infinity NDR) in Cortex

Parameter	Required
Infinity NDR API URL (e.g. https://api.now.checkpoint.com)	True
Client ID	True
Access Key	True
First fetch time	False
Trust any certificate (not secure)	False
Use system proxy settings	False
Incidents Fetch Interval	False

Commands

You can execute these commands from the Cortex CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

check-point-ndr-fetch-insights

Retrieve all NDR Insights

Base Command

check-point-ndr-fetch-insights

Input

Argument Name	Description	Required
from	Date and time from which to fetch insights. Default is Last 24 hours.	Optional
create_events	If true, the command will create events, otherwise it will only display them. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
CheckPointHEC.Entity.internetMessageId	String	Email message id in internet.
CheckPointHEC.Entity.subject	String	Email subject.
CheckPointHEC.Entity.received	String	Datetime email was received in iso 8601 format.
CheckPointHEC.Entity.size	String	Email size.
CheckPointHEC.Entity.emailLinks	unknown	Links in email.
CheckPointHEC.Entity.attachmentCount	Number	Number of attachments in email.
CheckPointHEC.Entity.attachments	unknown	File attachments in email.
CheckPointHEC.Entity.mode	String	Internal policy rule.
CheckPointHEC.Entity.recipients	unknown	Recipient email addresses.
CheckPointHEC.Entity.subject	String	Email subject.
CheckPointHEC.Entity.fromEmail	String	Email sender.
CheckPointHEC.Entity.fromDomain	String	Domain where the email was sent from.
CheckPointHEC.Entity.fromUser	unknown	Sender user details.
CheckPointHEC.Entity.fromName	String	Sender name.
CheckPointHEC.Entity.to	unknown	Email main recipients.
CheckPointHEC.Entity.toUser	unknown	User details for main recipients.
CheckPointHEC.Entity.cc	unknown	Email carbon copy recipients.
CheckPointHEC.Entity.ccUser	unknown	User details for carbon copy recipients.
CheckPointHEC.Entity.bcc	unknown	Email blind carbon copy recipients.
CheckPointHEC.Entity.bccUser	unknown	User details for blind carbon copy recipients.
CheckPointHEC.Entity.replyToEmail	String	Email reply.
CheckPointHEC.Entity.replyToNickname	String	Email reply nickname.
CheckPointHEC.Entity.isRead	Boolean	Email has been read.
CheckPointHEC.Entity.isDeleted	Boolean	Email has been deleted.
CheckPointHEC.Entity.isIncoming	Boolean	Email is from external organization.
CheckPointHEC.Entity.isInternal	Boolean	Email is from same organization.
CheckPointHEC.Entity.isOutgoing	Boolean	Email is to an external organization.
CheckPointHEC.Entity.isQuarantined	Boolean	Email has been quarantined.
CheckPointHEC.Entity.isQuarantineNotification	Boolean	Email is a notification of another quarantined email.
CheckPointHEC.Entity.isRestored	Boolean	Email is restored from quarantine.
CheckPointHEC.Entity.isRestoreRequested	Boolean	Email is a request to restore.
CheckPointHEC.Entity.isRestoreDeclined	Boolean	Email is a declined restore request.
CheckPointHEC.Entity.saasSpamVerdict	String	Spam verdict.
CheckPointHEC.Entity.SpfResult	String	Sender Policy Framework check result.
CheckPointHEC.Entity.restoreRequestTime	String	Restore request datetime in iso 8601 format.

Configuration parameters

url — Infinity NDR API URL (required)
credentials — Client ID (required)
domain — NDR Domain name (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
first_fetch — First fetch time
isFetch — Fetch incidents
min_probability — Minimum probability level
incidentFetchInterval — Incidents Fetch Interval
incidentType — Incident type
max_fetch — Maximum number of incidents per fetch

Commands (0)

This integration defines no commands.

Source

CheckPointNDR.py CheckPointNDR_test.py CheckPointNDR.yml CheckPointNDR_description.md command_examples.txt

Download History Raw

category: Analytics & SIEM
provider: CheckPoint Software Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: CheckPointNDR
  version: -1
configuration:
- section: Connect
  display: Infinity NDR API URL
  name: url
  defaultvalue: "https://portal.now.checkpoint.com"
  type: 0
  required: true
- section: Connect
  display: Client ID
  displaypassword: Access Key
  name: credentials
  type: 9
  required: true
- section: Connect
  display: NDR Domain name
  name: domain
  type: 0
  required: true
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- section: Collect
  display: First fetch time
  additionalinfo: First insight updated date to fetch. e.g., "24 hours", "7 days", "1 month"
  name: first_fetch
  defaultvalue: 7 days
  type: 0
  required: false
- section: Collect
  advanced: true
  display: Fetch incidents
  name: isFetch
  defaultvalue: 'true'
  type: 8
  required: false
- section: Collect
  display: Minimum probability level
  additionalinfo: Filter out NDR insights with probability lower than this value
  name: min_probability
  defaultvalue: "0"
  type: 0
  required: false
- section: Collect
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "10"
  type: 19
  required: false
- section: Collect
  display: Incident type
  name: incidentType
  required: false
  type: 13
- section: Collect
  display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "1000"
  type: 0
  required: false
description: Collect network security events from Check Point Infinity NDR for your secured SaaS periodically.
display: 'Check Point Network Detection and Response (Infinity NDR)'
name: CheckPointNDR
script:
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.9.0
tests:
- No tests (auto formatted)