category: Analytics & SIEM
provider: CheckPoint Software Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: CheckPointNDR
  version: -1
configuration:
- section: Connect
  display: Infinity NDR API URL
  name: url
  defaultvalue: "https://portal.now.checkpoint.com"
  type: 0
  required: true
- section: Connect
  display: Client ID
  displaypassword: Access Key
  name: credentials
  type: 9
  required: true
- section: Connect
  display: NDR Domain name
  name: domain
  type: 0
  required: true
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- section: Collect
  display: First fetch time
  additionalinfo: First insight updated date to fetch. e.g., "24 hours", "7 days", "1 month"
  name: first_fetch
  defaultvalue: 7 days
  type: 0
  required: false
- section: Collect
  advanced: true
  display: Fetch incidents
  name: isFetch
  defaultvalue: 'true'
  type: 8
  required: false
- section: Collect
  display: Minimum probability level
  additionalinfo: Filter out NDR insights with probability lower than this value
  name: min_probability
  defaultvalue: "0"
  type: 0
  required: false
- section: Collect
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "10"
  type: 19
  required: false
- section: Collect
  display: Incident type
  name: incidentType
  required: false
  type: 13
- section: Collect
  display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "1000"
  type: 0
  required: false
description: Collect network security events from Check Point Infinity NDR for your secured SaaS periodically.
display: 'Check Point Network Detection and Response (Infinity NDR)'
name: CheckPointNDR
script:
  isfetch: true
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.9.0
tests:
- No tests (auto formatted)