category: Analytics & SIEM
provider: CheckPoint Software Technologies
sectionorder:
- Connect
- Collect
commonfields:
  id: CheckPointXDR
  version: -1
configuration:
- section: Connect
  display: Infinity XDR API URL
  name: url
  defaultvalue: "https://cloudinfra-gw.portal.checkpoint.com"
  type: 0
  required: true
- section: Connect
  display: Client ID
  displaypassword: Access Key
  name: credentials
  type: 9
  required: true
- section: Connect
  advanced: true
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
- section: Connect
  advanced: true
  display: Use system proxy settings
  name: proxy
  type: 8
  required: false
- section: Collect
  display: First fetch time
  additionalinfo: First insight updated date to fetch. e.g., "24 hours", "7 days", "1 month"
  name: first_fetch
  defaultvalue: 3 days
  type: 0
  required: false
- section: Collect
  advanced: true
  display: Fetch incidents
  name: isFetch
  defaultvalue: 'true'
  type: 8
  required: false
- section: Collect
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "10"
  type: 19
  required: false
- section: Collect
  display: Incident type
  name: incidentType
  required: false
  type: 13
  defaultvalue: "Check Point XDR Incident"
- section: Collect
  display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "1000"
  type: 0
  required: false
- additionalinfo: Outgoing Mirroring - when selected, closing the Cortex XSOAR incident is mirrored in XDR.
  defaultvalue: 'false'
  display: Close Mirrored XDR Incidents
  name: close_out
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: 'Choose the direction to mirror the incident: Incoming (from XDR to Cortex XSOAR) - currently not supported, Outgoing (from Cortex XSOAR to XDR), or Incoming and Outgoing (Incoming currently not supported).'
  defaultvalue: None
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  hidden:
  - marketplacev2
  required: false
  section: Collect
description: Fetch and manage incidents from Check Point XDR.
display: 'Check Point XDR'
name: CheckPointXDR
script:
  commands:
  - arguments: []
    deprecated: false
    description: Returns the list of fields to map in outgoing mirroring. This command is only used for debugging purposes.
    execution: false
    name: get-mapping-fields
  isfetch: true
  script: '-'
  subtype: python3
  type: python
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  dockerimage: demisto/python3:3.12.13.10116658
defaultmapperin: CheckPointXDR_Incoming_Mapper
defaultmapperout: CheckPointXDR_Out_Mapper
fromversion: 6.10.0
tests:
- No tests (auto formatted)