↳ GitHub sourceConnector
Check Point EM ThreatCloud Intelligence Feed Connector
Description
Check Point provides a Microsoft Sentinel integration to ingest high-fidelity Indicators of Compromise (IoCs) from the Infinity External Risk Management solution into Microsoft Sentinel. This connector incrementally pulls the premium IOC feed — including malicious IPs, domains, URLs, and file hashes — enriched with confidence, severity, malicious classification, kill chain stage, blocking and uniqueness flags, malware types, and CVE/campaign associations.
- Declared author / publisher
- Check Point
Declared sources
Metadata from the source file. No dependencies inferred from KQL.
Data types
Declared permissions
Read/Write/Delete permissions are required.
Workspace
Workspace
Check Point Cyberint API Key, Argos URL, and Customer Name
The connector API key, Argos URL, and Customer Name are required
Connector instructions
Content published in the repository. Refer to the original file for all parameters.
Connect Check Point EM ThreatCloud Intelligence Feed to Microsoft Sentinel
To enable the connector provide the required information below and click on Connect.
**Argos URL** — Cyberint API URL for your tenant (e.g. `https://your_tenant.cyberint.io`)
**API Token** — Cyberint API access token
**Customer Name** — Company (client) name associated with your Cyberint instance
Argos URL
API Token
Customer Name
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
9800e51↗- Source identifier
CheckPointEMIOCIntelligence
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC