{
  "name": "CheckPointEmailSecConnector",
  "apiVersion": "2025-07-01-preview",
  "type": "Microsoft.SecurityInsights/dataConnectorDefinitions",
  "location": "{{location}}",
  "kind": "Customizable",
  "properties": {
    "connectorUiConfig": {
      "id": "CheckPointEmailSecConnector",
      "title": "Check Point Email Security (via Codeless Connector Framework)",
      "publisher": "Microsoft",
      "descriptionMarkdown": "The [Check Point Email Security (Harmony Email Collaboration)](https://www.checkpoint.com/harmony/email-security/) data connector provides the capability to ingest security events and audit logs from Check Point's Email Security platform into Microsoft Sentinel through the REST API. The connector provides visibility into advanced email threats including zero-day threats, phishing, account takeover, data leakage, and shadow IT discovery. It ingests security events, anti-phishing exceptions, spam exceptions, and audit logs into Microsoft Sentinel, helping organizations maintain security and compliance visibility.",
      "graphQueries": [
        {
          "metricName": "Total security events received",
          "legend": "Check Point Email Security Events",
          "baseQuery": "CheckPointEmailSecurityEvents_CL"
        },
        {
          "metricName": "Total anti-phishing exceptions received",
          "legend": "Check Point Anti-Phishing Exceptions",
          "baseQuery": "CheckPointEmailSecAntiPhishingExceptions_CL"
        },
        {
          "metricName": "Total spam exceptions received",
          "legend": "Check Point Spam Exceptions",
          "baseQuery": "CheckPointEmailSecuritySpamExceptions_CL"
        },
        {
          "metricName": "Total audit logs received",
          "legend": "Check Point Audit Logs",
          "baseQuery": "CheckPointEmailSecurityAuditLogs_CL"
        }
      ],
      "sampleQueries": [
        {
          "description": "Get sample of Check Point Email Security Events",
          "query": "CheckPointEmailSecurityEvents_CL\n | take 10"
        },
        {
          "description": "Get sample of Check Point Anti-Phishing Exceptions",
          "query": "CheckPointEmailSecAntiPhishingExceptions_CL\n | take 10"
        },
        {
          "description": "Get sample of Check Point Spam Exceptions",
          "query": "CheckPointEmailSecuritySpamExceptions_CL\n | take 10"
        },
        {
          "description": "Get sample of Check Point Audit Logs",
          "query": "CheckPointEmailSecurityAuditLogs_CL\n | take 10"
        }
      ],
      "dataTypes": [
        {
          "name": "CheckPointEmailSecurityEvents_CL",
          "lastDataReceivedQuery": "CheckPointEmailSecurityEvents_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
        },
        {
          "name": "CheckPointEmailSecAntiPhishingExceptions_CL",
          "lastDataReceivedQuery": "CheckPointEmailSecAntiPhishingExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
        },
        {
          "name": "CheckPointEmailSecuritySpamExceptions_CL",
          "lastDataReceivedQuery": "CheckPointEmailSecuritySpamExceptions_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
        },
        {
          "name": "CheckPointEmailSecurityAuditLogs_CL",
          "lastDataReceivedQuery": "CheckPointEmailSecurityAuditLogs_CL\n| where ingestion_time() > ago(12h)\n| summarize Time = max(ingestion_time())\n| where isnotempty(Time)"
        }
      ],
      "connectivityCriteria": [
        {
          "type": "HasDataConnectors"
        }
      ],
      "availability": {
        "isPreview": false,
        "status": 1
      },
      "permissions": {
        "resourceProvider": [
          {
            "provider": "Microsoft.OperationalInsights/workspaces",
            "permissionsDisplayText": "Read and Write permissions are required.",
            "providerDisplayName": "Workspace",
            "scope": "Workspace",
            "requiredPermissions": {
              "write": true,
              "read": true,
              "delete": true,
              "action": false
            }
          }
        ],
        "customs": [
          {
            "name": "Check Point Email Security API Credentials",
            "description": "Two separate Check Point Infinity Portal API keys are required. A **Harmony Email & Collaboration** API key (**Client ID** + **Client Secret**) is used for security events and exceptions. A separate **Logs as a Service** API key (**Audit Client ID** + **Audit Client Secret**) is required for audit logs. Generate both from your Check Point Infinity Portal under Global Settings > API Keys."
          }
        ]
      },
      "instructionSteps": [
        {
          "title": "Connect Check Point Email Security to Microsoft Sentinel",
          "instructions": [
            {
              "type": "Markdown",
              "parameters": {
                "content": "To gather data from Check Point Email Security, you need to provide the following credentials:"
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**1. API Base URL** - The base URL for your Check Point Email Security tenant (region-specific)."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**2. Client ID** - Client ID of the Harmony Email & Collaboration API key (used for security events and exceptions)."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**3. Client Secret** - Secret (access key) of the Harmony Email & Collaboration API key."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**4. Audit Client ID** - Client ID of a separate **Logs as a Service** API key (used for audit logs)."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "**5. Audit Client Secret** - Secret (access key) of the Logs as a Service API key."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "To obtain these credentials, log in to your Check Point Infinity Portal and navigate to the **API Keys** section under **Global Settings**. Create one API key with the **Harmony Email & Collaboration** service for the Client ID/Secret, and a second API key with the **Logs as a Service** service for the Audit Client ID/Secret."
              }
            },
            {
              "type": "Markdown",
              "parameters": {
                "content": "> **Multi-tenant support:** This connector supports ingesting data from multiple Check Point Email Security tenants in parallel. Click **Add Connection** once per tenant, supplying that tenant's API Base URL and credentials - each connection is tracked and managed independently in the grid below."
              }
            },
            {
              "type": "DataConnectorsGrid",
              "parameters": {
                "mapping": [
                  {
                    "columnName": "API Base URL",
                    "columnValue": "properties.addOnAttributes.apiUrl"
                  },
                  {
                    "columnName": "Data Type",
                    "columnValue": "properties.dataType"
                  }
                ],
                "menuItems": [
                  "DeleteConnector"
                ]
              }
            },
            {
              "type": "ContextPane",
              "parameters": {
                "isPrimary": true,
                "label": "Add Connection",
                "title": "Configure Check Point Email Security API Connection",
                "subtitle": "Connect to Check Point Email Security to ingest security data",
                "contextPaneType": "DataConnectorsContextPane",
                "instructionSteps": [
                  {
                    "instructions": [
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "API Base URL",
                          "placeholder": "https://cloudinfra-gw.portal.checkpoint.com",
                          "type": "text",
                          "name": "apiUrl",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client ID",
                          "placeholder": "Your Client ID",
                          "type": "text",
                          "name": "clientId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Client Secret",
                          "placeholder": "Your Client Secret",
                          "type": "password",
                          "name": "clientSecret",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Audit Client ID",
                          "placeholder": "Your Logs as a Service Client ID",
                          "type": "text",
                          "name": "auditClientId",
                          "validations": {
                            "required": true
                          }
                        }
                      },
                      {
                        "type": "Textbox",
                        "parameters": {
                          "label": "Audit Client Secret",
                          "placeholder": "Your Logs as a Service Client Secret",
                          "type": "password",
                          "name": "auditClientSecret",
                          "validations": {
                            "required": true
                          }
                        }
                      }
                    ]
                  }
                ]
              }
            }
          ]
        }
      ],
      "isConnectivityCriteriasMatchSome": true
    }
  }
}