skills.rest
mbadali25
mbadali25COMMUNITY
Explore all skills by this author →
WebsiteGitHub

checkpoint-email

Query, triage, and remediate email security events via the Check Point Email Security API.

2|Updated Jul 28, 2026
Search Tags:#api#triage#phishing#soc#quarantine#email security#check point
One-click install
npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill checkpoint-email-mbadali25
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: checkpoint-email
Source: https://github.com/mbadali25/useful-claude-add-ons/tree/main/skills/checkpoint-email
Command: npx skills add https://github.com/mbadali25/useful-claude-add-ons --skill checkpoint-email-mbadali25

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires requests, and includes scripts (resource) and references (resource) components.

What problem does it solve? Security teams managing Check Point Email Security (formerly Harmony Email & Collaboration / Avanan) need to search protected email entities, triage phishing/malware/DLP detections, and remediate threats without manually navigating the portal or hand-writing REST calls with token auth, regional hosts, and pagination. ## Core Features & Use Cases - Entity and event search: Query email entities by sender, subject, or attachments and security events by type, severity, or state, with automatic scrollId pagination. - Safe remediation: Quarantine, restore, dismiss, or change severity with a mandatory dry-run gate that resolves and displays each target before any mutating call executes. - Full auth handling: Manages Infinity Portal token auth, regional CloudInfra host resolution, the required x-av-req-id header, 429/401 retries, and async task polling. - Use Case: A SOC analyst investigating a phishing campaign searches events of type phishing with High severity from the past week, reviews the resolved target list in dry-run mode, then confirms quarantine of the malicious emails. ## Quick Start Set the CHECKPOINT_EMAIL_CLIENT_ID and CHECKPOINT_EMAIL_ACCESS_KEY environment variables, then ask the assistant to run the check command against your Check Point email tenant to verify authentication and access.

Frequently Asked Questions about checkpoint-email

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I quarantine an email using the Check Point Email Security API?▼

Use the action-entity command with the quarantine action and target entity IDs. It runs as a dry-run by default, showing each resolved target's sender and subject; add the --confirm flag to actually execute the quarantine via POST /action/entity.

How do I search Check Point email security events by severity?▼

Use the search-events command with a required ISO 8601 start date plus filters like --type phishing and --severity High. The client posts to /event/query and auto-paginates through results using the scrollId returned in the response envelope.

Why do I get a 401 error from the Check Point email API?▼

A 401 on /auth/external usually means wrong credentials or a region mismatch, since API keys are region-specific and only work against their own CloudInfra host. A 401 after a valid token means the token expired; the helper refreshes and retries automatically.

Does the Check Point Email Security API work across regions?▼

No, regions are fully isolated. Credentials and data never cross regions, so a US key only works against cloudinfra-gw-us.portal.checkpoint.com. Set CHECKPOINT_EMAIL_REGION or use --region to match the region where the API key was created.

What is the difference between an entity and a security event in Check Point email?▼

An entity is the protected object itself, such as an email message, while a security event is a detection about that entity, like a phishing verdict. Quarantining the entity removes the mail; acting on the event changes triage state such as dismiss or severity.

What are the rate limits for Check Point email API exceptions?▼

Anti-Phishing exception endpoints are limited to roughly 1 request per second, while other exception types allow about 10 requests per second. On a 429 response, honor the Retry-After header and back off; the helper client handles this retry logic automatically.

Related Skills

Explore More Software Engineering Skills→
rezosndrezosnd

environment-secrets

View, set, delete, and request environment variables and secrets across scopes.

Community
Intermediate
xalgordxalgord
954

building-incident-response-dashboard

Builds real-time incident response dashboards in Splunk, Elastic, or Grafana for SOC coordination.

Community
Intermediate
xalgordxalgord
954

analyzing-indicators-of-compromise

Enriches IOCs with multi-source threat intelligence to assign confidence scores and blocking dispositions.

Community
Intermediate
wyre-technologywyre-technology
39

Mailboxes

Manage Microsoft 365 mailboxes and mail flow via the Microsoft Graph API.

Official
Intermediate