Skip to content

Check Point Harmony Mobile

Overview

Check Point Harmony Mobile is the industry's first unified security solution for users devices and access.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Network device logs Check Point can record traffic events flowing through their firewall.
Network protocol analysis Check Point firewall does traffic analysis at physical/data/transport layers
Web logs Domain names are extracted from HTTP traffic

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind alert
Category network
Type info

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": "{\"attack_vector\":\"NetworkSecurity\",\"backend_last_updated\":\"02/02/2025 02:22:20\",\"details\":\"Domain:bb[.]caf\u00e9\",\"device_id\":\"2\",\"device_rooted\":false,\"email\":\"Blocked\",\"event\":\"Info\",\"event_timestamp\":\"02/22/2023 02:22:20\",\"id\":22,\"mdm_uuid\":\"00000000-0000-0000-0000-0000000000\",\"name\":\"TestDevice\",\"number\":\"+13045555555\",\"severity\":\"Critical\",\"threat_factors\":\"Phishing\",\"device_model\":\"Android\",\"client_version\":\"2.73-SNAPSHOT/2,089\"}",
    "event": {
        "category": "network",
        "kind": "alert",
        "reason": "Domain:bb[.]caf\u00e9",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2023-02-22T02:22:20Z",
    "checkpoint": {
        "harmony": {
            "attack_vector": "NetworkSecurity",
            "mdm_uuid": "00000000-0000-0000-0000-0000000000",
            "number": "+13045555555",
            "threat_factors": "Phishing"
        }
    },
    "device": {
        "id": "2"
    },
    "host": {
        "os": {
            "type": "Android"
        }
    },
    "log": {
        "level": "Critical"
    }
}
{
    "message": "{\"attack_vector\":\"NetworkSecurity\",\"backend_last_updated\":\"02/02/2025 02:22:20\",\"details\":\"Domain:bb[.]caf\u00e9\",\"device_id\":\"2\",\"device_rooted\":false,\"email\":\"Blocked\",\"event\":\"Info\",\"id\":22,\"mdm_uuid\":\"00000000-0000-0000-0000-0000000000\",\"name\":\"TestDevice\",\"number\":\"+13045555555\",\"severity\":\"Critical\",\"threat_factors\":\"Phishing\",\"device_model\":\"Android\",\"client_version\":\"2.73-SNAPSHOT/2,089\"}",
    "event": {
        "category": "network",
        "kind": "alert",
        "reason": "Domain:bb[.]caf\u00e9",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2025-02-02T02:22:20Z",
    "checkpoint": {
        "harmony": {
            "attack_vector": "NetworkSecurity",
            "mdm_uuid": "00000000-0000-0000-0000-0000000000",
            "number": "+13045555555",
            "threat_factors": "Phishing"
        }
    },
    "device": {
        "id": "2"
    },
    "host": {
        "os": {
            "type": "Android"
        }
    },
    "log": {
        "level": "Critical"
    }
}
{
    "message": "{\"attack_vector\":\"NetworkSecurity\",\"details\":\"Domain:bb[.]caf\u00e9\",\"device_id\":\"2\",\"device_rooted\":false,\"email\":\"Blocked\",\"event\":\"Info\",\"event_timestamp\":\"02/22/2023 02:22:20\",\"id\":22,\"mdm_uuid\":\"00000000-0000-0000-0000-0000000000\",\"name\":\"TestDevice\",\"number\":\"+13045555555\",\"severity\":\"Critical\",\"threat_factors\":\"Phishing\",\"device_model\":\"Android\",\"client_version\":\"2.73-SNAPSHOT/2,089\"}",
    "event": {
        "category": "network",
        "kind": "alert",
        "reason": "Domain:bb[.]caf\u00e9",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2023-02-22T02:22:20Z",
    "checkpoint": {
        "harmony": {
            "attack_vector": "NetworkSecurity",
            "mdm_uuid": "00000000-0000-0000-0000-0000000000",
            "number": "+13045555555",
            "threat_factors": "Phishing"
        }
    },
    "device": {
        "id": "2"
    },
    "host": {
        "os": {
            "type": "Android"
        }
    },
    "log": {
        "level": "Critical"
    }
}
{
    "message": "{\"attack_vector\":\"NetworkSecurity\",\"details\":\"Domain:bb[.]caf\u00e9\",\"device_id\":\"2\",\"device_rooted\":false,\"email\":\"Blocked\",\"event\":\"Info\",\"id\":22,\"mdm_uuid\":\"00000000-0000-0000-0000-0000000000\",\"name\":\"TestDevice\",\"number\":\"+13045555555\",\"severity\":\"Critical\",\"threat_factors\":\"Phishing\",\"device_model\":\"Android\",\"client_version\":\"2.73-SNAPSHOT/2,089\"}",
    "event": {
        "category": "network",
        "kind": "alert",
        "reason": "Domain:bb[.]caf\u00e9",
        "type": [
            "info"
        ]
    },
    "checkpoint": {
        "harmony": {
            "attack_vector": "NetworkSecurity",
            "mdm_uuid": "00000000-0000-0000-0000-0000000000",
            "number": "+13045555555",
            "threat_factors": "Phishing"
        }
    },
    "device": {
        "id": "2"
    },
    "host": {
        "os": {
            "type": "Android"
        }
    },
    "log": {
        "level": "Critical"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
checkpoint.harmony.attack_vector keyword Check Point Harmony attack vector
checkpoint.harmony.mdm_uuid keyword Check Point Harmony MDM uuid
checkpoint.harmony.number keyword Check Point Harmony number
checkpoint.harmony.threat_factors keyword Check Point Harmony threat factors
event.category keyword Event category. The second categorization field in the hierarchy.
event.kind keyword The kind of the event. The highest categorization field in the hierarchy.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
host.os.type keyword Which commercial OS family (one of: linux, macos, unix or windows).
log.level keyword Log level of the log event.

Configure

Create authentication credentials

  1. Login to your Check Point Harmony account and navigate to Profile > Global Settings

    Global settings

  2. Go to API Keys and click on New

    API Keys

  3. Update required fields with next information and create API Key:

    • Service: Harmony Mobile (1)
    • Expiration: If you pass an empty field, it means that API Key will not expire until you delete it. (2)
    • Description: You can specify any description that you want. (3)
    • Roles: Read-Only

    API Key Form

  4. Copy values of Client ID, Secret Key and Authentication URL and save them for the configuration of the connector.

Create the intake

To create the intake, go to the intake page and create a new intake from the format Check Point Harmony Mobile.

Pull events

To start to pull events, you have to:

  1. Go to the playbooks page and create a new playbook with the Check Point Harmony Mobile trigger
  2. Set up the module configuration with the Client ID, Client Secret and Authentication URL.
  3. Set up the trigger configuration with the intake key
  4. Start the playbook and enjoy your events