Check Point Harmony Email Security
You can integrate Check Point Harmony Email Security with Sophos XDR so that it sends data to Sophos for analysis.
This page gives you an overview of the integration.
Check Point Harmony Email Security product overview
Check Point Harmony Email Security (formerly Avanan) is an AI-powered, API-based email and collaboration security service. It protects cloud email and collaboration platforms such as Microsoft 365, Gmail, Microsoft Teams, SharePoint, OneDrive, and Slack against phishing, malware, and business email compromise, using Check Point's ThreatCloud threat intelligence.
What we ingest
Sophos XDR collects Check Point Harmony Email Security events through the HTTP Ingest endpoint, where Harmony Email forwards its events in Splunk HTTP Event Collector (HEC) format. The following log categories are collected:
- Email events: Security events for the email and collaboration messages Harmony Email processes.
- Threat detections: Phishing, malware, and business email compromise detections Harmony Email raises.
Event and data types
We ingest the following event and data types from Check Point Harmony Email Security:
- Email events: Records for the messages Harmony Email processes, including sender and recipient, subject, and disposition. Normalized to email telemetry.
- Threat detections: Security detections Harmony Email raises on malicious email and collaboration activity. Normalized to third-party security alert telemetry.
Data provided by this integration
Data provided by Check Point Harmony Email Security gets normalized to the following schemas:
emailthirdpartyalert
For more information about using schemas in Data Lake Search, see Schemas and logical types.