Get entity based on the specified Entity ID.

Parameters

ParameterDescription
Entity IDThe ID of the entity. Can be obtained via the Query Entity action.
ScopesThe scopes for the request.

Example Output

{
	"responseEnvelope": {
		"requestId": "<string>",
		"responseCode": 95,
		"responseText": "<string>",
		"additionalText": "<string>",
		"recordsNumber": 0,
		"scrollId": "<string>"
	},
	"responseData": [
		{
			"entityInfo": {
				"entityId": "<string>",
				"customerId": "<string>",
				"saas": "<string>",
				"saasEntityType": "<string>",
				"entityCreated": "2025-03-28T06:22:38.970236Z",
				"entityUpdated": "2025-03-28T06:22:55.100377Z",
				"entityActionState": null
			},
			"entityPayload": {
				"internetMessageId": "<string>",
				"subject": "<string>",
				"received": "2025-03-28T06:22:38.923510Z",
				"size": null,
				"emailLinks": [
					"<string>",
					"<string>"
				],
				"emailLinksDomains": [
					"<string>",
					"<string>"
				],
				"attachmentCount": 0,
				"attachments": [],
				"mode": "<string>",
				"recipients": [
					"<string>"
				],
				"fromEmail": "<string>",
				"fromDomain": "<string>",
				"fromUser": {},
				"fromName": "<string>",
				"to": [
					"<string>"
				],
				"toUser": [],
				"cc": null,
				"ccUser": [],
				"bcc": null,
				"bccUser": [],
				"replyToEmail": null,
				"replyToNickname": null,
				"isRead": false,
				"isDeleted": true,
				"isIncoming": true,
				"isInternal": false,
				"isOutgoing": false,
				"isQuarantined": false,
				"isQuarantineNotification": false,
				"isQuarantineUserNotification": false,
				"isRestored": true,
				"isRestoreRequested": false,
				"isRestoreDeclined": false,
				"saasSpamVerdict": "<string>",
				"SpfResult": "<string>",
				"restoreRequestTime": null,
				"restoreCommentary": null,
				"senderServerIp": "<string>",
				"senderClientIp": null,
				"isUserExposed": true
			},
			"entitySecurityResult": {
				"combinedVerdict": {
					"ap": "<string>",
					"dlp": null,
					"clicktimeProtection": null,
					"shadowIt": "<string>",
					"av": null
				},
				"ap": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"reasons": [
								"<string>",
								"<string>"
							],
							"reasons_by_category": {
								"Machine Learning summary": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Email Headers": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Sender Reputation": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Links": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Attack Analysis": [
									{
										"name_text": "<string>",
										"short_text": "<string>",
										"full_text": "<string>"
									}
								]
							},
							"reasons_by_category_list": [
								"<string>",
								"<string>"
							],
							"probability_level": "<string>"
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": null,
						"verdict": "<string>"
					}
				],
				"dlp": null,
				"clicktimeProtection": null,
				"shadowIt": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"from": "<string>",
							"to": "<string>",
							"subject": "<string>",
							"domain": "<string>"
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": "<string>",
						"verdict": "<string>"
					}
				],
				"av": null
			},
			"entityActions": [],
			"entityAvailableActions": []
		}
	]
}

Workflow Library Example

Get Entity with Check Point Harmony and Send Results Via Email

Preview this Workflow on desktop

Get entity based on the specified Entity ID.

Parameters

ParameterDescription
Entity IDThe ID of the entity. Can be obtained via the Query Entity action.
ScopesThe scopes for the request.

Example Output

{
	"responseEnvelope": {
		"requestId": "<string>",
		"responseCode": 95,
		"responseText": "<string>",
		"additionalText": "<string>",
		"recordsNumber": 0,
		"scrollId": "<string>"
	},
	"responseData": [
		{
			"entityInfo": {
				"entityId": "<string>",
				"customerId": "<string>",
				"saas": "<string>",
				"saasEntityType": "<string>",
				"entityCreated": "2025-03-28T06:22:38.970236Z",
				"entityUpdated": "2025-03-28T06:22:55.100377Z",
				"entityActionState": null
			},
			"entityPayload": {
				"internetMessageId": "<string>",
				"subject": "<string>",
				"received": "2025-03-28T06:22:38.923510Z",
				"size": null,
				"emailLinks": [
					"<string>",
					"<string>"
				],
				"emailLinksDomains": [
					"<string>",
					"<string>"
				],
				"attachmentCount": 0,
				"attachments": [],
				"mode": "<string>",
				"recipients": [
					"<string>"
				],
				"fromEmail": "<string>",
				"fromDomain": "<string>",
				"fromUser": {},
				"fromName": "<string>",
				"to": [
					"<string>"
				],
				"toUser": [],
				"cc": null,
				"ccUser": [],
				"bcc": null,
				"bccUser": [],
				"replyToEmail": null,
				"replyToNickname": null,
				"isRead": false,
				"isDeleted": true,
				"isIncoming": true,
				"isInternal": false,
				"isOutgoing": false,
				"isQuarantined": false,
				"isQuarantineNotification": false,
				"isQuarantineUserNotification": false,
				"isRestored": true,
				"isRestoreRequested": false,
				"isRestoreDeclined": false,
				"saasSpamVerdict": "<string>",
				"SpfResult": "<string>",
				"restoreRequestTime": null,
				"restoreCommentary": null,
				"senderServerIp": "<string>",
				"senderClientIp": null,
				"isUserExposed": true
			},
			"entitySecurityResult": {
				"combinedVerdict": {
					"ap": "<string>",
					"dlp": null,
					"clicktimeProtection": null,
					"shadowIt": "<string>",
					"av": null
				},
				"ap": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"reasons": [
								"<string>",
								"<string>"
							],
							"reasons_by_category": {
								"Machine Learning summary": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Email Headers": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Sender Reputation": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Links": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Attack Analysis": [
									{
										"name_text": "<string>",
										"short_text": "<string>",
										"full_text": "<string>"
									}
								]
							},
							"reasons_by_category_list": [
								"<string>",
								"<string>"
							],
							"probability_level": "<string>"
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": null,
						"verdict": "<string>"
					}
				],
				"dlp": null,
				"clicktimeProtection": null,
				"shadowIt": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"from": "<string>",
							"to": "<string>",
							"subject": "<string>",
							"domain": "<string>"
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": "<string>",
						"verdict": "<string>"
					}
				],
				"av": null
			},
			"entityActions": [],
			"entityAvailableActions": []
		}
	]
}

Workflow Library Example

Get Entity with Check Point Harmony and Send Results Via Email

Preview this Workflow on desktop