Query entity.

​
Basic Parameters

ParameterDescription
Entity Filter Start DateLimits the search results to any entities created within the given start date range.
FilterFilter entities based on the specified query.
ScopesThe scopes for the request.

​
Advanced Parameters

ParameterDescription
Entity Filter End DateLimits the search results to any entities created within the given end date range.
Extended FilterFilter entities based on a specific SaaS attributes.

Note: each filter object must have saasAttrName and saasAttrOp attributes.

For example:

[
{
"saasAttrName": "entityPayload.internetMessageId",
"saasAttrOp": "is",
"saasAttrValue": "<value>"
},
{
"saasAttrName": "entityPayload.internetMessageId",
"saasAttrOp": "isEmpty",
}
]

For more information about the Extended Filter parameter, refer to CheckPoint Harmony API documentation.
Scroll IDThe scroll identifier used for pagination. This value is obtained from a previous action result in the scrollId field and allows you to retrieve the next set of results in a sequence.

​
Example Output

{
	"responseEnvelope": {
		"requestId": "<string>",
		"responseCode": 166,
		"responseText": "<string>",
		"additionalText": "<string>",
		"recordsNumber": 244,
		"scrollId": "<string>"
	},
	"responseData": [
		{
			"entityInfo": {
				"entityId": "<string>",
				"customerId": "<string>",
				"saas": "<string>",
				"saasEntityType": "<string>",
				"entityCreated": "<string>",
				"entityUpdated": "<string>",
				"entityActionState": null
			},
			"entityPayload": {
				"internetMessageId": "<string>",
				"subject": "<string>",
				"received": "<string>",
				"size": null,
				"emailLinks": [
					"<string>",
					"<string>"
				],
				"emailLinksDomains": [
					"<string>"
				],
				"attachmentCount": 1,
				"attachments": [],
				"mode": "<string>",
				"recipients": [
					"<string>"
				],
				"fromEmail": "<string>",
				"fromDomain": "<string>",
				"fromUser": {},
				"fromName": "<string>",
				"to": [
					"<string>"
				],
				"toUser": [],
				"cc": null,
				"ccUser": [],
				"bcc": null,
				"bccUser": [],
				"replyToEmail": "<string>",
				"replyToNickname": "<string>",
				"isRead": null,
				"isDeleted": false,
				"isIncoming": true,
				"isInternal": false,
				"isOutgoing": false,
				"isQuarantined": false,
				"isQuarantineNotification": false,
				"isQuarantineUserNotification": false,
				"isRestored": false,
				"isRestoreRequested": false,
				"isRestoreDeclined": false,
				"saasSpamVerdict": "<string>",
				"SpfResult": "<string>",
				"restoreRequestTime": null,
				"restoreCommentary": null,
				"senderServerIp": "<string>",
				"senderClientIp": null,
				"isUserExposed": true
			},
			"entitySecurityResult": {
				"combinedVerdict": {
					"ap": "<string>",
					"dlp": null,
					"clicktimeProtection": null,
					"shadowIt": "<string>",
					"av": null
				},
				"ap": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"reasons": [],
							"reasons_by_category": {
								"Email Headers": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Domain Impersonation": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Sender Reputation": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Links": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								],
								"Email Text": [
									{
										"short_text": "<string>",
										"full_text": "<string>"
									},
									{
										"short_text": "<string>",
										"full_text": "<string>"
									}
								]
							},
							"reasons_by_category_list": [
								"<string>",
								"<string>"
							]
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": null,
						"verdict": "<string>"
					}
				],
				"dlp": null,
				"clicktimeProtection": null,
				"shadowIt": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"from": "<string>",
							"to": "<string>",
							"subject": "<string>",
							"domain": "<string>"
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": "<string>",
						"verdict": "<string>"
					}
				],
				"av": null
			},
			"entityActions": [],
			"entityAvailableActions": []
		},
		{
			"entityInfo": {
				"entityId": "<string>",
				"customerId": "<string>",
				"saas": "<string>",
				"saasEntityType": "<string>",
				"entityCreated": "<string>",
				"entityUpdated": "<string>",
				"entityActionState": null
			},
			"entityPayload": {
				"internetMessageId": "<string>",
				"subject": "<string>",
				"received": "<string>",
				"size": null,
				"emailLinks": [
					"<string>",
					"<string>"
				],
				"emailLinksDomains": [
					"<string>",
					"<string>"
				],
				"attachmentCount": 1,
				"attachments": [
					{
						"name": "<string>",
						"mimetype": "<string>",
						"size": 1329,
						"MD5": "<string>"
					}
				],
				"mode": "<string>",
				"recipients": [
					"<string>"
				],
				"fromEmail": "<string>",
				"fromDomain": "<string>",
				"fromUser": {},
				"fromName": "<string>",
				"to": [
					"<string>"
				],
				"toUser": [],
				"cc": null,
				"ccUser": [],
				"bcc": null,
				"bccUser": [],
				"replyToEmail": "<string>",
				"replyToNickname": "<string>",
				"isRead": null,
				"isDeleted": false,
				"isIncoming": false,
				"isInternal": true,
				"isOutgoing": false,
				"isQuarantined": false,
				"isQuarantineNotification": false,
				"isQuarantineUserNotification": false,
				"isRestored": false,
				"isRestoreRequested": false,
				"isRestoreDeclined": false,
				"saasSpamVerdict": "<string>",
				"SpfResult": "<string>",
				"restoreRequestTime": null,
				"restoreCommentary": null,
				"senderServerIp": "<string>",
				"senderClientIp": null,
				"isUserExposed": true
			},
			"entitySecurityResult": {
				"combinedVerdict": {
					"ap": "<string>",
					"dlp": null,
					"clicktimeProtection": null,
					"shadowIt": null,
					"av": "<string>"
				},
				"ap": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"reasons": [],
							"reasons_by_category": {},
							"reasons_by_category_list": []
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": null,
						"verdict": "<string>"
					}
				],
				"dlp": null,
				"clicktimeProtection": null,
				"shadowIt": null,
				"av": [
					{
						"entityId": "<string>",
						"entityType": "<string>",
						"payload": {
							"scan_details": []
						},
						"score": "<string>",
						"securityResultEntityId": "<string>",
						"securityResultEntityType": "<string>",
						"statusCode": "<string>",
						"statusDescription": "<string>",
						"verdict": "<string>"
					}
				]
			},
			"entityActions": [],
			"entityAvailableActions": []
		}
	]
}

​
Workflow Library Example

Query Entity with Check Point Harmony and Send Results Via Email

Preview this Workflow on desktop