Basic Parameters
| Parameter | Description |
|---|---|
| Entity Filter Start Date | Limits the search results to any entities created within the given start date range. |
| Filter | Filter entities based on the specified query. |
| Scopes | The scopes for the request. |
Advanced Parameters
| Parameter | Description |
|---|---|
| Entity Filter End Date | Limits the search results to any entities created within the given end date range. |
| Extended Filter | Filter entities based on a specific SaaS attributes. Note: each filter object must have saasAttrName and saasAttrOp attributes.For example: Extended Filter parameter, refer to CheckPoint Harmony API documentation. |
| Scroll ID | The scroll identifier used for pagination. This value is obtained from a previous action result in the scrollId field and allows you to retrieve the next set of results in a sequence. |
Example Output
{
"responseEnvelope": {
"requestId": "<string>",
"responseCode": 166,
"responseText": "<string>",
"additionalText": "<string>",
"recordsNumber": 244,
"scrollId": "<string>"
},
"responseData": [
{
"entityInfo": {
"entityId": "<string>",
"customerId": "<string>",
"saas": "<string>",
"saasEntityType": "<string>",
"entityCreated": "<string>",
"entityUpdated": "<string>",
"entityActionState": null
},
"entityPayload": {
"internetMessageId": "<string>",
"subject": "<string>",
"received": "<string>",
"size": null,
"emailLinks": [
"<string>",
"<string>"
],
"emailLinksDomains": [
"<string>"
],
"attachmentCount": 1,
"attachments": [],
"mode": "<string>",
"recipients": [
"<string>"
],
"fromEmail": "<string>",
"fromDomain": "<string>",
"fromUser": {},
"fromName": "<string>",
"to": [
"<string>"
],
"toUser": [],
"cc": null,
"ccUser": [],
"bcc": null,
"bccUser": [],
"replyToEmail": "<string>",
"replyToNickname": "<string>",
"isRead": null,
"isDeleted": false,
"isIncoming": true,
"isInternal": false,
"isOutgoing": false,
"isQuarantined": false,
"isQuarantineNotification": false,
"isQuarantineUserNotification": false,
"isRestored": false,
"isRestoreRequested": false,
"isRestoreDeclined": false,
"saasSpamVerdict": "<string>",
"SpfResult": "<string>",
"restoreRequestTime": null,
"restoreCommentary": null,
"senderServerIp": "<string>",
"senderClientIp": null,
"isUserExposed": true
},
"entitySecurityResult": {
"combinedVerdict": {
"ap": "<string>",
"dlp": null,
"clicktimeProtection": null,
"shadowIt": "<string>",
"av": null
},
"ap": [
{
"entityId": "<string>",
"entityType": "<string>",
"payload": {
"reasons": [],
"reasons_by_category": {
"Email Headers": [
{
"short_text": "<string>",
"full_text": "<string>"
},
{
"short_text": "<string>",
"full_text": "<string>"
}
],
"Domain Impersonation": [
{
"short_text": "<string>",
"full_text": "<string>"
}
],
"Sender Reputation": [
{
"short_text": "<string>",
"full_text": "<string>"
},
{
"short_text": "<string>",
"full_text": "<string>"
}
],
"Links": [
{
"short_text": "<string>",
"full_text": "<string>"
}
],
"Email Text": [
{
"short_text": "<string>",
"full_text": "<string>"
},
{
"short_text": "<string>",
"full_text": "<string>"
}
]
},
"reasons_by_category_list": [
"<string>",
"<string>"
]
},
"score": "<string>",
"securityResultEntityId": "<string>",
"securityResultEntityType": "<string>",
"statusCode": "<string>",
"statusDescription": null,
"verdict": "<string>"
}
],
"dlp": null,
"clicktimeProtection": null,
"shadowIt": [
{
"entityId": "<string>",
"entityType": "<string>",
"payload": {
"from": "<string>",
"to": "<string>",
"subject": "<string>",
"domain": "<string>"
},
"score": "<string>",
"securityResultEntityId": "<string>",
"securityResultEntityType": "<string>",
"statusCode": "<string>",
"statusDescription": "<string>",
"verdict": "<string>"
}
],
"av": null
},
"entityActions": [],
"entityAvailableActions": []
},
{
"entityInfo": {
"entityId": "<string>",
"customerId": "<string>",
"saas": "<string>",
"saasEntityType": "<string>",
"entityCreated": "<string>",
"entityUpdated": "<string>",
"entityActionState": null
},
"entityPayload": {
"internetMessageId": "<string>",
"subject": "<string>",
"received": "<string>",
"size": null,
"emailLinks": [
"<string>",
"<string>"
],
"emailLinksDomains": [
"<string>",
"<string>"
],
"attachmentCount": 1,
"attachments": [
{
"name": "<string>",
"mimetype": "<string>",
"size": 1329,
"MD5": "<string>"
}
],
"mode": "<string>",
"recipients": [
"<string>"
],
"fromEmail": "<string>",
"fromDomain": "<string>",
"fromUser": {},
"fromName": "<string>",
"to": [
"<string>"
],
"toUser": [],
"cc": null,
"ccUser": [],
"bcc": null,
"bccUser": [],
"replyToEmail": "<string>",
"replyToNickname": "<string>",
"isRead": null,
"isDeleted": false,
"isIncoming": false,
"isInternal": true,
"isOutgoing": false,
"isQuarantined": false,
"isQuarantineNotification": false,
"isQuarantineUserNotification": false,
"isRestored": false,
"isRestoreRequested": false,
"isRestoreDeclined": false,
"saasSpamVerdict": "<string>",
"SpfResult": "<string>",
"restoreRequestTime": null,
"restoreCommentary": null,
"senderServerIp": "<string>",
"senderClientIp": null,
"isUserExposed": true
},
"entitySecurityResult": {
"combinedVerdict": {
"ap": "<string>",
"dlp": null,
"clicktimeProtection": null,
"shadowIt": null,
"av": "<string>"
},
"ap": [
{
"entityId": "<string>",
"entityType": "<string>",
"payload": {
"reasons": [],
"reasons_by_category": {},
"reasons_by_category_list": []
},
"score": "<string>",
"securityResultEntityId": "<string>",
"securityResultEntityType": "<string>",
"statusCode": "<string>",
"statusDescription": null,
"verdict": "<string>"
}
],
"dlp": null,
"clicktimeProtection": null,
"shadowIt": null,
"av": [
{
"entityId": "<string>",
"entityType": "<string>",
"payload": {
"scan_details": []
},
"score": "<string>",
"securityResultEntityId": "<string>",
"securityResultEntityType": "<string>",
"statusCode": "<string>",
"statusDescription": "<string>",
"verdict": "<string>"
}
]
},
"entityActions": [],
"entityAvailableActions": []
}
]
}
Workflow Library Example
Query Entity with Check Point Harmony and Send Results Via Email