Query entity.

​
Basic Parameters

ParameterDescription
Entity Filter Start DateLimits the search results to any entities created within the given start date range.
FilterFilter entities based on the specified query.
ScopesThe scopes for the request.

​
Advanced Parameters

ParameterDescription
Entity Filter End DateLimits the search results to any entities created within the given end date range.
Extended FilterFilter entities based on a specific SaaS attributes.Note: each filter object must have saasAttrName and saasAttrOp attributes.For example:[ { "saasAttrName": "entityPayload.internetMessageId", "saasAttrOp": "is", "saasAttrValue": "<value>" }, { "saasAttrName": "entityPayload.internetMessageId", "saasAttrOp": "isEmpty", }]For more information about the Extended Filter parameter, refer to CheckPoint Harmony API documentation.
Scroll IDThe scroll identifier used for pagination. This value is obtained from a previous action result in the scrollId field and allows you to retrieve the next set of results in a sequence.

​
Example Output

{
	"responseData": [
		{
			"entityActions": [],
			"entityAvailableActions": [],
			"entityInfo": {
				"customerId": "Customer Domain",
				"entityActionState": "",
				"entityCreated": "Entity Created",
				"entityId": "Entity Id",
				"entityUpdated": "Entityupdated",
				"saas": "Saas Id",
				"saasEntityType": "Entity Type"
			},
			"entityPayload": {
				"SpfResult": "",
				"attachmentCount": 0,
				"attachments": [],
				"bcc": [],
				"bccUser": [],
				"cc": [],
				"ccUser": [],
				"emailLinks": [],
				"fromDomain": "",
				"fromEmail": "",
				"fromName": "",
				"fromUser": {},
				"internetMessageId": "Internet Message Id",
				"isDeleted": false,
				"isIncoming": false,
				"isInternal": false,
				"isOutgoing": false,
				"isQuarantineNotification": false,
				"isQuarantined": false,
				"isRead": false,
				"isRestoreDeclined": false,
				"isRestoreRequested": false,
				"isRestored": false,
				"mode": "An enumeration.",
				"received": "Received",
				"recipients": [],
				"replyToEmail": "",
				"replyToNickname": "",
				"saasSpamVerdict": "Saas Spam Verdict",
				"size": 0,
				"subject": "Subject",
				"to": [],
				"toUser": []
			},
			"entitySecurityResult": {
				"ap": [
					{
						"entityId": "Entity Id",
						"entityType": "Entity Type",
						"payload": {},
						"score": "Score",
						"securityResultEntityId": "Security Result Entity Id",
						"securityResultEntityType": "Security Result Entity Type",
						"statusCode": "Status Code",
						"statusDescription": "Status Description",
						"verdict": "Verdict"
					}
				],
				"av": [
					{
						"entityId": "Entity Id",
						"entityType": "Entity Type",
						"payload": {},
						"score": "Score",
						"securityResultEntityId": "Security Result Entity Id",
						"securityResultEntityType": "Security Result Entity Type",
						"statusCode": "Status Code",
						"statusDescription": "Status Description",
						"verdict": "Verdict"
					}
				],
				"clicktimeProtection": [
					{
						"entityId": "Entity Id",
						"entityType": "Entity Type",
						"payload": {},
						"score": "Score",
						"securityResultEntityId": "Security Result Entity Id",
						"securityResultEntityType": "Security Result Entity Type",
						"statusCode": "Status Code",
						"statusDescription": "Status Description",
						"verdict": "Verdict"
					}
				],
				"combinedVerdict": {
					"ap": "Ap",
					"av": "Av",
					"clicktimeProtection": "Clicktime Protection",
					"dlp": "Dlp",
					"shadowIt": "Shadow It"
				},
				"dlp": [
					{
						"entityId": "Entity Id",
						"entityType": "Entity Type",
						"payload": {},
						"score": "Score",
						"securityResultEntityId": "Security Result Entity Id",
						"securityResultEntityType": "Security Result Entity Type",
						"statusCode": "Status Code",
						"statusDescription": "Status Description",
						"verdict": "Verdict"
					}
				],
				"shadowIt": [
					{
						"entityId": "Entity Id",
						"entityType": "Entity Type",
						"payload": {},
						"score": "Score",
						"securityResultEntityId": "Security Result Entity Id",
						"securityResultEntityType": "Security Result Entity Type",
						"statusCode": "Status Code",
						"statusDescription": "Status Description",
						"verdict": "Verdict"
					}
				]
			}
		}
	],
	"responseEnvelope": {
		"additionalText": "",
		"recordsNumber": 0,
		"requestId": "Requestid",
		"responseCode": 0,
		"responseText": "",
		"scrollId": "Scrollid"
	}
}

​
Workflow Library Example

Query Entity with Check Point Harmony and Send Results Via Email

Preview this Workflow on desktop