Query Checkpoint Harmony Email security events (phishing, malware, DLP, anomaly, shadow IT, etc.). Supports filtering by type, state, severity, date range, and SaaS platform. Returns events with available remediation actions.

Get full details for a specific security event by ID.

Search email and SaaS entities in Checkpoint Harmony Email. Filter by sender, recipient, subject, SaaS platform, and date range. Use extended filters for precise attribute matching (contains, startsWith, isEmpty, etc.).

Get full details for a specific email entity by its entity ID.

⚠ HIGH-IMPACT. Quarantine one or more security events by event ID. Quarantining is reversible via restore but affects user access to events. Returns task IDs to track progress. Confirm with the user before invoking.

Restore one or more previously quarantined events by event ID. Returns task IDs to track progress.

⚠ HIGH-IMPACT. Quarantine specific email entities by entity ID. Quarantining is reversible via restore but affects user access to emails. Returns task IDs to track progress. Confirm with the user before invoking.

Restore specific quarantined email entities by entity ID.

Check the status of an action task (quarantine/restore). Use the taskId returned by quarantine or restore tools.

List whitelist or blacklist entries in Checkpoint Harmony Email.

Add an entry to the whitelist or blacklist. At least one match field (senderEmail, senderDomain, subject, attachmentMd5, recipient) must be provided.

Update an existing whitelist or blacklist entry by its entity ID.

⚠ DESTRUCTIVE — IRREVERSIBLE. Delete a whitelist or blacklist entry by its entity ID. This action cannot be undone and will permanently remove the exception from security policy. Confirm with the user before invoking.