> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Check Point Harmony

> Connect ThreatAware to Check Point Harmony to monitor endpoint protection and compliance

## Overview

The Check Point Harmony integration enables ThreatAware to collect data from your Check Point Harmony environment, providing visibility into endpoint protection status and security posture across your organisation.

<Info>
  **Connection Method**: API
  **Setup Time**: 20 minutes
  **Access Required**: Check Point Administrator account
</Info>

## Data collected

The Check Point Harmony integration provides:

* Endpoint protection status
* Compliance and policy status
* Device inventory from Harmony
* Security event data

## Use cases

<CardGroup cols={2}>
  <Card title="Endpoint Protection Monitoring" icon="shield-halved">
    Track Check Point protection status across all managed endpoints
  </Card>

  <Card title="Compliance Tracking" icon="clipboard-check">
    Monitor compliance status and policy adherence across your environment
  </Card>

  <Card title="Security Posture Assessment" icon="eye">
    Validate that Harmony controls are properly configured
  </Card>

  <Card title="Audit Support" icon="file-contract">
    Generate reports showing endpoint protection coverage
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to Check Point Harmony">
    Access the [Check Point Harmony Portal](https://portal.checkpoint.com) using an account with administrator privileges.
  </Step>

  <Step title="Enable API Access">
    Navigate to **Settings** or **Manage & Settings** in the Harmony console.

    * Find **API Access** and ensure it is enabled
    * (Optional) Configure IP whitelisting to restrict API access to specific IP addresses for enhanced security
  </Step>

  <Step title="Create an API User">
    Go to **User Management** > **API Users** in the Harmony console.

    * Click **Add User** to create a new API user
    * Enter a descriptive username (e.g., `threataware-api`)
    * Assign a secure password
    * Set permissions to **Read-Only** unless higher access is required

    <Warning>
      Only grant the minimum permissions necessary. Read-only access is recommended for ThreatAware integration.
    </Warning>
  </Step>

  <Step title="Copy API Credentials">
    Note the following details from the API user you created:

    * **Username**: The API user name
    * **Password**: The password you assigned
  </Step>

  <Step title="Enter Credentials in ThreatAware">
    In ThreatAware, navigate to **Settings** > **Integrations**.

    * Search for and select **Check Point Harmony**
    * Enter the required credentials:
      * **Username**: API user name
      * **Password**: API user password
      * **API Endpoint URL**: Your Harmony instance URL (e.g., `https://your-harmony-instance.checkpoint.com`)

    <Tip>
      You can find your Harmony instance URL in the portal address bar or in your Harmony documentation.
    </Tip>
  </Step>

  <Step title="Connect and Verify">
    Click **Connect** to establish the integration.

    Verify the connection status shows **Active** in ThreatAware before proceeding.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Username" icon="user">
    **Field Name**: Check Point API Username
    **Type**: String
    **Description**: The username for the API user created in Check Point Harmony

    Example: `threataware-api` or `svc_threataware`
  </Accordion>

  <Accordion title="Password" icon="lock">
    **Field Name**: Check Point API Password
    **Type**: Password (encrypted)
    **Description**: The password associated with the Check Point Harmony API user

    <Tip>
      Store this credential securely in your organisation's password manager for future reference.
    </Tip>
  </Accordion>

  <Accordion title="API Endpoint URL" icon="server">
    **Field Name**: Check Point API URL
    **Type**: String
    **Description**: The URL of your Check Point Harmony instance

    **Format**: `https://your-harmony-instance.checkpoint.com`
    **Example**: `https://harmony.acme.com` or `https://checkpoint.company.net`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the Check Point Harmony integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 60 minutes for the initial data sync
   * Search for a known device in ThreatAware
   * Verify Check Point Harmony data appears in the device details

3. **Test Queries**
   * Create a test query to filter devices with Harmony protection status
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Username** and **Password** are entered correctly
    * Ensure API access is enabled in the Harmony console
    * Check that the API user account is not locked or expired
    * Confirm the password was entered without extra spaces
    * Test the credentials in the Check Point console directly
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the **API Endpoint URL** is correct and accessible
    * Check firewall rules allow outbound HTTPS (443) to your Harmony instance
    * Test the URL in a browser to ensure it's reachable
    * Verify the Harmony instance is online and responding
  </Accordion>

  <Accordion title="Access Denied" icon="ban">
    **Symptoms**: Integration connects but returns permission denied errors

    **Solutions**:

    * Verify the API user has read access to required resources
    * Check if IP whitelisting is configured and includes your ThreatAware instance
    * Review the [Check Point API Documentation](https://sc1.checkpoint.com/documents/) for required permissions
    * Ensure the user has permissions across all required endpoints
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no Harmony data appears

    **Solutions**:

    * Verify there is endpoint data in Harmony to collect
    * Check the API user permissions for data access
    * Verify devices from Harmony are syncing to ThreatAware
    * Review ThreatAware integration logs for errors
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="Check Point API Documentation" icon="book" href="https://sc1.checkpoint.com/documents/">
    Official Check Point documentation for API configuration and permissions
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated service account specifically for ThreatAware
  * Store credentials securely in your organisation's password manager
  * Rotate API credentials annually or per your security policy
  * Monitor for authentication failures in ThreatAware logs
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read-only permissions (never write access)
  * Configure IP whitelisting to restrict API access
  * Review Check Point audit logs periodically to monitor API usage
  * Follow your organisation's least privilege principles
</Tip>