Checkpoint Harmony Email Policy Management

Overview

Checkpoint Harmony Email & Collaboration (Avanan) uses a layered policy engine to detect and respond to email threats. Policies define what gets scanned, how threats are classified, and what actions are taken when threats are detected. This skill covers policy types, configuration, enable/disable workflows, and best practices for policy tuning across managed customer tenants.

Policy Types

Policy Actions

Policy Scope

Policies can be scoped to different levels:

Complete Policy Field Reference

Core Fields

Configuration Fields

Anti-Phishing Specific Fields

Anti-Malware Specific Fields

DLP Specific Fields

MCP Tools

Tool Usage Examples

List all enabled anti-phishing policies:

{
  "tool": "avanan_policies_list",
  "parameters": {
    "type": "ANTI_PHISHING",
    "enabled": true
  }
}

Disable a policy with reason:

{
  "tool": "avanan_policies_disable",
  "parameters": {
    "policyId": "pol-abc123",
    "reason": "Generating excessive false positives on partner domain emails"
  }
}

Add sender to allow list:

{
  "tool": "avanan_allow_list_add",
  "parameters": {
    "type": "sender",
    "value": "noreply@trusted-partner.com",
    "reason": "Legitimate automated notifications from billing system"
  }
}

Common Workflows

Policy Audit Workflow

1. List all policies - Get complete policy inventory
2. Review enabled policies - Ensure baseline policies are active
3. Check policy priority order - Higher priority policies evaluate first
4. Review exceptions - Ensure allow/block lists are current
5. Check policy coverage:
   • Anti-phishing enabled for all inbound
   • Anti-malware enabled for all directions
   • DLP enabled for outbound
   • ATO protection enabled for internal
6. Document gaps - Identify missing or misconfigured policies

Policy Tuning Workflow (Reducing False Positives)

1. Identify high-FP policies - Check quarantine stats by policy
2. Review triggered items - Sample recent quarantine entries for the policy
3. Analyze patterns:
   • Are specific senders repeatedly triggering?
   • Is a specific rule too broad?
   • Are legitimate email patterns being caught?
4. Adjust policy:
   • Add specific sender/domain exceptions (prefer narrow exceptions)
   • Adjust sensitivity thresholds
   • Modify action from QUARANTINE to DELIVER_WARN if appropriate
5. Monitor results - Track FP rate after changes

Enable/Disable Policy Workflow

Enabling a policy:

1. Review policy configuration before enabling
2. Consider starting with LOG action to assess impact
3. Enable the policy
4. Monitor quarantine volume for 24-48 hours
5. Adj