Checkpoint Harmony Email Quarantine Management

Overview

Checkpoint Harmony Email & Collaboration (Avanan) quarantines emails that match security policies before they reach the end user's inbox. The quarantine system is the primary interface for reviewing flagged emails, releasing false positives, and managing email flow. This skill covers comprehensive quarantine management including search, review, release workflows, bulk operations, and quarantine configuration.

Quarantine Reasons

Emails are quarantined based on the detection engine that flagged them:

Severity Mapping

Complete Quarantine Field Reference

Core Fields

Classification Fields

Content Fields

Status Fields

MCP Tools

Tool Usage Examples

List recent quarantined emails:

{
  "tool": "avanan_quarantine_list",
  "parameters": {
    "startDate": "2024-02-01T00:00:00Z",
    "endDate": "2024-02-15T23:59:59Z",
    "status": "QUARANTINED",
    "limit": 50
  }
}

Search by sender:

{
  "tool": "avanan_quarantine_search",
  "parameters": {
    "query": "suspicious@external-domain.com",
    "field": "sender",
    "startDate": "2024-02-01T00:00:00Z"
  }
}

Release with allow-list:

{
  "tool": "avanan_quarantine_release",
  "parameters": {
    "entityIds": ["qe-abc123", "qe-def456"],
    "releaseToRecipients": true,
    "addToAllowList": true
  }
}

Common Workflows

False Positive Review Workflow

1. User reports missing email - Check quarantine for the expected message
2. Search quarantine by sender address and date range
3. Review quarantine entry - Check reason, confidence, severity
4. Verify legitimacy:
   • Compare sender address vs display name (BEC indicator)
   • Check if sender is known/expected
   • Review attachment types and URL destinations
   • Check confidence level of detection
5. Release if legitimate:
   • Release to original recipients
   • Optionally add sender to allow list
   • Document the false positive for policy tuning
6. If suspicious - Escalate to incident investigation

Bulk Quarantine Review Workflow

1. List quarantined emails for the review period (e.g., last 24 hours)
2. Group by quarantine reason to prioritize review
3. Review SPAM/BULK first - highest false positive rate
4. Review POLICY matches - check if policy is too broad
5. Review PHISHING/BEC last - most likely true positives
6. Bulk release confirmed false positives
7. Bulk delete confirmed threats

Quarantine Expiry Management

Quarantined emails auto-delete after the configured retention period (default: 30 days).

Day 1-7:   Email in quarantine, available for review
Day 8-14:  Email still available, notification sent to admin
Day 15-30: Email nearing expiry
Day 30+:   Email permanently deleted

To extend retention: Release and re-quarantine, or export before expiry.

Error Handling

Common API Errors

Validation Errors

Best Practices

1. Review quarantine daily - Prevents legitimate emails from expiring undelivered
2. Start with low-severity items - SPAM/BULK have highest false positive rates
3. Never release MALWARE without investigation - Even if the user requests it