Checkpoint Avanan Threats

Checkpoint Harmony Email Threat Detection & Analysis

Overview

Checkpoint Harmony Email & Collaboration (Avanan) uses multiple detection engines to identify email-borne threats before they reach end users. The threat detection system covers phishing, malware, business email compromise (BEC), account takeover (ATO), and zero-day attacks. This skill covers threat types, detection engines, IOC extraction, timeline analysis, and investigation workflows.

Threat Types

| Type | Code | Description | Severity Range | |------|------|-------------|----------------| | Phishing | PHISHING | Credential harvesting via fake login pages or deceptive links | Medium - Critical | | Spear Phishing | SPEAR_PHISHING | Targeted phishing aimed at specific individuals | High - Critical | | Malware | MALWARE | Malicious attachments or drive-by download links | High - Critical | | Ransomware | RANSOMWARE | Ransomware payload in attachment or link | Critical | | BEC | BEC | Business email compromise / CEO fraud | High - Critical | | Account Takeover | ATO | Compromised internal account sending malicious email | Critical | | Zero-Day | ZERO_DAY | Previously unknown threat detected by sandbox | Critical | | Spam | SPAM | Unsolicited bulk email | Low | | Bulk | BULK | Marketing/newsletter content | Low | | DLP Violation | DLP | Outbound data loss prevention trigger | Medium - High |

Detection Engines

| Engine | Description | Threat Types Detected | |--------|-------------|----------------------| | Anti-Phishing | URL reputation, page similarity, brand impersonation | PHISHING, SPEAR_PHISHING | | Anti-Malware | Signature-based and heuristic file scanning | MALWARE, RANSOMWARE | | Sandbox | Dynamic analysis of attachments in isolated environment | MALWARE, RANSOMWARE, ZERO_DAY | | AI/ML Engine | Machine learning models for anomaly and impersonation detection | BEC, ATO, SPEAR_PHISHING | | URL Rewriting | Click-time URL scanning and rewriting | PHISHING, MALWARE | | DLP Engine | Content inspection against data loss policies | DLP | | Anti-Spam | Reputation and content-based spam filtering | SPAM, BULK |

Complete Threat Field Reference

Core Fields

| Field | Type | Description | |-------|------|-------------| | threatId | string | Unique threat identifier | | type | string | Threat type code (see table above) | | severity | string | CRITICAL, HIGH, MEDIUM, LOW | | confidenceScore | int | Detection confidence 0-100 | | detectedDate | datetime | When the threat was first detected | | detectionEngine | string | Which engine identified the threat | | status | string | DETECTED, QUARANTINED, REMEDIATED, FALSE_POSITIVE |

Email Context Fields

| Field | Type | Description | |-------|------|-------------| | messageId | string | Email message ID (RFC 5322) | | subject | string | Email subject line | | sender | string | Sender email address | | senderDisplayName | string | Sender display name | | senderIp | string | Originating IP address | | recipients | string[] | Target recipient addresses | | recipientCount | int | Number of recipients targeted | | direction | string | INBOUND, OUTBOUND, INTERNAL |

Indicator of Compromise (IOC) Fields

| Field | Type | Description | |-------|------|-------------| | urls | object[] | Malicious URLs found in email body/attachments | | urls[].url | string | The full URL | | urls[].verdict | string | MALICIOUS, SUSPICIOUS, CLEAN | | urls[].category | string | Phishing page, malware host, C2 server, etc. | | domains | string[] | Suspicious domains extracted from URLs and headers | | ipAddresses | string[] | IP addresses associated with the threat | | fileHashes | object[] | Hashes of malicious attachments | | fileHashes[].sha256 | string | SHA-256 hash | | fileHashes[].md5 | string | MD5 hash | | fileHashes[].fileName | string | Original filename | | fileHashes[].verdict | string | MALICIOUS, SUSPICIOUS, CLEAN |

Timeline Fields

| Field | Type | Description | |-------|------|-------------| | receivedDate | datetime | When email entered the mail system | | scannedDate | datetime | When scanning completed | | quarantinedDate | datetime | When email was quarantined (if applicable) | | remediatedDate | datetime | When threat was remediated | | reportedDate | datetime | When user reported (if user-reported) |

MCP Tools

| Tool | Description | Key Parameters | |------|-------------|----------------| | avanan_threats_list | List detected threats with filters | startDate, endDate, type, severity, status, limit, offset | | avanan_threats_get | Get detailed threat analysis | threatId | | avanan_threats_iocs | Extract IOCs from a threat | threatId, iocTypes | | avanan_threats_timeline | Get threat detection timeline | threatId | | avanan_threats_search | Search threats by various criteria | query, field, startDate, endDate, type | | avanan_threats_stats | Get threat statistics and trends | startDate, endDate, groupBy | | avanan_threats_mark_false_positive | Mark threat as false positive | threatId, reason |

Tool Usage Examples

List critical threats from last 24 hours:

{
  "tool": "avanan_threats_list",
  "parameters": {
    "startDate": "2024-02-14T00:00:00Z",
    "endDate": "2024-02-15T00:00:00Z",
    "severity": "CRITICAL",
    "status": "DETECTED",
    "limit": 50
  }
}

Extract IOCs from a threat:

{
  "tool": "avanan_threats_iocs",
  "parameters": {
    "threatId": "threat-abc123",
    "iocTypes": ["urls", "domains", "fileHashes", "ipAddresses"]
  }
}

Search for phishing threats targeting a specific user:

{
  "tool": "avanan_threats_search",
  "parameters": {
    "query": "cfo@company.com",
    "field": "recipients",
    "type": "PHISHING",
    "startDate": "2024-02-01T00:00:00Z"
  }
}

Threat Analysis Workflows

Phishing Investigation Workflow

1. Get threat details - Retrieve full threat record with IOCs
2. Analyze sender:
3. Check sender address vs display name mismatch
4. Look up sender domain age and reputation
5. Check SPF/DKIM/DMARC results
6. Analyze URLs:
7. Extract all URLs from body and attachments
8. Check URL reputation and redirect chains
9. Identify brand impersonation (login page similarity)
10. Check scope:
11. Search for same sender across all recipients
12. Identify how many users received the same campaign
13. Remediate:
14. Quarantine all related messages if not already quarantined
15. Add sender domain to block list if confirmed malicious
16. Notify affected users
17. Document - Create incident with findings and IOCs

BEC Investigation Workflow

1. Review impersonation indicators:
2. Display name matches executive but email address differs
3. Reply-to address differs from sender
4. Unusual urgency language or financial requests
5. Check sender authentication:
6. SPF, DKIM, DMARC results
7. Whether sender domain is a lookalike (typosquatting)
8. Analyze email content:
9. Wire transfer or gift card requests
10. Urgency indicators ("immediately", "today", "confidential")
11. Unusual sender behavior patterns
12. Check for account compromise:
13. Search for ATO indicators on the impersonated account
14. Review recent login activity and impossible travel
15. Remediate and report:
16. Block sender domain
17. Alert targeted recipients
18. Report to incident management

Malware Analysis Workflow

1. Get attachment details - File name, type, size, hashes
2. Check hash reputation - Look up SHA-256 in threat intelligence
3. Review sandbox results - Dynamic analysis behavior indicators
4. Extract IOCs:
5. C2 server addresses
6. Dropped file hashes
7. Registry modifications
8. Network connections
9. Assess blast radius:
10. How many users rece