Checkpoint Avanan Threats git:20260728.b7e78fcA

Immutable. This exact content never changes and is served at /api/v1/blob/e2574d27705de870.

---
name: "Checkpoint Avanan Threats"
description: >
  Checkpoint Harmony Email & Collaboration (Avanan) threat detection and
  analysis: threat types and detection engines, IOC extraction, timeline
  and severity assessment, and investigation workflows for phishing,
  malware, BEC, and account-takeover threats.
when_to_use: >-
  When investigating or analyzing an email-borne threat detected by Checkpoint
  Harmony Email. Use when: checkpoint threat, avanan threat, email threat,
  phishing detection, malware email, bec detection, business email compromise,
  account takeover, threat analysis, ioc extraction, threat indicators, email
  security threat, threat timeline, or threat severity.
---

# Checkpoint Harmony Email Threat Detection & Analysis

## Overview

Checkpoint Harmony Email & Collaboration (Avanan) uses multiple detection engines to identify email-borne threats before they reach end users. The threat detection system covers phishing, malware, business email compromise (BEC), account takeover (ATO), and zero-day attacks. This skill covers threat types, detection engines, IOC extraction, timeline analysis, and investigation workflows.

## Threat Types

| Type | Code | Description | Severity Range |
|------|------|-------------|----------------|
| **Phishing** | `PHISHING` | Credential harvesting via fake login pages or deceptive links | Medium - Critical |
| **Spear Phishing** | `SPEAR_PHISHING` | Targeted phishing aimed at specific individuals | High - Critical |
| **Malware** | `MALWARE` | Malicious attachments or drive-by download links | High - Critical |
| **Ransomware** | `RANSOMWARE` | Ransomware payload in attachment or link | Critical |
| **BEC** | `BEC` | Business email compromise / CEO fraud | High - Critical |
| **Account Takeover** | `ATO` | Compromised internal account sending malicious email | Critical |
| **Zero-Day** | `ZERO_DAY` | Previously unknown threat detected by sandbox | Critical |
| **Spam** | `SPAM` | Unsolicited bulk email | Low |
| **Bulk** | `BULK` | Marketing/newsletter content | Low |
| **DLP Violation** | `DLP` | Outbound data loss prevention trigger | Medium - High |

### Detection Engines

| Engine | Description | Threat Types Detected |
|--------|-------------|----------------------|
| **Anti-Phishing** | URL reputation, page similarity, brand impersonation | PHISHING, SPEAR_PHISHING |
| **Anti-Malware** | Signature-based and heuristic file scanning | MALWARE, RANSOMWARE |
| **Sandbox** | Dynamic analysis of attachments in isolated environment | MALWARE, RANSOMWARE, ZERO_DAY |
| **AI/ML Engine** | Machine learning models for anomaly and impersonation detection | BEC, ATO, SPEAR_PHISHING |
| **URL Rewriting** | Click-time URL scanning and rewriting | PHISHING, MALWARE |
| **DLP Engine** | Content inspection against data loss policies | DLP |
| **Anti-Spam** | Reputation and content-based spam filtering | SPAM, BULK |

## Complete Threat Field Reference

### Core Fields

| Field | Type | Description |
|-------|------|-------------|
| `threatId` | string | Unique threat identifier |
| `type` | string | Threat type code (see table above) |
| `severity` | string | CRITICAL, HIGH, MEDIUM, LOW |
| `confidenceScore` | int | Detection confidence 0-100 |
| `detectedDate` | datetime | When the threat was first detected |
| `detectionEngine` | string | Which engine identified the threat |
| `status` | string | DETECTED, QUARANTINED, REMEDIATED, FALSE_POSITIVE |

### Email Context Fields

| Field | Type | Description |
|-------|------|-------------|
| `messageId` | string | Email message ID (RFC 5322) |
| `subject` | string | Email subject line |
| `sender` | string | Sender email address |
| `senderDisplayName` | string | Sender display name |
| `senderIp` | string | Originating IP address |
| `recipients` | string[] | Target recipient addresses |
| `recipientCount` | int | Number of recipients targeted |
| `direction` | string | INBOUND, OUTBOUND, INTERNAL |

### Indicator of Compromise (IOC) Fields

| Field | Type | Description |
|-------|------|-------------|
| `urls` | object[] | Malicious URLs found in email body/attachments |
| `urls[].url` | string | The full URL |
| `urls[].verdict` | string | MALICIOUS, SUSPICIOUS, CLEAN |
| `urls[].category` | string | Phishing page, malware host, C2 server, etc. |
| `domains` | string[] | Suspicious domains extracted from URLs and headers |
| `ipAddresses` | string[] | IP addresses associated with the threat |
| `fileHashes` | object[] | Hashes of malicious attachments |
| `fileHashes[].sha256` | string | SHA-256 hash |
| `fileHashes[].md5` | string | MD5 hash |
| `fileHashes[].fileName` | string | Original filename |
| `fileHashes[].verdict` | string | MALICIOUS, SUSPICIOUS, CLEAN |

### Timeline Fields

| Field | Type | Description |
|-------|------|-------------|
| `receivedDate` | datetime | When email entered the mail system |
| `scannedDate` | datetime | When scanning completed |
| `quarantinedDate` | datetime | When email was quarantined (if applicable) |
| `remediatedDate` | datetime | When threat was remediated |
| `reportedDate` | datetime | When user reported (if user-reported) |

## MCP Tools

| Tool | Description | Key Parameters |
|------|-------------|----------------|
| `avanan_threats_list` | List detected threats with filters | `startDate`, `endDate`, `type`, `severity`, `status`, `limit`, `offset` |
| `avanan_threats_get` | Get detailed threat analysis | `threatId` |
| `avanan_threats_iocs` | Extract IOCs from a threat | `threatId`, `iocTypes` |
| `avanan_threats_timeline` | Get threat detection timeline | `threatId` |
| `avanan_threats_search` | Search threats by various criteria | `query`, `field`, `startDate`, `endDate`, `type` |
| `avanan_threats_stats` | Get threat statistics and trends | `startDate`, `endDate`, `groupBy` |
| `avanan_threats_mark_false_positive` | Mark threat as false positive | `threatId`, `reason` |

### Tool Usage Examples

**List critical threats from last 24 hours:**
```json
{
  "tool": "avanan_threats_list",
  "parameters": {
    "startDate": "2024-02-14T00:00:00Z",
    "endDate": "2024-02-15T00:00:00Z",
    "severity": "CRITICAL",
    "status": "DETECTED",
    "limit": 50
  }
}
```

**Extract IOCs from a threat:**
```json
{
  "tool": "avanan_threats_iocs",
  "parameters": {
    "threatId": "threat-abc123",
    "iocTypes": ["urls", "domains", "fileHashes", "ipAddresses"]
  }
}
```

**Search for phishing threats targeting a specific user:**
```json
{
  "tool": "avanan_threats_search",
  "parameters": {
    "query": "cfo@company.com",
    "field": "recipients",
    "type": "PHISHING",
    "startDate": "2024-02-01T00:00:00Z"
  }
}
```

## Threat Analysis Workflows

### Phishing Investigation Workflow

1. **Get threat details** - Retrieve full threat record with IOCs
2. **Analyze sender:**
   - Check sender address vs display name mismatch
   - Look up sender domain age and reputation
   - Check SPF/DKIM/DMARC results
3. **Analyze URLs:**
   - Extract all URLs from body and attachments
   - Check URL reputation and redirect chains
   - Identify brand impersonation (login page similarity)
4. **Check scope:**
   - Search for same sender across all recipients
   - Identify how many users received the same campaign
5. **Remediate:**
   - Quarantine all related messages if not already quarantined
   - Add sender domain to block list if confirmed malicious
   - Notify affected users
6. **Document** - Create incident with findings and IOCs

### BEC Investigation Workflow

1. **Review impersonation indicators:**
   - Display name matches executive but email address differs
   - Reply-to address differs from sender
   - Unusual urgency language or financial requests
2. **Check sender authentication:**
   - SPF, DKIM, DMARC results
   - Whether sender domain is a lookalike (typosquatting)
3. **Analyze email content:**
   - Wire transfer or gift card requests
   - Urgency indicators ("immediately", "today", "confidential")
   - Unusual sender behavior patterns
4. **Check for account compromise:**
   - Search for ATO indicators on the impersonated account
   - Review recent login activity and impossible travel
5. **Remediate and report:**
   - Block sender domain
   - Alert targeted recipients
   - Report to incident management

### Malware Analysis Workflow

1. **Get attachment details** - File name, type, size, hashes
2. **Check hash reputation** - Look up SHA-256 in threat intelligence
3. **Review sandbox results** - Dynamic analysis behavior indicators
4. **Extract IOCs:**
   - C2 server addresses
   - Dropped file hashes
   - Registry modifications
   - Network connections
5. **Assess blast radius:**
   - How many users received the attachment
   - Whether any users opened/executed it
6. **Remediate:**
   - Quarantine all instances
   - Block file hash at endpoint level
   - Block C2 domains/IPs at firewall

## Severity Assessment Matrix

| Factor | Low | Medium | High | Critical |
|--------|-----|--------|------|----------|
| Recipients | 1 user | 2-10 users | 10-50 users | 50+ users or executives |
| Threat Type | SPAM, BULK | DLP, ANOMALY | PHISHING, BEC | MALWARE, RANSOMWARE, ATO |
| Confidence | < 50% | 50-75% | 75-90% | > 90% |
| User Interaction | None | Email opened | Link clicked | Attachment executed |
| Data Exposure | None | Metadata only | Credentials entered | Data exfiltrated |

## Error Handling

### Common API Errors

| Code | Message | Resolution |
|------|---------|------------|
| 400 | Invalid threat type | Use valid type codes from reference above |
| 400 | Invalid date range | Max 90-day range, startDate before endDate |
| 401 | Unauthorized | Check API credentials and token expiry |
| 403 | Insufficient permissions | API key needs threat detection scope |
| 404 | Threat not found | Verify threat ID exists |
| 429 | Rate limited | Implement exponential backoff |

### Validation Errors

| Error | Cause | Fix |
|-------|-------|-----|
| Invalid severity filter | Unrecognized severity value | Use CRITICAL, HIGH, MEDIUM, or LOW |
| Too many IOC types | Requested more than supported | Use valid iocTypes: urls, domains, fileHashes, ipAddresses |
| Threat expired | Older than retention period | Data no longer available |

## Best Practices

1. **Prioritize by severity** - Critical threats first, then high, then medium
2. **Check blast radius early** - Know how many users are affected before deep analysis
3. **Extract and share IOCs** - Feed IOCs to other security tools (SIEM, firewall, EDR)
4. **Correlate across threat types** - A phishing campaign may precede an ATO
5. **Document investigation steps** - Maintains chain of evidence for incident response
6. **Review false positive rates** - High FP rates indicate policy tuning needed
7. **Monitor threat trends** - Track threat volume by type over time for reporting
8. **Never release malware to users** - Even if they insist; escalate to management

## Related Skills

- [Checkpoint Quarantine](../quarantine/SKILL.md) - Quarantine management
- [Checkpoint Incidents](../incidents/SKILL.md) - Incident investigation
- [Checkpoint Policies](../policies/SKILL.md) - Policy management
- [Checkpoint API Patterns](../api-patterns/SKILL.md) - Authentication and API usage