Add Check Point Cyberint Alerts bi-directional sync playbooks (v3.1.0) by klevitskiy · Pull Request #13790 · Azure/Azure-Sentinel

klevitskiy · 2026-03-10T21:14:52Z

Change(s):

Add bi-directional sync playbooks for Check Point Cyberint Alerts solution (CPEM Base, Inbound/Outbound Sync, Manual Status Update, Automation Rules)
Add enrichment playbooks (Fetch Attachments, IOC Enrichment)
Add response playbooks (Credential Leak Response, Phishing Takedown, Vulnerability Monitoring)
Add CPEMAlerts KQL parser with alert type metadata lookup and deduplication by ref_id
Add CPEMAlertIngestionAnomaly analytic rule
Add CPEMAlertOverview workbook
Update solution package to v3.1.0 with nested playbook deployments
Fix ref_id column type from datetime to string in DCR and table definitions
Add Customer Name field to connector configuration
Rename logo to checkpoint.svg

Reason for Change(s):

Enable bi-directional alert sync between Check Point Cyberint (Infinity External Risk Management) and Microsoft Sentinel
Provide automated enrichment and response workflows for SOC teams
Fix data ingestion issue where ref_id values were silently dropped due to incorrect column type
Address duplicate alert ingestion issue reported by customers (parser-level dedup by ref_id)

Version Updated:

Solution package updated from 3.0.0 to 3.1.0

Testing Completed:

Yes
Deployed mainTemplate.json to test Sentinel workspace (eastus)
Verified all playbooks render in Content Hub
Validated connector configuration with API key and Argos URL
Confirmed workbook renders with sample data

Checked that the validations are passing and have addressed any issues that are present:

Yes

klevitskiy · 2026-03-10T21:16:02Z

@microsoft-github-policy-service agree company="Check Point"

…/cyberint-ioc-connector # Conflicts: # Solutions/Check Point Cyberint Alerts/Analytic Rules/CPEMAlertIngestionAnomaly.yaml # Solutions/Check Point Cyberint Alerts/Package/createUiDefinition.json # Solutions/Check Point Cyberint Alerts/Package/mainTemplate.json # Solutions/Check Point Cyberint Alerts/Parsers/CPEMAlerts.yaml # Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_InboundSync/azuredeploy.json # Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_ManualStatusUpdate/azuredeploy.json # Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_ManualStatusUpdate/readme.md # Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_OutboundSync/azuredeploy.json # Solutions/Check Point Cyberint Alerts/Playbooks/Sync/CPEM_OutboundSync/readme.md # Solutions/Check Point Cyberint IOC/Data Connectors/CyberintArgosIOCLogs_ccp/CyberintArgosIOCLogs_PollingConfig.json # Solutions/Check Point Cyberint IOC/Package/mainTemplate.json

klevitskiy · 2026-03-19T08:53:35Z

@v-maheshbh Hi, thank you for your assistance! All checks have passed, could you please review the PR when you get a chance?

klevitskiy · 2026-03-23T08:17:23Z

@v-maheshbh Hi, sorry to bug you again. Thanks for your help so far! All checks have passed - could you take a look at the PR when you have a moment?

klevitskiy · 2026-03-26T07:54:14Z

@v-maheshbh Hi, thank you for the recommendation. I made the single PR for review instead of two. Could you please review the PR when you get a chance?

v-maheshbh · 2026-03-27T08:44:06Z

Hi @klevitskiy

Kindly resolve the branch conflicts.

Thanks!

v-maheshbh · 2026-04-06T08:16:35Z

Hi @klevitskiy

Kindly add both black‑and‑white preview images inside the workbook preview images folder.

Thanks!

…ture/cyberint-clean # Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

klevitskiy · 2026-04-07T10:33:14Z

Hi @klevitskiy

Kindly add both black‑and‑white preview images inside the workbook preview images folder.

Thanks!

@v-maheshbh Hi, I've added required screenshots. Let me know if anything else need to be added there

v-maheshbh · 2026-04-08T05:46:08Z

Hi @klevitskiy
Kindly add both black‑and‑white preview images inside the workbook preview images folder.
Thanks!

@v-maheshbh Hi, I've added required screenshots. Let me know if anything else need to be added there

Hi @klevitskiy

kindly refer below solution for more details:

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CiscoMeraki/Workbooks/Images/Preview

Thanks!

klevitskiy · 2026-04-08T06:57:16Z

Hi @klevitskiy

kindly refer below solution for more details:

https://github.com/Azure/Azure-Sentinel/tree/master/Solutions/CiscoMeraki/Workbooks/Images/Preview

Thanks!

@v-maheshbh Hi, Thank you for your patience and endless support! I've updated the workbook preview screenshots. To be honest, I'm not quite following your comment, the link shows 2 screenshots (black and white appearances), which matches what I attached. This PR has been open for a month now. I'd really appreciate it if we could wrap it up soon. Thanks again!

v-maheshbh · 2026-04-08T08:02:05Z

Hi @klevitskiy
Kindly review the comment carefully and add both black‑and‑white preview images inside the workbook preview images folder. Currently, I do not see any preview images present in the solution.

Thanks!

klevitskiy · 2026-04-08T08:07:29Z

Hi @klevitskiy Kindly review the comment carefully and add both black‑and‑white preview images inside the workbook preview images folder. Currently, I do not see any preview images present in the solution.
Thanks!

@v-maheshbh Hi, you are looking at the wrong folder

v-maheshbh · 2026-04-08T08:36:16Z

Hi @klevitskiy

Create this folder here and add images. hope you get my point. or give me branch access.

Thanks!

klevitskiy · 2026-04-08T09:32:51Z

Hi @klevitskiy

Create this folder here and add images. hope you get my point. or give me branch access.
Thanks!

@v-maheshbh Hi, thank you again for your patience and the helpful hint. I've created new folders and uploaded the screenshots

v-maheshbh · 2026-04-09T06:22:41Z

Hi @klevitskiy

Kindly grant me branch access to resolve the validation error.

Thanks!

klevitskiy · 2026-04-09T06:50:07Z

@v-maheshbh Hi, I've granted you access to the branch. Let me know if you have any issues

Remove leftover merge-conflict markers and duplicate block in .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json, normalize the JSON array formatting, and append missing connectors (CheckPointCyberintAlerts, CheckPointCyberintIOC). Ensures the file is a valid, de-duplicated list of connector IDs.

klevitskiy · 2026-04-09T09:08:19Z

@v-maheshbh Thanks for the help! What's left to get this PR ready for merge?

v-maheshbh · 2026-04-09T09:24:11Z

Hi @klevitskiy

The data file includes a total of 9 playbooks; however, one playbook is not reflected in the mainTemplate.
Additionally, there is a solution name mismatch — the solution name is defined as "Name": "Check Point Exposure Management Alerts" in the data file, whereas the correct solution name should be “Check Point Cyberint Alerts”
so kindly update accordingly.

Thanks!

klevitskiy · 2026-04-09T09:44:16Z

Hi @klevitskiy

The data file includes a total of 9 playbooks; however, one playbook is not reflected in the mainTemplate. Additionally, there is a solution name mismatch — the solution name is defined as "Name": "Check Point Exposure Management Alerts" in the data file, whereas the correct solution name should be “Check Point Cyberint Alerts” so kindly update accordingly.

Thanks!

@v-maheshbh Hi, fixed it! Hopefully it looks correct now

v-maheshbh · 2026-04-09T10:44:00Z

Hi @klevitskiy
The data file includes a total of 9 playbooks; however, one playbook is not reflected in the mainTemplate. Additionally, there is a solution name mismatch — the solution name is defined as "Name": "Check Point Exposure Management Alerts" in the data file, whereas the correct solution name should be “Check Point Cyberint Alerts” so kindly update accordingly.
Thanks!

@v-maheshbh Hi, fixed it! Hopefully it looks correct now

Kindly repackage the solution so that the solution name changes are correctly reflected in the mainTemplate.json.

klevitskiy · 2026-04-09T10:48:22Z

Hi @klevitskiy
The data file includes a total of 9 playbooks; however, one playbook is not reflected in the mainTemplate. Additionally, there is a solution name mismatch — the solution name is defined as "Name": "Check Point Exposure Management Alerts" in the data file, whereas the correct solution name should be “Check Point Cyberint Alerts” so kindly update accordingly.
Thanks!

@v-maheshbh Hi, fixed it! Hopefully it looks correct now

Kindly repackage the solution so that the solution name changes are correctly reflected in the mainTemplate.json.

Done! ✅

v-maheshbh · 2026-04-09T11:46:39Z

Hi @klevitskiy
The data file includes a total of 9 playbooks; however, one playbook is not reflected in the mainTemplate. Additionally, there is a solution name mismatch — the solution name is defined as "Name": "Check Point Exposure Management Alerts" in the data file, whereas the correct solution name should be “Check Point Cyberint Alerts” so kindly update accordingly.
Thanks!

@v-maheshbh Hi, fixed it! Hopefully it looks correct now

Kindly repackage the solution so that the solution name changes are correctly reflected in the mainTemplate.json.

Done! ✅

Thanks!

klevitskiy · 2026-04-09T13:04:36Z

@v-maheshbh Hi, thanks for pointing me on that! Fixed

klevitskiy added 3 commits March 10, 2026 21:43

add artifacts

bd269fa

add artifacts

59d7d11

fix issues

2c80a96

klevitskiy requested review from a team as code owners March 10, 2026 21:14

v-shukore assigned v-maheshbh Mar 11, 2026

v-shukore added the Solution Solution specialty review needed label Mar 11, 2026

klevitskiy added 4 commits March 11, 2026 08:56

fix issues

0233f75

add alert_url column

5011b5c

add alert_url column

57d87ac

add alert_url column

7e3b37a

klevitskiy requested a review from a team as a code owner March 11, 2026 08:53

klevitskiy added 10 commits March 11, 2026 10:37

add include_csv_attachments_as_json_content: true to the POST body

4c95d35

add configuration fields

a174821

fixes

25c694f

fixes

f422b32

fix arm-ttk test issue

2f7564c

fix arm-ttk test issue

15ac2da

fix connection issue

3434b29

fix closure reasons

9486c38

fix cyberint ioc connector

7ff1c6b

v-maheshbh mentioned this pull request Mar 25, 2026

Fix/Cyberint IOC connector #13849

Closed

add customer name field to IOC connector configuration

782a43d

klevitskiy and others added 5 commits April 7, 2026 12:08

remove: clean up commit history

77fc0b3

fix test script

dcff4ec

Merge remote-tracking branch 'origin/feature/cyberint-clean' into fea…

80e6ba1

…ture/cyberint-clean # Conflicts: # .script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json

remove: revert Solutions Analyzer to master

1d69876

add valid connector ids

f0a7143

replace workbook previews

f9a6165

add workbook previews

57648e3

Merge branch 'master' into feature/cyberint-clean

8ae6efe

klevitskiy added 2 commits April 9, 2026 11:39

fixed solution name and fixed missing playbook

6d4d4dc

fixed solution name and fixed missing playbook

ba1e28f

repackage

8bae5da

repackage

2bab7db

Conversation

klevitskiy commented Mar 10, 2026

Uh oh!

klevitskiy commented Mar 10, 2026

Uh oh!

klevitskiy commented Mar 19, 2026

Uh oh!

klevitskiy commented Mar 23, 2026

Uh oh!

klevitskiy commented Mar 26, 2026

Uh oh!

v-maheshbh commented Mar 27, 2026

Uh oh!

v-maheshbh commented Apr 6, 2026

Uh oh!

klevitskiy commented Apr 7, 2026

Uh oh!

v-maheshbh commented Apr 8, 2026

Uh oh!

klevitskiy commented Apr 8, 2026

Uh oh!

v-maheshbh commented Apr 8, 2026

Uh oh!

klevitskiy commented Apr 8, 2026

Uh oh!

v-maheshbh commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

klevitskiy commented Apr 8, 2026

Uh oh!

v-maheshbh commented Apr 9, 2026

Uh oh!

klevitskiy commented Apr 9, 2026

Uh oh!

klevitskiy commented Apr 9, 2026

Uh oh!

v-maheshbh commented Apr 9, 2026

Uh oh!

klevitskiy commented Apr 9, 2026

Uh oh!

v-maheshbh commented Apr 9, 2026

Uh oh!

klevitskiy commented Apr 9, 2026

Uh oh!

v-maheshbh commented Apr 9, 2026

Uh oh!

klevitskiy commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

v-maheshbh commented Apr 8, 2026 •

edited

Loading