Azure-Sentinel/Solutions/Check Point/Playbooks

Check Point Software Technologies Logic Apps Playbook

Table of Contents

1. Overview
2. Deploy Playbook
3. Test Playbook
4. Key Playbook Components

Overview

The Check Point Logic App Playbook allow you to make changes to Check Point firewalls via Check PointManagement API.

Common use cases include:

1. Enable operation teams to automate common security functions such as creating objects, updating security policies, and schedule security policy updates to gateways.
2. Fully integrate with any orchestration platforms for both on-prem or public cloud providers
3. Integrate with all leading SIEM/SOAR providers such as Azure Sentinel

For more information see

Check Point Management API
Logic App Overview

Deploy Playbook

This package includes:

This Playbook will create IP objects and add objects to group.

As prerequsit you'll need to first deploy the Check Point Connector in your subscription before you can install this playbook.

Deployment instructions

1. Create an API key from Check Point management console

   

2. Launch the template

   

3. Fill in the template

   

4. Update LogicApp Sentinel Connection

   

Test Playbook

• Dry run

  

• Dry run result

  

Key Playbook Components

1. Trigger point - It can be scheduled, use HTTP post, or trigger point from a connector

   Example 1 - Scheduled tasks

   

   Example 2 - Azure Sentinel Alert

   

   Example 3 - HTTP post

   

2. Workflow - Logic App instructions

   Define the Check Point gateway and policy package

   

   Define the Check Point Management Station API Key or usr/pw

   

   Define what action to take, in this case, create and add each host to predefined group

   

   Publish and Install Security Policy