Email Security Administration Guide

Important Information

Related Documents

Introduction to Email Security

Getting Started

Creating an Account in the Check Point Portal

This topic provides an overview of the Check Point Portal and points to additional documentation for creating an account.

Accessing the Email Security Administrator Portal

Accessing the Email Security Administrator Portal From Check Point Portal

Finding the Portal Identifier of your Email Security Tenant

Licensing the Email Security Product

Managing Email Security Licenses

License Assignment with a Commercial Contract

Limiting License Consumption and Security Inspection to a Specific Group

Manual Changes to License Assignment

Trial Period for Email Security in the Check Point Portal

Managing Users, Roles and their Permissions

Activating SaaS Applications

Minimum License Requirements to Activate SaaS Applications

Activating Office 365 Mail

Office 365 Mail - Required Roles and Permissions

Automatic Mode Onboarding - Microsoft 365 Footprint

Mail Flow Rules (Transport Rules)

Check Point - Protect Outgoing Rule

Check Point - Protect Internal Rule

Check Point - Protect Rule

Check Point - Whitelist Rule

Check Point - Junk Filter Low Rule

Check Point - Junk Filter Rule

Check Point- Encryption

Check Point Inbound Connector

Check Point DLP Inbound Connector

Check Point Internal Inbound Connector

Check Point Outbound Connector

Check Point DLP Outbound Connector

Check Point Journaling Outbound Connector

Connection Filters

Distribution Lists

Spoofed Senders Allow List

Trusted ARC Sealers

Reported Phishing Emails

Delegated Token

PowerShell Scripts

Connecting Multiple Portals to the Same Microsoft 365 Account

Connecting Multiple Email Security Tenants

Connecting Multiple Tenants to the same Microsoft 365 Account - Microsoft 365 Footprint

Deactivating Office 365 Mail

Activating Microsoft Teams

Activating Office 365 OneDrive

Activating Office 365 SharePoint

Activating Google Workspace (Gmail and Google Drive)

Activating Gmail

Activating Google Drive

Google Workspace Footprint

Changing the Google Application Role

Performing Actions on Behalf of Users

Inbound Check Point Firewall

SMTP Relay Service

Content Compliance Rules

Google Drive Permissions Changes

Activating Slack

Onboarding Next Steps

Configuring Security Engines

Data Loss Prevention

Creating a Custom Regular Expression DLP Data Type

Validating Regular Expression

Dictionary DLP Data Types

Compound DLP Data Types

Creating a Custom Compound DLP Data Type

Edit, Clone, or Delete Custom DLP Data Types

Configuring Advanced Data Type Parameters

Configuring DLP Engine Settings

Click-Time Protection

Configuring Click-Time Protection Engine

Rewritten Check Point URL

Click-Time Protection Against Malicious Files Behind Links

Click-Time Protection - End-User Experience

Email Protection

Office 365 Mail

Office 365 Mail Security Settings

Configuration Templates for Office 365 Mail

Protecting Microsoft 365 Groups

Adding a New Domain to Microsoft 365

Overriding Microsoft's False Positive Detections

Emails Falsely Quarantined by Microsoft

Emails Falsely Sent to Junk by Microsoft

Viewing Office 365 Mail Security Events

Viewing Security Events for Microsoft Quarantined Emails

Visibility into Microsoft Defender Verdict and Enforcement

Gmail Security Settings

Configuration Templates for Google Gmail

Viewing Gmail Security Events

Configuring Email Policy

Threat Detection Policy

Threat Detection Policy for Incoming Emails

Excluding Members of Microsoft 365 Groups from a Prevent (Inline) Policy

Manually Controlling IP Exceptions in Microsoft 365 Mail Flow Rules

Threat Detection Policy for Internal Emails

Threat Detection Policy for Outgoing Emails

Supported Workflow Actions

Prerequisites to Avoid Failing SPF Checks

Threat Detection Policy Workflows

Malware Protection

Phishing Protection

Customizing the Subject Prefix for Phishing Warning Emails

Configure the Subject Prefix

Password Protected Attachments Protection

Requesting Passwords from End Users - End-User Experience

Quarantine. User is alerted and allowed to restore the email workflow

Password Protected Attachments - Administrator Experience

Attachment Cleaning (Threat Extraction)

Configuring Attachment Cleaning (Threat Extraction) for Office 365 Mail or Gmail

Attachment Cleaning (Threat Extraction) Clean Attachments and Workflows

Threat Extraction Exceptions

Attachment Cleaning (Threat Extraction) – File Types and Attachments

Viewing Emails with Cleaned Attachments

Sending the Unmodified Emails to End Users

Attachment Cleaning (Threat Extraction) - End-User Experience

Smart Banners for Non-Clean Emails

Spam Protection

Trusted Senders

Graymail Workflows

Quarantined Emails - End-User Experience

Data Loss Prevention (DLP) Policy

Sync Times with Microsoft

Enhanced DLP Policy using Microsoft Purview Sensitivity Labels

Configure DLP Policy with File Type Criteria

Configuring Misdirected Email Prevention

Configuring the Maximum Alerts shown to the End Users

DLP Policy for Outgoing Emails

DLP Subject Regular Expression (Regex)

Subject Regular Expressions Syntax

DLP Workflows for Outgoing Emails

DLP Alerts for Outgoing Emails

Prerequisites to Avoid Failing SPF Checks

Outgoing Email Protection - Office 365 Footprint for DLP

DLP Policy Sensitivity Level

DLP Policy for Incoming Emails

DLP Workflows for Incoming Emails

DLP Alerts for Incoming Emails

Encrypting Outgoing Emails

Microsoft Encryption for Outgoing Emails

Encrypting Outgoing Emails using Check Point Email Encryption

Click-Time Protection Policy

Notifications and Banners

Sending Email Notifications to End Users

Customizing the From address for Email Notifications

Warning Banners

Notification and Banner Templates - Placeholders

Legacy Archiving

Email Archiving

Searching and Viewing Archived Emails

Litigation Holds

Importing Emails to Archive

Exporting Emails from Archive

Support for S/MIME-Signed Emails

Messaging Apps Protection

Microsoft Teams

Microsoft Teams Security Settings

Configuring Malware Policy for Microsoft Teams

Configuring DLP Policy for Microsoft Teams

Secured Microsoft Teams Messages and Users

Viewing Microsoft Teams Security Events

Slack Security Settings

Configuring Malware Policy for Slack

Configuring DLP Policy for Slack

Viewing Slack Security Events

File Storage Protection

Office 365 OneDrive

Office 365 OneDrive Security Settings

Configuring Malware Policy for Office 365 OneDrive

Configuring DLP Policy for Office 365 OneDrive

Viewing Office 365 OneDrive Security Events

Office 365 SharePoint

Office 365 SharePoint Security Settings

Configuring Malware Policy for Office 365 SharePoint

Configuring DLP Policy for Office 365 SharePoint

Viewing Office 365 SharePoint Security Events

File Cleaning (Threat Extraction) for Office 365 OneDrive and Office 365 SharePoint

Configuring Microsoft Teams File Scanning for E1/E3 Tenants

Google Drive Security Settings

Configuring Malware Policy for Google Drive

Configuring DLP Policy for Google Drive

Viewing Google Drive Security Events

Action on Files Placed in Vault

Shared Files from Unprotected Drives

Compromised Account (Anomaly) Detection

Critical Anomalies

Suspected Anomalies

Configuring Anomaly Detection Workflows

Automatically Blocking All Outgoing Emails

Configuring Settings for Impossible Travel Anomaly

Creating Anomaly Exceptions

Partner Risk Assessment (Compromised Partners)

Cloud SMTP Relay

Access the Domains Section

Configure a Domain

Configure DNS Records

Configure the Relay MX Record

Configure the SPF Record

Configure the DKIM Record

Re-checking DNS Records

Access the Relay Sources Section

Adding a New Relay Source

Activate Cloud Email Relay

Managing Domains and Relay Sources

Deliverability Reporting

Sender Domain Selection and DNS Requirements

SMTP Relay Email Retention

Managing Security Exceptions

Security Engine Exceptions

Anti-Phishing Exceptions

Anti-Malware Exceptions

Click-Time Protection Exceptions

URL Reputation Exceptions

Threat Extraction Exceptions

Trusted Senders - End-User Allow-List

Global IoC Block List (IOC Management)

Managing Security Events

Dashboards, Reports and Charts

Overview Dashboard

Security Widgets

Security Events

Application Protection Health

Login Events Map

Email Security Flow Charts

Analytics Dashboard

Customizing the Analytics dashboard using Infinity AI Copilot

Office 365 Email and Gmail Analytics

Office 365 OneDrive Analytics

Google Drive Analytics

Shadow IT Analytics

User Interaction Dashboard

Security Checkup Report

Security Checkup Report Recipients

Generating a Security Checkup Report

Last 30 Days Security Checkup Report

Scheduling the Security Checkup Report

Configuring a Report Schedule

Default Weekly Report and Managing Report Schedule

Reviewing Security Events

Attachment Preview

Reviewing Phishing Events

Reviewing Malware Events

Automatic Ingestion of End User Reports

Retention of Security Events

Searching for Emails

Acting on Filtered Results in Mail Explorer

Creating and Saving a New Query

Filtering the Query Results

Updating the Query Details

Exporting a Query Results to your Email Address

Scheduling an Export of Query Results to your Email Address

Modifying the Query Columns

Performing Bulk Actions on Query Results

Quarantining a Query Results

Restoring a Query from Quarantine

Sending a Query Alerts and Reports to Users

Manually Sending Items to Quarantine

Remediating Compromised Accounts

System Settings

SIEM / SOAR Integration

Supported SIEM & SOAR Integrations

Configuring SIEM Integration from the Check Point Portal

Extending Formats to Include Additional Information

Forwarding Logs in Syslog Format

Forwarding Audit Logs to SIEM

Supported Security Events and Field Mapping References for SIEM

Forwarding Events to AWS S3

Configuring AWS S3 to Receive Email Security Logs

Configuring AWS S3 to Send Email Security Logs to Splunk

Recommended Configuration for known SIEM Platforms

Configuring Check Point Email Security with Microsoft Sentinel

Step 1: Creating an Azure Resource Group

Step 2: Creating a Log Analytics Workspace

Step 3: Enabling Microsoft Sentinel

Step 4: Installing the Check Point Email Security Solution

Step 5: Retrieving the Data Collection Rule (DCR) Information

Step 6: Retrieving the Logs Ingestion Endpoint

Step 7: Retrieving the Microsoft Entra Tenant ID

Step 8: Creating a Microsoft Entra Application

Step 9: Granting Application Access to the DCR

Step 10: Configuring Microsoft Sentinel in Email Security

Step 11: Verifying the Integration

Configuring Integration with Cortex XSOAR by Palo Alto Networks

CrowdStrike Integration

Step 1 - Create a CrowdStrike Data Connection

Step 2 - Configure CrowdStrike SIEM Integration

Managing Quarantine

End-User Daily Quarantine Report (Digest)

End-User Portal (Email Security Portal)

Accessing the Email Security Portal from Outlook

Limiting End User Portal Access to Specific Users or Groups

Including Blocklisted Emails in the End User Portal

Read and Unread Status of Emails in the End User Portal

Managing Restore Requests

Quarantine Restore Requests

Requesting a Restore from Quarantine - End-User Experience

Restore Requests for Emails Sent to Groups - End-User Experience

Restoring Emails Without Administrator Approval - End-User Experience

Admin Quarantine Release Process

Cleaned Attachments Restore Requests

Restoring Quarantined Emails - End-User Experience

Notifying End Users about Rejected Quarantine Restore Requests

Restore Requests - Notifications and Approvers

Authentication for Email Notifications

Enabling or Disabling Dark Mode

Adding a Custom Logo

Adding a Branded Header and Footer to Admin Email Notifications

Customizing Time Zone for Email Notifications and Reports

Customizing End User Browser Pages Language

Customizing Retention Period of Emails

SmartConfig Recommendations

Incident Response as a Service (IRaaS)

DMARC Management

RUA Mailbox Hosted by Check Point

Discovering Domains from RUA Reports

Virtual RUF Reports

Adding a New Domain

Reviewing the DMARC Status of your Domains

Annotating / Tagging Domains and Sending Sources

Investigating Domains and Sending Sources

Viewing Specific RUA Reports

Improving your Domains' DMARC Enforcement

Monitoring SPF and DMARC Changes

Annotating / Commenting on SPF and DMARC Changes

Manually Adding New Source to SPF Records

Configuring and Defining the SPF Record

Managing Sending Sources

DKIM Management

Activating DKIM Management

Manually Adding New DKIM Selector to your Domain

Managing Selectors

Alerts and Reports

Adding a New Alert

Security Posture Management (SSPM)

Leaked Credentials

Resetting Passwords for a Compromised User Account

Blocking a Compromised User Account

Security Awareness Training

Creating Security Awareness Training Policy

Customizing Security Awareness Training Policy

Daily Sending Frequency

Customizing the Sender of Security Awareness Training Notifications

Custom Phishing Simulation Templates

Custom Phishing Simulation Templates – Placeholders

Importing Template Email Details from a Learning Management System (LMS)

Assigning Custom Phishing Simulation Templates to Users

Adding a Banner to Phishing Simulation Emails

Authorizing Training Module Access for the Organization

Security Awareness Training Email Headers

Branding the Security Awareness Training Web Page

Security Awareness Training Domains

Monitoring User Interactions with Phishing Simulations

Monitoring User Training Progress

Monitoring Phishing Simulations

Monitoring User Awareness Training Progress

Searching for Security Awareness Training Related Emails in Mail Explorer

Security Awareness Training - End User Experience

Supported Languages for Phishing Simulations and Training Modules

Phishing Simulation Email - End User Experience

Available Training Modules

Video Tutorials

How to Onboard Office 365 Mail with Email Security

How to Onboard Microsoft Teams with Email Security

How to Onboard Office 365 OneDrive with Email Security

How to Onboard Office 365 SharePoint with Email Security

How to Onboard Gmail with Email Security

How to Onboard Google Drive with Email Security

How to Contact Check Point Support and Incident Response Team from the Email Security Administrator Portal

Phishing Email End-User Experience with Email Security

Password-Protected Attachments End-User Experience with Email Security

Check Point Email Encryption End-User (External Recipient) Experience with Email Security

How to Enable Smart Banners to Emails with Email Security

How to Configure Daily Quarantine Report (Digest) in Email Security and Allow End Users to Generate a Report on Demand

How to Configure Security Awareness Training Policy in Email Security

How to Configure Outlook Add-In with Email Security

User Interaction Administrator Experience with Email Security

How to Request to Restore Quarantined Phishing Emails End User Experience with Email Security

How to Respond to Misdirected Email Warnings in Outlook

How to Report a Phishing Email in Outlook

How to Access the Email Security Portal from Outlook

Smart Banners and Trusted Senders End-User Experience with Email Security

Appendix A: Check Point Manual Integration with Office 365 Mail

Step 1 - Authorize the Manual Integration Application

Step 2 - On-boarding (Monitor only and Detect and Remediate)

Step 3 - Check Point Contact

Step 4 - Journal Rule

Step 5 - Connectors

Step 6 - Connection Filter (All Modes)

Step 7 - Protect (Inline) Protection Mode Policy Configuration on Email Security

Step 8 - Connectors (Protect (Inline) Mode)

Step 9 - Transport Rules (Protect (Inline) Mode)

Check Point - Protect External

Check Point - Protect Internal

Check Point - Protect

Check Point - Allow-List

Check Point - Junk Filter

Check Point - Encryption

Transport Rules

Step 10 - Sending User Reported Phishing Emails to an Internal Mailbox

Reverting Manual Onboarding / Switching to Automatic Onboarding

Unified Quarantine for Manual Mode On boarding with Office 365 Mail

Appendix B: Check Point Manual Integration with Google Gmail

Step 1: Add Groups

Step 2: Adding a Host

Step 3: Updating Inbound Check Point Firewall

Step 4: Adding SMTP Relay Host

Step 5: Create a Compliance Rule

IP Addresses Supported by Region for Google Gmail

Appendix C: Manual Steps for Enabling Gmail Prevent (Inline) DLP Policy

Step 1: Adding a Host

Step 2: Updating Inbound Check Point Firewall

Step 3: Adding SMTP Relay Host

Step 4: Add Groups

Step 5: Create a Compliance Rule

IP Addresses Supported by Region for Gmail Prevent (Inline) Policy

Appendix D: Securing FedRAMP Organizations

Supported and Unsupported Features in the FedRAMP Region

Appendix E: DLP Built-in Data Types and Categories

Appendix F: Supported Languages for Anti-Phishing

Appendix G: Data Retention Policy

Appendix H: Activating Office 365 Mail in Hybrid Environments

Appendix I: Permitted IP Addresses to access the Check Point Azure Application

Appendix J: Supported File Types for DLP

Appendix K: Troubleshooting

Appendix L: Outlook Add-In

Configuring the Outlook Add-In

Generating the Add-In XML

Deploying the Outlook Add-In through Microsoft 365 Admin Center

Outlook Add-In - Supported Outlook Types and Platform

Automatic Localization of the Outlook Add-In Experience

Appendix M: Configuring Postfix as an Internal SMTP Relay for Non‐TLS Senders to Check Point Cloud SMTP Relay

Postfix Configuration

Restart Postfix to Load the New Configuration

Example Postfix Configuration File

Testing and Debugging Postfix

17 September 2026

© 2022 - 2026 Check Point Software Technologies Ltd.