Configuring Check Point Email Security with Microsoft Sentinel
Email Security provides an out-of-the-box integration with Microsoft Sentinel. You can send Email Security events to Microsoft Sentinel for centralized monitoring, investigation, correlation, and reporting.
The integration uses the Azure Monitor Logs Ingestion API:
Check Point Email Security → Microsoft Entra authentication → Azure Logs Ingestion endpoint → Data Collection Rule → Custom Log Analytics table → Microsoft Sentinel
The Data Collection Rule (DCR) defines the expected event structure and routes incoming events to the appropriate custom table in the Log Analytics workspace. The DCR immutable ID, ingestion endpoint, and stream name identify where and how Email Security sends the events.
Required Resources
|
Resource |
Purpose |
Created by |
|---|---|---|
|
Azure resource group |
Contains and manages the integration resources |
Customer |
|
Log Analytics workspace |
Stores the Check Point security events |
Customer |
|
Microsoft Sentinel |
Provides SIEM analysis and investigation capabilities |
Customer |
|
Check Point Email Security solution |
Installs the Microsoft Sentinel integration content |
Content Hub installation |
|
Custom Log Analytics table |
Stores the Check Point events |
Content Hub installation |
|
Data Collection Rule |
Defines the event schema and destination table |
Content Hub installation |
|
Data Collection Endpoint |
Provides the ingestion URL |
Content Hub installation |
|
Microsoft Entra application |
Authenticates Email Security |
Customer |
|
Client secret |
Allows the application to authenticate |
Customer |
|
Azure role assignment |
Allows the application to send events through the DCR |
Customer |
If your organization already has a Microsoft Sentinel workspace, you can skip Steps 1 to 3 and install the solution in the existing workspace.
Required Permissions
The administrator must have the Azure Owner role at the subscription level and the Microsoft Entra Application Developer role or higher. If an existing resource group is used, the Azure Owner role can be scoped to that resource group.
On the Check Point side, the administrator must have permissions to configure SIEM integrations in Email Security.