Jump to main content
Check Point Endpoint Security Administration Guide
Endpoint Security Administration Guide
Important Information
Revision History
Lists all updates made to the Endpoint Security Administration Guide, grouped by year. The latest change appears at the top.
Introduction to Endpoint Security
API Support
Getting Started
Creating an Account in the Check Point Portal
This topic provides an overview of the Check Point Portal and points to additional documentation for creating an account.
Endpoint Security for Managed Security Service Providers
Accessing the Endpoint Security Administrator Portal
This task describes how to access the Endpoint Security Administrator Portal. It provides step-by-step instructions for signing in and navigating through the menu options.
Creating a New Endpoint Management Service
Managing Licenses
Account Trial and Licensing
Extending Trial Period
Amazon Web Services Marketplace
Activating the License
License Violation
Getting Started Walkthrough Wizard
Specific Service Roles
System Roles and Descriptions
User Type Permissions Summary
Permissions Matrix for Endpoint Management Tabs
Video Tutorials
How to Add Exclusions using Smart Exclusions in Endpoint Security
How to Deploy Endpoint Security Client Using Microsoft Intune
How to Create a Custom Dashboard
How to Perform the Run Diagnostics Push Operation in Harmony Endpoint
How to Generate Security Reports in Endpoint Security
How to Create a Threat Prevention Policy Template in Harmony Endpoint for MSSPs
How to Configure Automatic Patch Updates in Harmony Endpoint
How to apply Data Loss Prevention (DLP) rule in Harmony Endpoint
Threat Hunting
Quarantine Management
Reconnect Tool
Windows
macOS
Supported Operating Systems for the Endpoint Security Client
Endpoint Security Client Requirements for Microsoft Windows
Endpoint Security Client Requirements for Microsoft Windows Server
Endpoint Security Client Requirements for macOS
Endpoint Security Client Requirements for Linux
Supported Browsers for the Browser Extension
Migrating an On-premises Security Management Server to Endpoint Security
Use Case
Prerequisites for migration
Known Limitations
Migrating to Endpoint Security
Infinity AI Copilot
General Actions
Providing Feedback
Supported Capabilities
Deploying Endpoint Clients
Installation Token
Enable token-limited registration
Automatic Deployment of Endpoint Clients
Describes how to deploy Endpoint Security clients automatically by using deployment rules, the Tiny Agent, the Vanilla Client, and the Endpoint Security Component Package on Windows, macOS, and Linux endpoints.
Manual Deployment of Endpoint Security Clients
Using the Export Package
Using the Offline Installation
Installing the Exported Package or Client
Adding a New VPN Site to an Exported Package
Remotely Installing the Initial Client
Using Third-Party Tools
Using Push Operation
Setting the Deployment Agent
Certificates and DNS
Privileges
Setting the Target Devices
Other AV Solutions
Enable Access to the Task Scheduler Through the Windows Firewall in a Domain Profile
Remotely Installing the Initial Client
To install the Initial Client remotely from the Push Operations view
To install the Initial Client remotely from the Asset Management view
Windows Task Scheduler on endpoint devices
Security Considerations
Progress of Installation and Error Handling
Ports and Permissions
Upgrades
Anti-Malware Settings
Heartbeat Interval
Configuring Alerts
Basic Alerts
Configuring Basic Alert Messages
Configuring an E-mail Server
Advanced Alerts
Configuring Advanced Alerts
Duplicating an Advanced Alert
Editing or Creating a Notification Profile
How to Verify that Endpoint Security can Access Check Point Servers
Uninstalling Third-Party Anti-Virus Software Products
Viewing Operational Overview, Security Overview and Reports
Unified Dashboard
Custom Dashboard
Creating a Custom Dashboard
Managing a Custom Dashboard
Operational Overview
Security Overview
Reports
Scheduled Reports
Announcements
Browser Settings
Chrome on Windows
Firefox on Windows
Microsoft Edge on Windows
Brave on Windows
Chrome on macOS
Firefox on macOS
Microsoft Edge on macOS
Enabling the Browser Extension on a Browser with Incognito or InPrivate Mode
Enable the Harmony Browse extension on Chrome in Incognito mode
Enable the Harmony Browse extension on Edge in InPrivate mode
Enable the Harmony Browse extension on Firefox in the InPrivate mode
Ending the Browser Process Running in the Background
To end the Chrome browser process running in the background
To end the Edge browser process running in the background
Browser Extension Pinning
Managing Accounts in the Check Point Portal
To create an additional account for an user
To switch between accounts
To add an administrators to an account
Managing Browser - Classic
Manage the Harmony Browse client through Endpoint Security
Limitations
Viewing Computer Information
Asset Management View
Creating a Custom View
Status Icon
Filters
Table Filters and Column Description
Working with the Computers Table
Viewing Device Hardware Information
Viewing Endpoint Posture
Vulnerability Assessment Table
Patch Status Messages
Device Details Widget
CVE Details Widget
Scanning Devices
Mitigating Vulnerable CVEs
Isolating a Device
Applying the Patch for CVEs
Verifying the Applied Patch
Managing Devices
Managing Storage and Peripheral Devices
Managing Storage Device Groups
Using Wild Card Characters
Viewing Events
Configuring Endpoint Policy
Configuring the Threat Prevention Policy
Unified Policy
Parts of the Policy Rule Base
Threat Prevention Policy Toolbar
Policy Mode
Select a Policy Mode
Update a Predefined Policy Mode
Web & Files Protection
Behavioral Protection
The Anti-Bot Component
Configuring Anti-Bot
Advanced Anti-Bot Settings:
The Behavioral Guard & Anti-Ransomware Component
Advanced Behavioral Guard & Anti-Ransomware Settings
Backup Settings
The Anti-Exploit Component
Automated Attack Analysis (Forensics)
Remediation & Response
Adding Exclusions to Rules
Legacy Exclusions
Adding Exclusions to a Specific Rule
Adding Global Exclusions
Adding Exclusions from Security Overview
Adding Exclusions from Logs
Adding a New Exclusion to an Exclusion Category
Editing an Exclusion
Supported Exclusions for Anti-Bot
Anti Bot -> URL Filtering Exclusions
Anti-Malware -> Process Exclusions (on-access only)
Anti-Malware Files and Folders Exclusion
Anti-Malware Exclude Infection by Name
Threat Emulation, Threat Extraction, and Zero-Phishing Exclusions
Threat Emulation -> Anti-Exploit Exclusions
Forensics Anti-Ransomware and Behavioral Guard Exclusions
Forensics Monitoring Exclusions
Forensics - Quarantine Exclusions
Smart Exclusions
Adding Exclusions to a Specific Rule
Adding Global Exclusions
Migrating Legacy Exclusions
Importing and Exporting Exclusions
Managing Exclusions
Optimizing the Endpoint Security Client for Servers and Profiles
Quarantine Management
Known Limitations
Supported Actions
Quarantine Manager
Deleting a Quarantined File
Restoring a Quarantined File
Sending a File to Quarantine
Importing a Quarantined File
Managing Quarantined Files
Benefits
Viewing Quarantined Files and Applications
Quarantined file fields
Acting on Quarantined Files and Applications
Fetching (download) a quarantined file
Restoring a quarantined file
Deleting a quarantined file
Endpoint Security Client Device Restart Requirements
Security Policy - Best Practices
Threat Prevention Policy Profile - Initial Baseline
Behavioral Protection - Low Memory Mode
Analysis & Remediation - Termination of Trusted Processes (LOLbins)
Endpoint Firewall - Deployment for Remote Attack Containment
Endpoint Firewall - Network Micro-Segmentation for Lateral Movement Prevention
Configuring Client Settings
User Interface
Pre-Boot Images
Windows Background Image
Customized Client Image
Customized Browser Block Pages
Log Upload
Installation and Upgrade Settings
Agent Uninstall Password
Local Deployment Options
Automatic Client Update
Automatic Client Update Procedure
General Settings - Authenticated Proxy
Sharing Data with Check Point
Connection Awareness
Super-Node
Super Node Overview
Configure a Super Node through the toolbar
Configure a super node proxy for an offline environment
Disable Capabilities
Network Protection
Push Operations
Configuring the Data Protection Policy
Configuring Full Disk Encryption
Policy Rule Components
Policy toolbar options
To disable Full Disk Encryption
Check Point Disk Encryption for Windows
Authentication before the Operating System Loads (Pre-boot)
Enable preboot authentication
Temporary Pre-boot BypassSettings
Advanced Pre-boot Settings
User Authorization before Encryption
User Assignment
Smart Pre-Boot
To enable Smart Pre-boot
Easy Unlock
Responding to a request
Self Unlock
Enable Self-Unlock for Full Disk Encryption Policy
BitLocker Encryption for Windows Clients
Taking Control of Unmanaged BitLocker Devices
FileVault Encryption for macOS
Pre-boot Authentication Methods
Configure the authentication method for Password or SmartCard
Before You Configure Smart Card
To configure the smartcard options
Password Complexity and Security
Passwordless Pre-boot Authentication
Enable passwordless preboot authentication
User Account Lockout Settings
Configure an Account Lock Action
Remote Help Permissions
Configure remote help options
Logon Settings
Options
Bi-Directional Password Sync Settings
Installing and Deploying Full Disk Encryption
Client Requirements for Full Disk Encryption Deployment
Completing Full Disk Encryption Deployment on a Client
Stages of the Deployment Phase
Viewing Full Disk Encryption (FDE) Status of an Endpoint Device
Output Parameters
Configuring Media Encryption & Port Protection
Configure Media Encryption
Configuring the Read Action
Configure the Read action and manage exclusions
Configuring the Write Action
Configure the Write action
Import exclusions
Export exclusions
Configuring Business-Related File Types
View business-related and non-business-related file types
Configure business and non-business related file types
Creating User Overrides (UserCheck)
Configuring Authorization Settings
Managing Devices
Managing Storage and Peripheral Devices
Managing Storage Device Groups
Using Wild Card Characters
Viewing Events
Advanced Settings for Media Encryption
UserCheck Messages
Advanced Settings for Media Encryption
Media Log
Site Configuration
Lockout Settings
Offline Access
Media EncryptionRemote Help​
Recover a Media Encryption & Port Protection password with Remote Help
Port Protection
Create a new Port Protection rule
Import exclusions
To export exclusions
Device Category Descriptions for Windows
Media Encryption Access Rules
Configuring Access and Compliance Policy
Firewall
Firewall
Configuring Security Zones
Configure a Trusted Zone
Configuring Firewall Rule Advanced Settings
Configuring Inbound/Outbound Rules
Inbound Traffic Rules
Outbound Traffic Rules
Parts of Rules
Editing a Rule
Deleting a Rule
Managing Firewall Objects and Groups
Supported Object Categories
Creating Objects
Used In
Application Control
Configuring Application Control in Windows
Configuring Application Control in macOS
Creating the List of Applications on the Reference Device
Collect a list of applications on the reference device
Appscan Command Syntax
Uploading the Appscan XML File to the Endpoint Security Management Server
Configure terminate settings
Supported Actions
Configure terminate settings
App Rules
Custom Rules for Windows
Custom Rules for macOS
Disabling or Enabling Windows Subsystem for Linux (WSL)
Developer Protection
Configure Developer Protection
Exclusions to Developer Protection
Compliance
Planning for Compliance Rules
Ensuring Alignment with the Deployed Profile
Remote Access Compliance Status
Action Rules
Basic Workflow for defining additional compliance rules:
Check Objects
Remediation Objects
Service Packs for Compliance
Ensuring that Windows Server Updates Are Installed
To configure the WSUS compliance check:
Detecting Common Vulnerabilities and Exposures
Configuring Posture Assessment Settings
Anti-Virus for Compliance
IOC Management
Connected, Disconnected and Restricted Rules
Policy Operation
Data Loss Prevention (DLP)
Data Loss Prevention (DLP)
DLP DLP Logs
Use Case
Known Limitations
Sample Data Type
Creating a DLP Rule and Associating with an Event
Creating a Custom Data Type Group
Adding an Existing Data Type to a Group
Editing a Data Type or GroupData Type or Group
Duplicating a Data Type or a Group
Deleting a Data Type or a Group
Managing Microsoft Sensitivity Labels for DLP
Step 1 - Copy the Microsoft Sensitivity label names and their UUIDs from Microsoft Purview
Step 2 - Creating Microsoft Sensitivity Labels in Endpoint SecurityBrowser - Classic
Step 3 - Assign Sensitivity Labels to DLP Rules
Creating a DLP Rule and Associating with an Event
Topic
Topic
Enabling GenAI Protect
Import or Export Policies
Exporting Policies
Importing Policies
Capabilities of Offline Endpoint Security Client
Performing Data Recovery
Full Disk Encryption Drive Slaving Utility
To perform full recovery with recovery media
Full Disk Encryption Drive Slaving Utility
Use the Drive Slaving Utility
BitLocker Recovery
FileVault Recovery
Password Reset using a Personal Key
Personal key overview
Decrypting and recovering the user's FileVault-encrypted macOS
Managing Virtual Groups
To create a virtual group
Add items to a virtual group
To create and add to virtual group:
Move devices between virtual groups
To export the list of devices in a virtual group to an excel file
Managing Active Directory Scanners
Supported Directory
Prerequisites
Managing Microsoft Active Directory Scanner
Organization Distributed Scan
Full Active Directory Sync
Managing Microsoft Entra ID Scanners
Limitations
Configuring the Settings in the Microsoft Entra ID Portal
Importing Objects from Microsoft Entra ID
Giving Remote Help to Full Disk Encryption Users
Active Directory Authentication
Configuring Active Directory Authentication
Configuring the Active Directory Server for Authentication
Configuring Authentication Settings
Step 3 of 3: Save Changes
UPN Suffixes and Domain Names
Configuring Alternative Domain Names
Troubleshooting Authentication in Client Logs
Endpoint Security Logs
Catalog Items for Tabs
Log Interface Reference
Data Storage and Retention
Static Signatures (YARA) Logs
Query Language Overview
Exporting Logs
To export logs from Endpoint Security
Creating Security Certificates for TLS Mutual Authentication
Sending Security Reports
Push Operations
Accessing Push Operations
Push Operations Dashboard Widgets
Push Operations Table
Available Actions from Push Operations
Creating a Push Operation
Affected Devices Table
Filtering the Push Operations
Certificate Management
Add a new certificate
Forensics Data
Threat Hunting
Enabling Threat Hunting
Using Threat Hunting
Saving a Query as a Bookmark
To add recipients to threat hunting email notifications
Use Case - Maze Ransomware Threat Hunting
Sending Forensics Data to Third-Party Analytics Tool
Downloading Forensics Reports
Download the forensics report of an event
Two-Factor Authentication
Endpoint Security for Linux
Endpoint Security for Linux Overview
Prerequisites
Key Threat Prevention Technologies
Minimum Hardware Requirements
Supported Linux Versions
Linux Kernel Support
Installation on Semi-Isolated Environments with Super Node Proxy
Deploying Endpoint Security for Linux
Endpoint Security for Linux Runtime Configurations
Overview
Limitations
How Container Runtime Monitoring Works
Supported Container Runtimes
Prerequisites
Configuring Container Runtime Settings
Path Configuration Requirements
Runtime-Specific Configuration
Kubernetes-Specific Configuration
Verification
Endpoint Security for Linux CLI Commands
Quarantine Commands
Scans & Detections
Logs
Uninstall Endpoint Security for Linux
Endpoint Security for Linux Additional Information
Endpoint Security for Windows Virtual Desktop Infrastructure (VDI)
​Software Blades for Persistent Desktops
Configuring Clients for Persistent Desktops
Creating a Basic Golden Image for Persistent Desktops
Creating a Pool for Persistent Desktops
Configuring Clients for Non-Persistent Desktops
Configuring Clients for Non-Persistent Desktops
Shared Signatures Server
Configuring the Signatures Server
Setup Validation
Client Machine Configuration for Non-Persistent Desktops
Creating a Basic Golden Image for Persistent Desktops
Post Setup Actions
Creating a Pool for Non-Persistent Desktops
VMware Horizon Key Points
Citrix Xen-Desktop Key Points
Pool Validation
Disabling the Anti-Malware Periodic Scan
Client Machine Configuration for Non-Persistent Desktops
Assigning Policies to VDI Pools
Limitations
Advanced Settings Non-Persistent Desktops
Advanced Settings Non-Persistent Desktops
Endpoint Security for Terminal Server/ Remote Desktop Services
Limitations
Deploying Endpoint Security for Terminal/ Remote Desktop Services
Prerequisites
Procedure
Software Blades for Terminal Servers
Deploying Endpoint Security for Terminal/ Remote Desktop Services
Limitations
Prerequisites
Procedure
Software Blades for Terminal Servers
Configuring Threat Emulation (TE) Appliance for Endpoint Security
Known Limitations
Step 1 - Configure the TE Appliance on SmartConsole
Step 2 - Create a TE Appliance Object in the SmartConsole
Step 3 - Enable Threat Prevention API
Step 4 - Threat Emulation Configuration in Check Point Portal
Managed Security Service Providers (MSSP)
MSSP Essentials
MSSP Total Endpoints
Account with Issues
Service Status
Contracts by Type
Contracts by Status
Active Endpoints Trend
Top 5 Attacked Accounts
Top 5 Ransomware Attacked Accounts
Top 5 Phishing Attacked Accounts
Top 5 Accounts with Exploit Attack Attempts
Alerts
MSSP Custom Dashboard
MSSP Dashboard
Account Dashboard
Managing a Custom Dashboard
Optional Widgets
Password Reuse Attacks
Phishing Attacks
Ransomware Attacks
Exploit Attacks
Malicious Site Attacks
Service Management
Accounts Info
Issues by Accounts
Service Status
Hosting Sites
Account Details Table
Reports for MSSP
To download a report
Global Exclusions
Adding Global Exclusions using Legacy Exclusion
Adding Global Exclusions using Smart Exclusion
Syncing Exclusions with Child Accounts
Templates for Child Accounts
Threat Prevention Policy Template
Creating a Threat Prevention Policy Template
Attaching the Threat Prevention Policy Template to a Child Account
Viewing the Accounts Attached to a Template
Smart App Control
Recent Tasks
Known Limitations
Appendix A - Deploying Endpoint Security Client using SCCM
Appendix B - Uninstalling the Client (For macOS and Windows)
Appendix C - Deploying Endpoint Security Client Using Microsoft Intune
Use Case
Prerequisites
Preparing the Endpoint Security Client Windows Package for Deployment
Endpoint Security Configuration
Creating the Endpoint Security Windows App in Microsoft Intune
Appendix D - Microsoft Intune Wipe and Windows Reset with Full Disk Encryption