Home
Introduction to Playblocks
This topic introduces the automated response capabilities of PlayBlocks and its integration with collaborative tools. It provides an overview of how PlayBlocks helps protect organizations from cyber attacks.
How it Works
This topic describes how the automation process operates from detection through execution and administrator review. It outlines each step performed by the system and the administrator.

Important Information
Introduction to Playblocks
This topic introduces the automated response capabilities of PlayBlocks and its integration with collaborative tools. It provides an overview of how PlayBlocks helps protect organizations from cyber attacks.
- Benefits
  This topic describes key benefits that improve automation, operational integration, and administrative actions for incident handling. It highlights efficiencies and streamlined communication across collaborative platforms.
- Use Case
  This topic describes a scenario where automated incident response is needed across multiple security products. It outlines desired preventive actions and communication flows.
- Supported Products
  This topic lists the products that can be used with PlayBlocks and their supported environments. It includes both on-premises and cloud-based product options.
- How it Works
  This topic describes how the automation process operates from detection through execution and administrator review. It outlines each step performed by the system and the administrator.
Getting Started
This topic describes the initial steps required to begin working with PlayBlocks. It provides links to create an account, access the portal, license the product, and onboard services.
Video Tutorials
Overview
This topic describes the Overview page, which displays key information and statistics about Playblocks. It explains how to access the Overview page and view its data.
Automations
This topic describes the Automations page and its interface elements. It provides details about automation categories, views, filtering options, and automation card components.
Monitor
This topic describes the Monitor page, which displays statistics and visual widgets showing automation activity and prevention data. It summarizes the available monitoring views and their functions.
Executions
This topic describes the Executions page and how to access it. It provides an overview of the information shown for executed automations.
Pending Actions
This topic describes the Pending Actions page, which lists automation executions awaiting approval. It also explains how to access this page in Playblocks.
Lists
This topic describes the Lists page, which shows various types of destinations, sources, devices, and identities managed by the system. It explains the purpose of each list category.
Connectors
This topic describes connectors used in Playblocks and explains how they support automatic incident response and collaboration. It also shows how to access the Connectors page and identifies automatically connected products.
Notifications
The Notifications page provides options to manage who receives notifications and how they are delivered. It also displays legends describing available actions and views.
Appendix
This appendix provides links to supporting procedures for integrating various external services with Check Point Playblocks. It lists additional configuration resources for multiple platforms.

How it Works

This topic describes how the automation process operates from detection through execution and administrator review. It outlines each step performed by the system and the administrator.

Playblocks either detects a malicious activity by analyzing the logs (On the Security Gateway or Multi-Domain Security Management or and Single-Domain Security Management ) or receives the preventive or corrective action to be executed directly, for example, from XDR.
Automatically correlates the required action to a predefined automation.
Executes the automation.

Note:
You can disable automatic execution of an automation and configure Administrator approval for execution.
Sends a notification to the Administrator through the configured communication channel, such as Microsoft Teams.

For example:
The Administrator reviews the notification and takes the required action:
- Revert the execution.
- Approve or block the execution if Administrator approval is enabled.
  
  See Approving, Rejecting or Reverting an Automation Execution.

03 July 2026

© 2023 - 2026 Check Point Software Technologies Ltd.