Home
Connectors
This topic describes connectors used in Playblocks and explains how they support automatic incident response and collaboration. It also shows how to access the Connectors page and identifies automatically connected products.
IOC Enforcement
This topic describes IOC Enforcement and how it synchronizes indicators across connected security products. It explains how Playblocks IOCs are updated and distributed through the IOC Management platform.

Important Information
Introduction to Playblocks
This topic introduces the automated response capabilities of PlayBlocks and its integration with collaborative tools. It provides an overview of how PlayBlocks helps protect organizations from cyber attacks.
Getting Started
This topic describes the initial steps required to begin working with PlayBlocks. It provides links to create an account, access the portal, license the product, and onboard services.
Video Tutorials
Overview
This topic describes the Overview page, which displays key information and statistics about Playblocks. It explains how to access the Overview page and view its data.
Automations
This topic describes the Automations page and its interface elements. It provides details about automation categories, views, filtering options, and automation card components.
Monitor
This topic describes the Monitor page, which displays statistics and visual widgets showing automation activity and prevention data. It summarizes the available monitoring views and their functions.
Executions
This topic describes the Executions page and how to access it. It provides an overview of the information shown for executed automations.
Pending Actions
This topic describes the Pending Actions page, which lists automation executions awaiting approval. It also explains how to access this page in Playblocks.
Lists
This topic describes the Lists page, which shows various types of destinations, sources, devices, and identities managed by the system. It explains the purpose of each list category.
Connectors
This topic describes connectors used in Playblocks and explains how they support automatic incident response and collaboration. It also shows how to access the Connectors page and identifies automatically connected products.
- Check Point Firewall Logs
  This topic describes the Check Point Firewall Logs interface and the information it displays about connected management servers and firewalls.
- Check Point Firewall Enforcement
  This topic describes Check Point Firewall Enforcement and the related supported configurations and objects it adds to the management system. It also outlines prerequisites for on-premises onboarding.
- Email
  This topic describes how to configure an email connector for sending notifications. It guides you through defining groups, addresses, and default settings.
- SMS
  This topic explains how to configure an SMS connector to send incident notifications. It provides steps for adding groups, entering phone numbers, and managing defaults.
- Jira Ticketing
  This topic describes how to configure a Jira Ticketing connector in Playblocks. It provides step-by-step instructions for setting up access and ticket type parameters.
- Slack
  This topic describes how to configure a Slack connector to receive incident details and responsive actions. It guides you through adding and managing Slack channels.
- Microsoft Teams
  This topic describes how to configure a Microsoft Teams connector to receive notifications. It provides step-by-step instructions for adding and managing Teams channels.
- ServiceNow Ticketing
  This topic describes how you can receive incident details and responsive actions through ServiceNow Ticketing. It also provides prerequisite information for configuring the ServiceNow Ticketing connector.
- PagerDuty Alerting
  Configure the PagerDuty connector to enable automations to open, acknowledge, and resolve incidents in PagerDuty as part of an automated response.
- AI Connectors
  This topic describes how to connect an AI provider to Playblocks and how to use the AI Request step in custom automations.
- Microsoft Defender
  This topic describes how to configure a Microsoft Defender connector in Playblocks. It provides the steps required to enable and authorize the connector.
- CrowdStrike
  This topic describes how to connect CrowdStrike Falcon with an Playblocks account. It provides steps to enable the connector and configure required credentials.
- Microsoft Entra ID
  This task describes how to connect Microsoft Entra ID with your Check Point Portal account. Follow the steps to configure and enable the connector.
- Okta
  This topic describes how to connect Okta with your Check Point Portal account. It provides the required steps and connection behavior.
- SentinelOne
  This topic describes the integration of playbook blocks with SentinelOne and explains how automated workflows help improve threat management. It also includes a note about required SentinelOne service user permissions.
- IOC Enforcement
  This topic describes IOC Enforcement and how it synchronizes indicators across connected security products. It explains how Playblocks IOCs are updated and distributed through the IOC Management platform.
  - Configure an IOC Enforcement connector
    This topic describes how to configure IOC Enforcement connectors and enable integrations with supported security platforms. It provides step-by-step instructions for setup, validation, and enforcement options.
Notifications
The Notifications page provides options to manage who receives notifications and how they are delivered. It also displays legends describing available actions and views.
Appendix
This appendix provides links to supporting procedures for integrating various external services with Check Point Playblocks. It lists additional configuration resources for multiple platforms.

IOC Enforcement

This topic describes IOC Enforcement and how it synchronizes indicators across connected security products. It explains how Playblocks IOCs are updated and distributed through the IOC Management platform.

The IOC Enforcement connector ensures seamless synchronization between Playblocks and all connected products enforcing IOC.

It automatically updates and distributes newly added IOC across the security products, enhancing protection through up-to-date threat intelligence.

With Check Point Firewall IOC Enforcement, you can select the Security managements you want to fetch the indicators from the output blend of the IOC Management platform. Each gateway connected to the management with anti-bot and anti-virus will start enforcing IOCs after installing the new Threat prevention policy.

When enabling IOC Enforcement, a new list Playblocks IOCs is added. This list sync with a new feed in the IoC Management platform called Playblocks feed. In this feed is be added every indicator that is found by Playblocks automations.

03 July 2026

© 2023 - 2026 Check Point Software Technologies Ltd.