Home
Connectors
This topic describes connectors used in Playblocks and explains how they support automatic incident response and collaboration. It also shows how to access the Connectors page and identifies automatically connected products.
SentinelOne
This topic describes the integration of playbook blocks with SentinelOne and explains how automated workflows help improve threat management. It also includes a note about required SentinelOne service user permissions.

Important Information
Introduction to Playblocks
This topic introduces the automated response capabilities of PlayBlocks and its integration with collaborative tools. It provides an overview of how PlayBlocks helps protect organizations from cyber attacks.
Getting Started
This topic describes the initial steps required to begin working with PlayBlocks. It provides links to create an account, access the portal, license the product, and onboard services.
Video Tutorials
Overview
This topic describes the Overview page, which displays key information and statistics about Playblocks. It explains how to access the Overview page and view its data.
Automations
This topic describes the Automations page and its interface elements. It provides details about automation categories, views, filtering options, and automation card components.
Monitor
This topic describes the Monitor page, which displays statistics and visual widgets showing automation activity and prevention data. It summarizes the available monitoring views and their functions.
Executions
This topic describes the Executions page and how to access it. It provides an overview of the information shown for executed automations.
Pending Actions
This topic describes the Pending Actions page, which lists automation executions awaiting approval. It also explains how to access this page in Playblocks.
Lists
This topic describes the Lists page, which shows various types of destinations, sources, devices, and identities managed by the system. It explains the purpose of each list category.
Connectors
This topic describes connectors used in Playblocks and explains how they support automatic incident response and collaboration. It also shows how to access the Connectors page and identifies automatically connected products.
- Check Point Firewall Logs
  This topic describes the Check Point Firewall Logs interface and the information it displays about connected management servers and firewalls.
- Check Point Firewall Enforcement
  This topic describes Check Point Firewall Enforcement and the related supported configurations and objects it adds to the management system. It also outlines prerequisites for on-premises onboarding.
- Email
  This topic describes how to configure an email connector for sending notifications. It guides you through defining groups, addresses, and default settings.
- SMS
  This topic explains how to configure an SMS connector to send incident notifications. It provides steps for adding groups, entering phone numbers, and managing defaults.
- Jira Ticketing
  This topic describes how to configure a Jira Ticketing connector in Playblocks. It provides step-by-step instructions for setting up access and ticket type parameters.
- Slack
  This topic describes how to configure a Slack connector to receive incident details and responsive actions. It guides you through adding and managing Slack channels.
- Microsoft Teams
  This topic describes how to configure a Microsoft Teams connector to receive notifications. It provides step-by-step instructions for adding and managing Teams channels.
- ServiceNow Ticketing
  This topic describes how you can receive incident details and responsive actions through ServiceNow Ticketing. It also provides prerequisite information for configuring the ServiceNow Ticketing connector.
- PagerDuty Alerting
  Configure the PagerDuty connector to enable automations to open, acknowledge, and resolve incidents in PagerDuty as part of an automated response.
- AI Connectors
  This topic describes how to connect an AI provider to Playblocks and how to use the AI Request step in custom automations.
- Microsoft Defender
  This topic describes how to configure a Microsoft Defender connector in Playblocks. It provides the steps required to enable and authorize the connector.
- CrowdStrike
  This topic describes how to connect CrowdStrike Falcon with an Playblocks account. It provides steps to enable the connector and configure required credentials.
- Microsoft Entra ID
  This task describes how to connect Microsoft Entra ID with your Check Point Portal account. Follow the steps to configure and enable the connector.
- Okta
  This topic describes how to connect Okta with your Check Point Portal account. It provides the required steps and connection behavior.
- SentinelOne
  This topic describes the integration of playbook blocks with SentinelOne and explains how automated workflows help improve threat management. It also includes a note about required SentinelOne service user permissions.
  - Configure a SentinelOne connector
    This task describes how to configure a SentinelOne connector in Playblocks. Follow the steps to enable the connector and provide required credentials.
- IOC Enforcement
  This topic describes IOC Enforcement and how it synchronizes indicators across connected security products. It explains how Playblocks IOCs are updated and distributed through the IOC Management platform.
Notifications
The Notifications page provides options to manage who receives notifications and how they are delivered. It also displays legends describing available actions and views.
Appendix
This appendix provides links to supporting procedures for integrating various external services with Check Point Playblocks. It lists additional configuration resources for multiple platforms.

SentinelOne

This topic describes the integration of playbook blocks with SentinelOne and explains how automated workflows help improve threat management. It also includes a note about required SentinelOne service user permissions.

The integration of Playblocks with SentinelOne allows you to receive real-time alerts from SentinelOne agents and take corrective actions through automations. These automated workflows enable faster responses and more efficient threat management.

Note:

Before you configure the SentinelOne connector, create a SentinelOne service user with sufficient permissions. For more information, see Appendix F - Creating a SentinelOne Service User.

03 July 2026