This topic describes how to onboard an on‑premises system to PlayBlocks. It provides step-by-step instructions to complete the onboarding workflow.

This topic describes automation that blocks attackers based on IPS-detected popular attacks and outlines supported products, parameters, triggers, and flow details.

This topic describes automation that blocks scanners detected by the IPS blade with high confidence and outlines its parameters, trigger, and flow.

This topic describes the automation that blocks attackers flagged as malicious by IP reputation services and triggered by IPS-detected attacks. It also lists supported products, parameters, triggers, and workflow details.

This topic describes the automation that blocks attacking IP addresses identified with malicious reputation and outlines supported products, parameters, trigger details, and flow.

This topic describes settings and behavior for quarantining compromised Endpoint Security devices enforced by a Check Point Firewall. It includes supported products, parameters, trigger details, and flow information.

This topic describes quarantining potentially infected Endpoint Security devices and provides details about supported products, parameters, triggers, and the automation flow. It explains configuration options and associated behaviors.

This topic describes an automation that sends a notification when firewall traffic is blocked by Check Point SASE. It outlines supported product details, parameters, triggers, and flow.

This topic describes an automation that sends notifications when standard risk URL filtering events are blocked by Check Point SASE and explains its parameters and trigger conditions.

This topic describes the automation that sends notifications when a URL reputation is detected by Check Point SASE and outlines its parameters, trigger conditions, and workflow.

This topic describes an automation that notifies when a SASE tunnel is detected as up. It explains supported products, parameters, trigger conditions, and flow.

This topic describes the automation that sends notifications when a Check Point SASE tunnel is detected as down and outlines its parameters, trigger, and flow.

This topic describes an automation that sends notifications when a malicious file is detected by Check Point SASE Threat Prevention. It includes supported product details, configurable parameters, trigger conditions, and the automation flow.

This topic describes an automation that adds a malicious file indicator identified by Threat Extraction Endpoint Security to an IOC feed to enhance threat intelligence and response.

This topic describes the automation that adds a malicious file indicator identified by Threat Emulation Endpoint Security to an IOC feed for enhanced threat intelligence and response.

This topic describes an automation that adds malicious file indicators identified by Anti-Bot Endpoint Security to an IOC feed to enhance threat intelligence and security response. It outlines supported products, parameters, trigger conditions, and flow.

This topic describes an automation that blocks malicious URL indicators identified by Anti-Bot Endpoint Security by adding them to an IOC feed to enhance threat intelligence and response.

This topic describes an automation that adds a malicious URL identified by SASE as an indicator to an IOC feed. It updates threat intelligence to enhance security response.

This topic describes an automation that adds a malicious URL identified by Anti-Bot to an IOC feed to enhance threat intelligence and security response.

This topic describes how the automation blocks a malicious URL identified by Anti-Virus by adding it as an indicator to an IOC feed. It summarizes supported products, parameters, trigger conditions, and the automation flow.

This topic describes the automation that adds a malicious URL identified by Zero Phishing Endpoint Security to an IOC feed. It updates threat intelligence and enhances the security response.

This topic describes an automation that adds a malicious URL identified by the Email Security blade as an indicator to an IOC feed. It helps update threat intelligence and enhance security response.

This topic describes an automation that blocks a malicious URL identified by Zero Phishing by adding it as an indicator. It updates threat intelligence to enhance security response.

This topic describes the automation that isolates compromised Endpoint Security devices and details its supported product, parameters, trigger, and workflow.

This topic describes the automation that isolates potentially infected Endpoint Security devices and lists its parameters, trigger conditions, and flow. It explains how the automation helps prevent threats from spreading inside an organization.

This topic describes automation settings for isolating SentinelOne devices with high‑severity infections and details supported products, parameters, trigger conditions, and flow.

This topic describes how the automation isolates CrowdStrike devices with high severity infections and lists its parameters, triggers, and operational flow.

This topic describes quarantining SentinelOne devices with high-severity infections and lists supported products, parameters, triggers, and flow. It explains how automation settings control quarantine behavior.

This topic describes the AI-based automation that analyzes CPM Doctor reports and outlines supported products, parameters, triggers, and flow. It provides details for configuring ticketing options and scheduling.

This topic describes the automation that isolates potentially infected Microsoft Defender devices and outlines supported products, parameters, trigger conditions, and flow information.

This topic describes how to quarantine potentially infected Microsoft Defender devices when enforcement is applied by the firewall. It includes supported products, parameters, trigger details, and automation flow.

This topic describes the automation that resets passwords when credentials leakage is detected by External Risk Management. It also lists supported products, parameters, trigger conditions, and the flow diagram.

Describes the health monitor that evaluates cloud log ingestion status for Check Point Firewall Management Servers and notifies administrators about failures or successful ingestion events. Includes supported products, parameters, triggers, and the process flow.

This topic describes automation behavior for repeated Remote Access login failures using password-only authentication and the configurable parameters that control it.

This topic describes notifications and blocking behavior for repeated Remote Access login attempts to expired accounts. It also lists supported products, parameters, trigger conditions, and the automation flow.

This topic describes automation notifications triggered by Remote Access user logins that use password-only authentication. It outlines supported products, parameters, and the event flow.

This topic describes the automated blocking of attackers detected by DDoS Protector and outlines supported products, parameters, trigger conditions, and flow information. It includes details about configuration options and automation behavior.

This topic describes automation behavior that quarantines devices identified by CrowdStrike as potentially infected. It also details supported products, parameters, trigger conditions, and the process flow.

This topic describes the automation that removes isolation from a potentially clean Microsoft Defender machine upon administrator approval. It outlines supported products, parameters, trigger conditions, and flow details.

This topic describes an automation that notifies when an administrator login to the GAIA Portal fails. It includes supported products, trigger conditions, and a flow diagram.

This topic describes the notification generated when an Expert Shell login occurs on Gaia or Embedded devices and lists supported product versions, parameters, triggers, and flow.

This topic describes the notification generated when scripts are executed on a Gaia device. It outlines the included notification details and related flow information.

This topic describes notification behavior when a policy installation on Check Point Firewall fails. It outlines supported products, trigger conditions, and the automation flow.

This topic describes automated notifications triggered by degradation in Check Point Firewall Compliance status and configurable parameters for reporting and ticket creation.

This topic describes automated notifications triggered upon successful policy installation on Check Point Firewall. It outlines supported products, trigger conditions, and flow information.

This topic describes an automation that notifies about changes in administrators and their permissions in the management server. It explains supported products, parameters, trigger conditions, and the automation flow.

This topic describes alerts generated when MTA email bypass is detected and the parameter controlling repeated notifications. It also provides product support information, trigger details, and flow visualization.

This topic describes notifications for validation errors or warnings on Management and outlines parameters, triggers, and flow.

This topic describes automated notifications triggered by a change-over event in the management high availability environment. It outlines supported products, parameters, trigger conditions, and the automation flow.

This topic describes the automated notification for repeated login failures to Management and the parameters that control its behavior.

This topic describes how the automation notifies when a high number of blocked connections occur from the same origin machine. It also lists the parameters and trigger conditions for this notification.

This topic describes notifications generated when blade update installations fail on Check Point Firewalls. It includes supported products, parameters, trigger conditions, and the automation flow.

This topic describes automation that notifies on successful installation of blade updates on Check Point Firewalls and provides details about related parameters and triggers. It also includes product support information and a flow diagram.

This topic describes automation behavior for notifying and opening tickets when licenses on Check Point Firewall devices are about to expire. It also lists the supported product, parameters, trigger, and flow of the automation.

This topic describes how automation alerts when VPN certificates expire on Check Point Firewalls and outlines the configurable parameters for expiration monitoring.

This topic describes an automation that sends an alert when a permanent VPN tunnel goes down. It explains supported products, configuration parameters, trigger conditions, and flow behavior.

This topic describes the alert generated when Check Point Firewall Management cannot communicate with one or more Check Point Firewalls. It lists supported products, parameters, trigger conditions, and the automation flow.

This topic describes an automation that sends notifications when non-compliant devices are blocked by the identity and trust system. It outlines supported products, triggers, and the flow.

This topic describes the automation that blocks incoming access from external IP addresses and details supported products, parameters, triggers, and flow information.

This topic describes isolating an endpoint device through automated actions. It includes supported products, parameters, trigger details, and a flow diagram.

This topic describes the automation that enforces best practice policy on a newly discovered IoT zone. It outlines supported products, trigger conditions, and the automation flow.

This topic describes notifications generated when an IoT device is at risk and the available administrative actions. It also outlines supported products, parameters, triggers, and flow information.

This topic describes automation that notifies when the Endpoint Security client uninstall password changes. It includes supported product details, parameters, trigger conditions, and flow information.

This topic describes automation that notifies when multiple Endpoint Security clients are uninstalled within a defined time period. It also outlines supported products, parameters, trigger conditions, and flow information.

This topic describes how the automation resets a user password in the identity provider linked to the account. It outlines supported products, parameters, triggers, and the automation flow.

This topic describes the automation that deletes a file on a Endpoint Security device and outlines its parameters, triggers, and workflow.

This topic describes the settings and parameters used to add a new indicator to an IOC feed. It also outlines the trigger behavior and provides a flow diagram.

This topic describes how an automation deletes an existing indicator from an IOC feed and lists parameters, triggers, and flow information.

This topic describes how the automation stops and quarantines a file on a Microsoft Defender machine and outlines the required parameters, trigger details, and flow.

This topic describes how the automation scans a machine using Microsoft Defender and details supported products, parameters, triggers, and flow.

This topic describes the automation used to isolate a machine protected by Microsoft Defender. It outlines supported products, parameters, trigger conditions, and the automation flow.

This topic describes an automation that releases a Microsoft Defender protected machine from isolation when triggered by XDR. It explains supported products, parameters, trigger behavior, and the automation flow.

This topic describes an automation that stops and quarantines a file on a machine protected by Microsoft Defender using XDR. It outlines supported products, parameters, trigger, and automation flow.

This topic describes the automation behavior when an SD-WAN link swap occurs due to an ISP outage and a critical ticket is generated for follow-up. It also summarizes supported products, parameters, trigger conditions, and workflow.

This topic describes how an automation creates a ticket in an enabled ticketing system based on a provided subject and description. It also lists supported products, parameters, trigger information, and flow details.

This topic describes the automation process that closes a ticket using a ticket number, close state, and close description. It also outlines supported products, parameters, triggers, and the automation flow.

This topic describes how the automation retrieves a ticket number and returns all available information about the ticket. It also lists supported products, parameters, triggers, and shows the process flow.

This topic describes how the automation opens a ticket and sends notifications when an event occurs. It also lists the configurable parameters and trigger behavior.

This topic describes the automation used by Spark Management to handle detected events and shows the associated flow.

This topic describes an automation that alerts when a ransomware attack is detected and outlines supported products, parameters, triggers, and workflow.

This topic describes notifications generated when a Generative AI risky session is detected and outlines the parameters, trigger conditions, and flow.

This topic describes the alert generated when a phishing attempt is detected by Endpoint Security and lists its configurable parameters and trigger details.

This topic describes the alert generated when a malicious file is detected by Endpoint Security and outlines its parameters, trigger, and flow. It provides information for configuring thresholds and notification settings.

This topic describes the alert triggered when access to a malicious site is detected by Endpoint Security and outlines the available automation parameters. It also provides information about the trigger and flow of the automation.

This topic describes the alert triggered when a password reuse attempt is detected and explains the parameters and flow of the automation. It includes supported product information, trigger conditions, and configuration options.

This topic describes alert behavior when an exploit attempt is detected and details the parameters, trigger conditions, and flow for the automation. It provides configuration information for thresholds, severity, and notification settings.

This topic describes the alert generated when the Endpoint Security Static Analysis capability becomes outdated. It outlines the trigger, supported product, and flow of this automation.

This topic describes an automation that notifies when the Endpoint Security Offline Reputation capability is outdated. It provides information about the supported product, trigger conditions, and flow.

This topic describes an automation alert that notifies when the Endpoint Security Behavioral Guard capability becomes outdated. It provides information about the trigger and flow of the alert.

This topic describes the automation that notifies when a Endpoint Security client becomes disconnected. It outlines the supported product, parameters, trigger, and flow.

This topic describes how the automation notifies users when Endpoint Security compliance warnings are triggered. It also provides information about supported products, parameters, triggers, and flow.

This topic describes notifications generated when device restrictions are initiated by the Endpoint Security compliance capability. It outlines supported products, parameters, triggers, and the process flow.

This topic describes the alert generated when the Endpoint Security Anti-Malware capability is outdated. It also lists supported products, parameters, triggers, and flow information.

This topic describes an automation that alerts when a device has not been fully scanned by the Endpoint Security Anti-Malware capability. It outlines supported products, trigger conditions, and the flow of the automation.

This topic describes the alert generated when the Endpoint Security Anti-Malware license expires and outlines its trigger and flow.

This topic describes the alert generated when a Endpoint Security Client deployment fails. It also outlines the supported product, trigger conditions, and flow overview.

This topic explains the alert that notifies when one or more Endpoint Security client capabilities stop running or fail to report their status.

This topic describes an automation that adds SHA256 hashes of malicious files identified by CrowdStrike to an IOC feed. It helps enhance threat intelligence and security response.

This topic describes an automation that adds SHA1 hashes of malicious files flagged by SentinelOne to an IOC feed. It updates threat intelligence and can help prevent malicious files from running on devices.

This topic describes an automation that adds SHA1 hashes of malicious files detected by Microsoft Defender into an IOC feed. It also adds the source URL to enhance threat intelligence and security response.

This topic describes the automation that notifies when Events & AIOps alerts are detected. It outlines the trigger and shows the flow of the notification process.

Creating an automation from blank allows you to build fully customized flows from scratch and tailor every step to your specific use case.

Configure a Log Trigger to monitor logs, define conditions, and create example outputs for automation workflows.

Configure a schedule trigger to run automation at recurring intervals. The task explains how to select the repetition frequency and create the trigger.

Learn how to manage a trigger by adding notifications, enrichments, conditions, or actions.

Configure notification actions including Notify, Ask, and Open Ticket options. This task explains how to create and customize notification messages and ticket actions.

Use enrichment steps to query the Reputation Service for IP addresses, URLs, or file hashes from previous step outputs. The enrichments provide threat intelligence data about the selected value.

Use conditions to create branches in the automation flow based on logical evaluations. This task explains how to configure condition expressions and operations.

Action steps perform operational tasks such as running automations, managing indicators, and sending external API requests.

Run an automation action and configure automation parameters and inputs for supported automation types.

Use the Add to List procedure to add IPs, URLs, domains, or hashes to a list with optional conditions and duration settings.

Create IoC Management indicators by specifying indicator values and expiration settings in the Create IoC Management Indicators window.

Configure an API Request action in an automation and define the example output structure for API responses.

Use the AI Request step to send a prompt to a connected AI provider and use the model's response in subsequent steps.

Configure and create an isolation action for an endpoint device. Specify the endpoint product, device details, isolation duration, and reason for isolation.

Scan an Endpoint Security device by configuring target identification, scan options, and scheduling parameters.

Terminate a process on an Endpoint Security device by configuring target details and action settings.

Delete a file on an Endpoint Security device by configuring the target device and file path settings. This task explains how to create the delete file action.

You can export and import an automation in JSON format. This task explains how to export an automation and import an automation file.

You can clone an existing automation for editing and customization. This task explains how to clone an automation from the card view and table view.

This topic describes the different automation capability types, their use cases, abilities, and editing restrictions.

Replace Trigger allows you to change the current trigger type in your automation to a different one. This topic explains how to replace a trigger, configure the new trigger, and resolve validation errors.

You can add new steps between existing steps in an automation to extend the flow without creating a new automation. When you add a Condition or Ask step, you must specify how the automation continues to the next step.

This task explains how to trigger an automation using a webhook. It outlines the required steps to configure and create a webhook.

This task describes how to trigger a custom automation using a webhook and configure its parameters. It guides users through adding a webhook trigger and defining the example output.

This task describes how to trigger a cloned automation using a webhook. It guides you through replacing the trigger and configuring webhook parameters.

This topic describes how to create a webhook, configure its URL and expiration date, and optionally apply authentication. It also provides guidance on managing exposed or expired webhook URLs.

This topic explains how to map incoming webhook payload fields to the expected structure using Webhook Parameters. It describes scenarios where field names or formats differ from the Example Output.

This topic describes how to use a webhook after it has been created. It provides step-by-step instructions for configuration and usage.

This task describes how to create a new authentication. It guides users through selecting authentication types and configuring related options.

This topic lists supported authentication methods for webhook triggers and API requests. It describes available basic, custom, and token-based authentication options.

This topic describes Identity and Trust Enforcement, its related network objects, and the procedures to enable and configure Check Point Firewall Enforcement. It provides step-by-step instructions for managing enforcement and automation settings.

This topic describes configuration options for Check Point Firewall Managements and firewall capabilities. It outlines how management connections and configuration sharing affect enforcement behavior.

This task describes how to configure the ServiceNow Ticketing connector in Playblocks. Follow the steps to enable and set up the connector.

This topic describes how to provide write permissions required to reset a user password in Entra ID. It guides you through assigning the appropriate role to the application.

This task describes how to configure a SentinelOne connector in Playblocks. Follow the steps to enable the connector and provide required credentials.

This topic describes how to configure IOC Enforcement connectors and enable integrations with supported security platforms. It provides step-by-step instructions for setup, validation, and enforcement options.

This topic describes supported parameter reference types and how they enable dynamic retrieval of values from automation steps or parameters. It also outlines the characteristics of each reference type.

This topic lists the available step categories used within automation workflows. It provides quick navigation to each category type.

This topic describes trigger types and their parameters for automation workflows. It includes log, schedule, and webhook triggers with detailed parameter schemas and examples.

This topic describes notification-related automation steps including Ask, Notify, and Open Ticket. It provides parameter schemas, detailed descriptions, and examples.

This topic describes enrichment steps that gather additional information about IPs, URLs, and files. It includes parameter schemas, details, and examples for each enrichment type.

This topic describes conditional logic steps used in automation flows and details their parameters and usage. It includes schema definitions, parameter descriptions, and example structures.

Describes actions, schemas, parameters, and examples for automation, list management, IOC creation, and running automation tasks. Provides detailed structures and valid input formats.

This topic describes common structured data types used for duration values and event detail definitions. It includes specifications for TimeInterval and EventDetails formats.

Describes rules for parameter behavior, validation requirements, optional fields, string length limits, and trigger output expectations in automation flows.