Skip to main content
Connect your Check Point MSSP account and the agent works email security tickets for every customer tenant without a technician opening the Infinity Portal. When a user reports a quarantined email or a suspicious message, the agent finds the event in that customer’s Check Point tenant, reads what Check Point decided and why, and proposes the fix: restore the email, quarantine a delivered one, or add an exception. Every change waits for a technician’s approval. It covers whatever SaaS apps the customer’s Check Point tenant protects: Microsoft 365 and Google Workspace mail first, and SharePoint, OneDrive, Teams, Slack, Box and Dropbox when they are connected there.

​
What Rallied creates in customer tenants

Rallied creates one Email Security API key in each customer tenant that is matched to a Rallied client. It creates nothing until you confirm it in the setup, and it creates no key in a tenant that is not matched.
Each key:
  • is created inside the customer’s tenant in the Infinity Portal, under that tenant’s Settings → API Keys;
  • is an Account API key for the Email & Collaboration service with the Admin role, which the quarantine and exception tools need;
  • is named with the label you choose plus a short code, for example Rallied a1b2c3d4. The default label is Rallied; you can change it on the integration’s page at any time. Administrators with access to that tenant see the name, so choose one that makes sense to them;
  • shows the id of your MSSP account under Created By, because the key is created by your account’s API key rather than by a person. Check Point does not let the creator’s name be set;
  • has no expiration. Rallied removes it when you unmatch the client, when the tenant leaves your MSSP account, when you disconnect the integration, or when the MSP is deleted in Rallied.
Rallied only ever deletes a key by the id it recorded when it created that key, or a leftover of its own exact name (a key it created but could not record, a temporary key it could not delete). It never touches a key created by anyone else. A matched tenant where the new key cannot work gets no key for now: a tenant without Harmony Email & Collaboration (the key reads no portal) is checked again the next day, and a tenant with more than one Email Security portal is not supported yet and is checked again the next week. The setup and the integration’s page show these as “matched tenants without Email Security”, apart from a tenant where Check Point refused or did not answer, which is retried at the next sync.

​
Why one key per tenant

An Email Security API key reads only the tenant it was created in. A key created in the MSSP account itself covers the MSSP’s own tenant and none of its customers, so a single key cannot serve an MSSP. Check Point’s documented path for MSSPs is the one Rallied follows: the MSSP account’s API key creates an API key for each child account, and that child key is used to work in the child account. See Create an API key for a child account in the Check Point Portal MSSP Administration Guide.

​
Prerequisites

  • A Check Point account of the MSSP type, with your customers as its child accounts (the Infinity Portal’s Manage Accounts page lists them). Each customer you want the agent to work on needs Harmony Email & Collaboration active in its tenant.
  • An Account API key of the MSSP account itself: service Infinity Portal (the guide calls it “Check Point Portal”), role Admin. Rallied uses it to list your customer tenants and to create and remove its own API keys in them; it reads no email data by itself.
  • Company mapping enabled on your Rallied account, so you can match a tenant to a client by hand. Ask Rallied support if the setup says it is off.

​
How to connect

1

Create the MSSP account's API key

Sign in to the Infinity Portal on your MSSP account (not a customer’s). Open Global Settings → API Keys and click New → Account API key. Choose the service Infinity Portal and the role Admin. Copy the Client ID and the Secret Key. Check Point shows the secret only once.
2

Connect Avanan in Rallied

In Rallied, go to Settings → Integrations, find Avanan (Check Point Email Security) and click Connect. Choose your Region (USA, Europe, Canada, Australia, United Kingdom or India) and enter the Client ID and Secret Key. Rallied validates the credential and stores it. Nothing is created in Check Point yet.
3

Find your customers' Check Point tenants

The setup opens. Click Sync companies. Rallied lists the customer tenants of your MSSP account that have Email Security and matches each one to the client it belongs to in Rallied. A tenant with the same name as a client is matched by itself; the others wait for you.
4

Create the API keys

The second step explains what is created, where it shows up and how it is removed, and asks for the Key name. Click Create keys. Rallied records your confirmation and creates one key in each tenant already matched to a client. A tenant you match later gets its key by itself, right after you match it.

​
Matching tenants to clients

After the setup, the integration’s page shows how many tenants are matched and how many still wait. Click Pick the client for N waiting tenants (or the banner’s Pick the clients) to open the matching cards: one card per tenant, with the client Rallied thinks it belongs to. Confirm it, pick another client, or ignore the tenant. The client list offers the clients that exist in your PSA. A tenant can only be matched to a client your PSA knows. When you close the cards, Rallied syncs once more and creates the key of every tenant you just matched. The Companies tab lists every tenant and its client. A client with no matched tenant is left alone: the agent stops instead of acting on the wrong tenant.

​
When a key is removed

To remove a key from a customer’s tenant, Check Point requires a key of that tenant. For a few seconds Rallied creates a temporary key of the Infinity Portal service there, named with your label, the key’s short code and temp plus a code (for example Rallied a1b2c3d4 temp k9x2-7f1e), uses it to delete the Email Security key, and deletes the temporary key with its own token. A temporary key a failed attempt left behind is removed by the next removal in that tenant; if one could ever not be deleted, Rallied logs its id so you can remove it under that tenant’s Settings → API Keys.
If an administrator deletes a Rallied key in a tenant’s portal, the agent’s next call on that customer fails once, Rallied forgets the key, and the next sync or call creates a new one.

​
Disconnecting

Click Disconnect on the integration’s page and type Avanan (Check Point Email Security) to confirm. Rallied removes every key it created in your customers’ tenants (a few tenants at a time; with many tenants it takes a few minutes, and a second Disconnect meanwhile is refused), deletes its stored copy of your MSSP credential, and the agent stops using Check Point tools. If a key cannot be removed, nothing is disconnected and the message names it. If the disconnect fails after the keys were removed, Rallied asks for your confirmation again before it creates any key. The MSSP account’s own API key (the one you created in step 1) stays yours: delete it in the Infinity Portal’s Settings → API Keys if you no longer need it.

​
How the agent uses it

On a client’s ticket, the agent reads and acts only in that client’s tenant. It fills in the tenant automatically; it cannot name another customer’s tenant. A typical “my email was quarantined” ticket:
  1. The agent searches the customer’s quarantine for the sender, subject or time the user describes.
  2. It opens the event and reads Check Point’s verdict (phishing, malware, DLP, spam) and the actions still available.
  3. It proposes the action in the ticket: restore the email, keep it quarantined, or add an allow or block exception. A technician approves before anything changes.

​
Tools

Reads default to Auto; every change defaults to Approval needed. To change a default, open the Policies tab on Settings → Integrations → Avanan (Check Point Email Security). See Approval settings. Sender, domain and IP exceptions can be added and listed, not removed; anti-malware exceptions can only be listed.

​
Sources

​
See also