> ## Documentation Index > Fetch the complete documentation index at: https://docs.rallied.ai/llms.txt > Use this file to discover all available pages before exploring further. # Avanan (Check Point Email Security) > How Rallied connects to a Check Point MSSP account, creates one Email Security API key per customer tenant, and works quarantine and phishing tickets. Connect your Check Point MSSP account and the agent works email security tickets for every customer tenant without a technician opening the Infinity Portal. When a user reports a quarantined email or a suspicious message, the agent finds the event in that customer's Check Point tenant, reads what Check Point decided and why, and proposes the fix: restore the email, quarantine a delivered one, or add an exception. Every change waits for a technician's approval. It covers whatever SaaS apps the customer's Check Point tenant protects: Microsoft 365 and Google Workspace mail first, and SharePoint, OneDrive, Teams, Slack, Box and Dropbox when they are connected there. ## What Rallied creates in customer tenants > [!NOTE] > > Rallied creates **one Email Security API key in each customer tenant** that is matched to a Rallied client. It creates nothing until you confirm it in the setup, and it creates no key in a tenant that is not matched. Each key: * is created inside the customer's tenant in the Infinity Portal, under that tenant's **Settings → API Keys**; * is an Account API key for the **Email & Collaboration** service with the **Admin** role, which the quarantine and exception tools need; * is named with the label you choose plus a short code, for example `Rallied a1b2c3d4`. The default label is `Rallied`; you can change it on the integration's page at any time. Administrators with access to that tenant see the name, so choose one that makes sense to them; * shows the id of your MSSP account under **Created By**, because the key is created by your account's API key rather than by a person. Check Point does not let the creator's name be set; * has no expiration. Rallied removes it when you unmatch the client, when the tenant leaves your MSSP account, when you disconnect the integration, or when the MSP is deleted in Rallied. Rallied only ever deletes a key by the id it recorded when it created that key, or a leftover of its own exact name (a key it created but could not record, a temporary key it could not delete). It never touches a key created by anyone else. A matched tenant where the new key cannot work gets no key for now: a tenant **without Harmony Email & Collaboration** (the key reads no portal) is checked again the next day, and a tenant with **more than one Email Security portal** is not supported yet and is checked again the next week. The setup and the integration's page show these as "matched tenants without Email Security", apart from a tenant where Check Point refused or did not answer, which is retried at the next sync. ### Why one key per tenant An Email Security API key reads only the tenant it was created in. A key created in the MSSP account itself covers the MSSP's own tenant and none of its customers, so a single key cannot serve an MSSP. Check Point's documented path for MSSPs is the one Rallied follows: the MSSP account's API key creates an API key for each child account, and that child key is used to work in the child account. See [Create an API key for a child account](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Infinity-Portal-MSSP-Admin-Guide/Content/Topics-Infinity-Portal/API-Keys.htm) in the Check Point Portal MSSP Administration Guide. ## Prerequisites * A Check Point account of the **MSSP** type, with your customers as its child accounts (the Infinity Portal's **Manage Accounts** page lists them). Each customer you want the agent to work on needs **Harmony Email & Collaboration** active in its tenant. * An **Account API key** of the MSSP account itself: service **Infinity Portal** (the guide calls it "Check Point Portal"), role **Admin**. Rallied uses it to list your customer tenants and to create and remove its own API keys in them; it reads no email data by itself. * Company mapping enabled on your Rallied account, so you can match a tenant to a client by hand. Ask Rallied support if the setup says it is off. ## How to connect **1. Create the MSSP account's API key** Sign in to the [Infinity Portal](https://portal.checkpoint.com) on your **MSSP account** (not a customer's). Open **Global Settings → API Keys** and click **New → Account API key**. Choose the service **Infinity Portal** and the role **Admin**. Copy the **Client ID** and the **Secret Key**. Check Point shows the secret only once. **2. Connect Avanan in Rallied** In Rallied, go to **Settings → Integrations**, find **Avanan (Check Point Email Security)** and click **Connect**. Choose your **Region** (USA, Europe, Canada, Australia, United Kingdom or India) and enter the **Client ID** and **Secret Key**. Rallied validates the credential and stores it. Nothing is created in Check Point yet. **3. Find your customers' Check Point tenants** The setup opens. Click **Sync companies**. Rallied lists the customer tenants of your MSSP account that have Email Security and matches each one to the client it belongs to in Rallied. A tenant with the same name as a client is matched by itself; the others wait for you. **4. Create the API keys** The second step explains what is created, where it shows up and how it is removed, and asks for the **Key name**. Click **Create keys**. Rallied records your confirmation and creates one key in each tenant already matched to a client. A tenant you match later gets its key by itself, right after you match it. ## Matching tenants to clients After the setup, the integration's page shows how many tenants are matched and how many still wait. Click **Pick the client for N waiting tenants** (or the banner's **Pick the clients**) to open the matching cards: one card per tenant, with the client Rallied thinks it belongs to. Confirm it, pick another client, or ignore the tenant. The client list offers the clients that exist in your PSA. A tenant can only be matched to a client your PSA knows. When you close the cards, Rallied syncs once more and creates the key of every tenant you just matched. The **Companies** tab lists every tenant and its client. A client with no matched tenant is left alone: the agent stops instead of acting on the wrong tenant. ## When a key is removed | What happens | What Rallied does | | - | - | | You unmatch a tenant from its client | Removes that tenant's key at the next sync | | A tenant leaves your MSSP account (the customer is offboarded) | Removes its key at the next sync | | You disconnect the integration | Removes every key it created, in every tenant | | You update the connection with a new secret of the **same** MSSP account | Keeps the keys and your confirmation | | You reconnect with **another** MSSP account or region | Removes the keys of the old account first, then asks for your confirmation again | | You delete the MSP in Rallied | Removes every key first; if one cannot be removed, the MSP is not deleted and the reason says so | | Check Point no longer accepts your MSSP account's key (deleted or rotated there) | Rallied cannot remove the keys with it. Disconnect names the keys still alive: connect again with a working key of the **same** account (Rallied keeps the keys when the account is the same) and disconnect again, or delete those keys by hand under each tenant's **Settings → API Keys** and disconnect again. A reconnect with **another** account is refused until then | > [!NOTE] > > To remove a key from a customer's tenant, Check Point requires a key of that tenant. For a few seconds Rallied creates a temporary key of the **Infinity Portal** service there, named with your label, the key's short code and `temp` plus a code (for example `Rallied a1b2c3d4 temp k9x2-7f1e`), uses it to delete the Email Security key, and deletes the temporary key with its own token. A temporary key a failed attempt left behind is removed by the next removal in that tenant; if one could ever not be deleted, Rallied logs its id so you can remove it under that tenant's **Settings → API Keys**. If an administrator deletes a Rallied key in a tenant's portal, the agent's next call on that customer fails once, Rallied forgets the key, and the next sync or call creates a new one. ## Disconnecting Click **Disconnect** on the integration's page and type **Avanan (Check Point Email Security)** to confirm. Rallied removes every key it created in your customers' tenants (a few tenants at a time; with many tenants it takes a few minutes, and a second Disconnect meanwhile is refused), deletes its stored copy of your MSSP credential, and the agent stops using Check Point tools. If a key cannot be removed, nothing is disconnected and the message names it. If the disconnect fails after the keys were removed, Rallied asks for your confirmation again before it creates any key. The MSSP account's own API key (the one you created in step 1) stays yours: delete it in the Infinity Portal's **Settings → API Keys** if you no longer need it. ## How the agent uses it On a client's ticket, the agent reads and acts only in that client's tenant. It fills in the tenant automatically; it cannot name another customer's tenant. A typical "my email was quarantined" ticket: 1. The agent searches the customer's quarantine for the sender, subject or time the user describes. 2. It opens the event and reads Check Point's verdict (phishing, malware, DLP, spam) and the actions still available. 3. It proposes the action in the ticket: restore the email, keep it quarantined, or add an allow or block exception. A technician approves before anything changes. ## Tools Reads default to **Auto**; every change defaults to **Approval needed**. To change a default, open the **Policies** tab on **Settings → Integrations → Avanan (Check Point Email Security)**. See [Approval settings](https://docs.rallied.ai/dashboard/policies.md). | Tool | Default policy | Description | | - | - | - | | `avanan-list-events` | Auto | List the customer's quarantine and security events in a time window, with the verdict and the actions available on each | | `avanan-get-event` | Auto | Open one security event: its details, what was done about it, what is still available | | `avanan-list-entities` | Auto | Search the emails, files and messages Check Point is tracking for the customer | | `avanan-get-entity` | Auto | Open one protected email or file with its scan results | | `avanan-list-exceptions` | Auto | List the standing allow and block rules for senders, domains and IPs | | `avanan-list-security-exceptions` | Auto | List the standing DLP, anti-malware and URL-reputation exceptions | | `avanan-restore-email` | Approval needed | Take an email out of quarantine and put it back in the recipient's inbox | | `avanan-take-entity-action` | Approval needed | Run an action Check Point offers on a protected email or file, such as quarantine | | `avanan-take-event-action` | Approval needed | Run an action Check Point offers on a security event | | `avanan-add-exception` | Approval needed | Add an allow or block rule for a sender, domain or IP | | `avanan-add-security-exception` | Approval needed | Add a DLP or URL-reputation exception | | `avanan-remove-security-exception` | Approval needed | Remove a DLP or URL-reputation exception | Sender, domain and IP exceptions can be added and listed, not removed; anti-malware exceptions can only be listed. ## Sources * [Check Point Portal MSSP Administration Guide, API Keys](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Infinity-Portal-MSSP-Admin-Guide/Content/Topics-Infinity-Portal/API-Keys.htm): the MSSP account's API key creates a key for each child account. * [Check Point Portal Administration Guide, API Keys](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Infinity-Portal-Admin-Guide/Content/Topics-Infinity-Portal/API-Keys.htm): account API keys, services, roles, how to delete a key. * [Harmony Email & Collaboration Smart API](https://app.swaggerhub.com/apis-docs/Check-Point/harmony-email-collaboration-smart-api/1.50): the API the tools call. * [Infinity Portal API](https://app.swaggerhub.com/apis-docs/Check-Point/infinity-portal-api/1.0.6): authentication and tenant management. ## See also * [Approval settings](https://docs.rallied.ai/dashboard/policies.md) * [Clients](https://docs.rallied.ai/dashboard/clients.md) * [Integrations](https://docs.rallied.ai/dashboard/integrations.md) * [Integrations overview](https://docs.rallied.ai/integrations/overview.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.