🧪 Community ✓ Claude Code ✓ Claude Desktop 🔌 Requires MCP Server • Email Security
Checkpoint Avanan
Checkpoint Harmony Email & Collaboration (Avanan) - quarantine and restore, threat event search, and allow/block-list exceptions
🔌 Recommended MCP Server
Pair this plugin with the Avanan MCP for direct API access alongside skills and commands.
Installation
Install this plugin individually:
/plugin marketplace add wyre-technology/msp-claude-plugins --plugin checkpoint-avanan Or install all MSP plugins at once:
/plugin marketplace add wyre-technology/msp-claude-plugins Features
- Exceptions
- Quarantine
- Threats
Skills
This plugin provides 4 skills that teach Claude about Checkpoint Avanan:
| Skill | Description |
|---|---|
exceptions | The Checkpoint Harmony Email (Avanan) whitelist and blacklist surface: the match fields and matching modes an exception accepts, the defaults that widen an entry beyond what was typed, the id mismatch between listing and editing, and the standing security consequence of a detection bypass. |
quarantine | Finding and acting on mail in Checkpoint Harmony Email (Avanan): the `hec_search_emails` attribute-filter syntax, what an entity payload carries, the asynchronous quarantine and restore actions and their task polling, and the judgement a restore requires because delivery cannot be undone. |
threats | The Checkpoint Harmony Email (Avanan) security-event surface: the event type, state, severity and SaaS enums accepted by `hec_query_events`, what a detection record does and does not carry, how `availableEventActions` governs what you can do next, and phishing, BEC and malware triage built on those fields. |
api-patterns | Shape of the Checkpoint Harmony Email (Avanan) `hec_*` tool surface: the thirteen tools and what each reaches, the event/entity split that governs which tool accepts which id, the `responseEnvelope`/`responseData` result shape, `scrollId` pagination, and the auth, regional-routing and farm-scope behaviour behind every call. |
Agents
This plugin provides 2 agents for autonomous task execution:
| Agent | Description |
|---|---|
cloud-email-defender | Use this agent when investigating security detections, locating or releasing quarantined mail, or managing sender allow and block entries in Checkpoint Harmony Email & Collaboration (Avanan). |
exception-hygiene-auditor | Use this agent for a periodic read-only review of the sender allow and block entries in Checkpoint Harmony Email & Collaboration (Avanan) — finding exceptions that are undocumented, scoped wider than intended, stale, or still suppressing live detections. |
Commands
Available slash commands:
| Command | Description |
|---|---|
/check-threat | Pull full detail for one Checkpoint Harmony Email detection and the message behind it |
/release-quarantine | Restore quarantined mail to its recipients in Checkpoint Harmony Email, with task polling |
/search-quarantine | Find messages in Checkpoint Harmony Email by sender, subject, attachment hash or quarantine state |
/search-threats | Sweep security events in Checkpoint Harmony Email by type, state, severity and date range |
API Reference
| Base URL | |
| Authentication | |
| Rate Limit | |
| Documentation |
Example Usage
Pull full detail for one Checkpoint Harmony Email detection and the message behind it
/check-threatRestore quarantined mail to its recipients in Checkpoint Harmony Email, with task polling
/release-quarantineFind messages in Checkpoint Harmony Email by sender, subject, attachment hash or quarantine state
/search-quarantineSweep security events in Checkpoint Harmony Email by type, state, severity and date range
/search-threatsUsing Skills
/skill checkpoint-avanan:exceptions
The Checkpoint Harmony Email (Avanan) whitelist and blacklist surface: the match fields and matching modes an exception accepts, the defaults that widen an entry beyond what was typed, the id mismatch between listing and editing, and the standing security consequence of a detection bypass.