Check Point CloudGuard
Cloud Security- Overview
- Setup
- Data & mappings
- Operations & API
- Changelog
The Check Point CloudGuard connector integrates with the Check Point CloudGuard (Dome9) cloud security posture management platform via its Dome9 REST API. It synchronizes compliance findings and derives three Brinqa models from them: security Alerts (findings), the Alert Definitions (the underlying compliance rules), and the Cloud Resources (the cloud entities the findings were raised against). All three models are sourced from a single compliance-finding search; the connector deduplicates findings into definitions and resources locally before publishing them.
Data retrieved from Check Point CloudGuard
| Connector Object | Required | Maps to Data Model |
|---|---|---|
| Alert | Yes | Alert |
| Alert Definition | Yes | Alert Definition |
| CloudResource | Yes | Cloud Resource |
Model relationships
For detailed steps on how to view the data retrieved from Check Point CloudGuard in the Brinqa Platform, see How to view your data.
Connection settings
When setting up a data integration, select Check Point CloudGuard from the Connector dropdown and provide the following:
| Setting | Required | Default | Description |
|---|---|---|---|
| API URL | No | — | CloudGuard API URL |
| API ID | No | — | CloudGuard API ID |
| API Secret | No | — | CloudGuard API secret |
| Page size | No | — | Maximum number of records to get per API request |
Authentication
The connector authenticates to the Dome9 API using HTTP Basic authentication. The configured API ID is used as the Basic username and the API Secret as the Basic password. The credentials are validated at configuration time and sent on every API request via the standard Authorization: Basic <base64(apiId:apiSecret)> header.
Connection Test Endpoint
| Method | URL |
|---|---|
| GET | https://api.dome9.com/v2/Compliance/Finding/Sources |
The connector calls this endpoint during test() to verify the credentials and base URL.
Request Headers
| Header | Value |
|---|---|
Authorization | Basic <base64(apiId:apiSecret)> |
Accept | application/json |
Content-Type | application/json (for POST search requests) |
Credential Usage
There is no token-exchange step. The same Basic credential derived from the API ID and API Secret is attached to every subsequent request, including the paginated POST /v2/Compliance/Finding/search calls used to retrieve findings.
Sync Behavior
The connector supports incremental (delta) syncs. It maintains a sync token between runs and applies it as an incremental timestamp filter, so each run re-processes only the records that changed after the previous sync. The initial run retrieves the complete data set; later runs are incremental. The specific timestamp field applied to each object is documented under that object's Sync Duration Parameter.
How to obtain Check Point CloudGuard credentials
Generate Check Point CloudGuard API credentials
For the Check Point CloudGuard connector to use the CloudGuard API, you must provide API credentials. To generate API credentials, follow these steps.
-
Log in to your organization's Check Point CloudGuard portal as an administrator at https://secure.dome9.com/v2/.
-
Navigate to Settings > Account > Credentials.
-
Click Create API Key.
The API ID and API secret display. You cannot view the API secret again. Copy and save it to a secure location.
Note: If you do not have permissions to generate credentials, contact your CloudGuard administrator. For additional information, see Check Point documentation.
Attribute mappings
Expand the sections below to view the mappings between the source and the Brinqa data model attributes:
Alert
| Source Field Name | SDM Attribute |
|---|---|
BaseFinding.acknowledged | ACKNOWLEDGED |
BaseFinding.alertType | ALERT_TYPE |
BaseFinding.alertType + BaseFinding.category | CATEGORIES |
BaseFinding.bundleId | BUNDLE_ID |
BaseFinding.bundleName | BUNDLE_NAME |
BaseFinding.cloudAccountExternalId | CLOUD_ACCOUNT_EXTERNAL_ID |
BaseFinding.cloudAccountId | CLOUD_ACCOUNT_ID |
BaseFinding.cloudAccountType | CLOUD_ACCOUNT_TYPE |
BaseFinding.comments[].value | COMMENTS |
BaseFinding.createdTime | FIRST_FOUND |
BaseFinding.entityDome9Id | ENTITY_DOME9_ID |
BaseFinding.entityExternalId | TARGETS |
BaseFinding.entityName | ENTITY_NAME |
BaseFinding.entityNetwork | ENTITY_NETWORK |
BaseFinding.entityTags[].label | ENTITY_TAGS |
BaseFinding.entityType | ENTITY_TYPE |
BaseFinding.findingKey | FINDING_KEY |
BaseFinding.id | UID |
BaseFinding.isExcluded | EXCLUDED |
BaseFinding.lastSeenTime | LAST_FOUND |
BaseFinding.magellan.alertWindowEndTime | ALERT_WINDOW_END_TIME |
BaseFinding.magellan.alertWindowStartTime | ALERT_WINDOW_START_TIME |
BaseFinding.occurrences | OCCURRENCES |
BaseFinding.organizationalUnitId | ORG_ID |
BaseFinding.organizationalUnitPath | ORG_PATH |
BaseFinding.origin | ORIGIN |
BaseFinding.ownerUserName | OWNER_USER_NAME |
BaseFinding.region | REGION |
BaseFinding.remediationActions | REMEDIATION_ACTIONS |
BaseFinding.ruleId | TYPE |
BaseFinding.scanId | SCAN_ID |
BaseFinding.status | SOURCE_STATUS |
BaseFinding.status (normalized) | STATUS |
BaseFinding.tag | TAGS |
BaseFinding.updatedTime | SOURCE_LAST_MODIFIED |
derived from normalized BaseFinding.status | STATUS_CATEGORY |
Alert Definition
| Source Field Name | SDM Attribute |
|---|---|
BaseFinding.remediation | RECOMMENDATION |
BaseFinding.ruleId | UID |
BaseFinding.ruleLogic + BaseFinding.description | DESCRIPTION |
BaseFinding.ruleName | NAME |
BaseFinding.severity | SOURCE_SEVERITY |
BaseFinding.severity (normalized) | SEVERITY |
derived from normalized BaseFinding.severity | SEVERITY_SCORE |
CloudResource
| Source Field Name | SDM Attribute |
|---|---|
BaseFinding.entityExternalId | UID |
BaseFinding.entityName | NAME |
BaseFinding.entityNetwork | ENTITY_NETWORK |
BaseFinding.entityTags[].label | TAGS |
BaseFinding.entityType (with cloud-resource asset category) | CATEGORIES |
Operations & API
Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).
Alert
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint · Endpoint:
POST /v2/Compliance/Finding/search - Default filters:
filter.creationTime.from/to(applied only for incremental sync; see Sync Duration Parameter)
Alert Definition
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint · Endpoint:
POST /v2/Compliance/Finding/search - Default filters:
filter.creationTime.from/to(applied only for incremental sync; see Sync Duration Parameter)
CloudResource
Operation options
This object does not support any operation options.
Delta sync
Supported.
API
- Type: REST endpoint · Endpoint:
POST /v2/Compliance/Finding/search - Default filters:
filter.creationTime.from/to(applied only for incremental sync; see Sync Duration Parameter)
Changelog
The Check Point CloudGuard connector has undergone the following changes:
| Version | Description | Migration Steps |
|---|---|---|
| 3.0.3 | Bug Fixes - Corrected the data type of the Alert model's "Bundle ID" attribute from text to a number, to match the numeric identifier returned by the API (the value was previously coerced). | • Alert: the "Bundle ID" attribute changed from text to a number. Re-sync the Check Point CloudGuard connector to repopulate alerts with the corrected type. |
| 3.0.2 | Improvements - Connector-sourced attribute values now take precedence over non-connector data channels (manual edits, bulk imports, UI input) when the platform consolidates records, so Check Point CloudGuard data is no longer overridden by lower-priority sources. Bug Fixes - Corrected the data type of the Alert model's timestamp attributes — First found, Last found, Source last modified, Alert window start time, and Alert window end time. They are now stored as proper timestamps instead of numeric epoch values, so date-based filtering, sorting, and display behave correctly. | • Alert: the timestamp attributes listed above changed from numeric (epoch) values to timestamps. Re-sync the Check Point CloudGuard connector to repopulate Alert records with the corrected types. |
| 3.0.1 | Bug Fixes - Alert window start and end times are now parsed correctly from the Check Point CloudGuard API, so these timestamps populate reliably on Alert records instead of being dropped or misread. | N/A |
| 3.0.0 | Overview The Check Point CloudGuard connector integrates with Check Point CloudGuard to synchronize cloud security findings, the rules that generate them, and the cloud resources they affect. Category: Cloud Security Models | N/A |