--- title: Checkpoint XDR slug: connectors/checkpoint-xdr docTags: createdAt: 2026-06-09T16:29:33.526Z --- Checkpoint XDR is a security platform that provides extended detection and response capabilities across various environments. Checkpoint XDR is a comprehensive extended detection and response platform that provides advanced threat prevention and incident response capabilities. The Checkpoint XDR connector for Swimlane Turbine allows users to seamlessly integrate Checkpoint's incident management capabilities into their security automation workflows. By leveraging this integration, Swimlane Turbine users can efficiently retrieve and manage incidents, apply advanced filtering, and normalize data into the Turbine Schema for enhanced analysis and response. This integration empowers security teams to streamline their incident response processes, reduce manual effort, and improve overall security posture. ## Prerequisites Before you can use the Checkpoint XDR connector for Turbine, you'll need access to the Checkpoint XDR API. This requires the following: - Custom authentication using Check Point XDR external client credentials: - URL: The endpoint for accessing Checkpoint XDR services. - Client ID: Unique identifier for your application. - Access Key: Key used to authenticate API requests. - Client Key: Secret key associated with your client ID. ## Capabilities This Connector provides the following capabilities: - Capabilities - Go - Here - e.g. Manage Firewall Policies instead of listing each individual tasks ### Limitations Include information about known limitations here, including supported or minimum versions, especially known unsupported versions. ## Asset Setup The content here should discuss asset setup in a conversational manner. Be sure to include any known login and test connection errors. ## Tasks Setup Special task setup as needed depending on plugin, exclude if empty. Known available allowed input options from enum type selection ## Notes - Any other notes not fitting other sections go here. - Any reference URLs to external docs or other resources # Configurations ## Check Point XDR External Client Authentication Authenticates using Check Point XDR external client credentials (clientId and accessKey). ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ----------------------------------------- | -------- | ------------ | | url | Base URL for the Check Point XDR gateway. | string | Required | | client\_id | External client ID (UUID). | string | Required | | access\_key | External client access key (UUID). | string | Required | | ck | External client key identifier. | string | Required | | verify\_ssl | Verify SSL certificate. | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## List Incidents Retrieve paginated Checkpoint XDR incidents with optional filtering by time, limit, and offset. Optionally return results as normalized Turbine Schema alerts. ### Endpoint - **URL:** `/app/xdr/api/xdr/v1/incidents` - **Method:** `GET` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------------------- | -------- | ------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `parameters.filterBy` | string | Required | The time field to filter incidents by. | | `parameters.from` | string | Optional | Start date of the time frame (ISO 8601). Example: 2024-10-30T12:00:00Z. Defaults to 7 days ago. | | `parameters.to` | string | Optional | End date of the time frame (ISO 8601). Example: 2024-10-30T12:00:00Z. Defaults to today. | | `parameters.limit` | integer | Optional | Maximum number of incidents to return. Default is 1000. | | `parameters.offset` | integer | Optional | Number of incidents to skip for pagination. Default is 0. | | `parameters.return_as_turbine_schema` | boolean | Optional | If true, returns results as normalized Turbine Schema alerts instead of raw API response. | | `parameters.alert_organization` | string | Optional | Optional organization name to include in the Turbine Schema alert. Used only when return\_as\_turbine\_schema is true. | | `parameters.ioc_types` | array | Optional | List of observable types to extract. Supported: ipv4\_public, ipv4\_private, ipv6\_public, ipv6\_private, domain, url, email, sha1, sha256, md5. If omitted or empty, all types are extracted. | | `parameters.domains_ignore_list` | string | Optional | Comma-separated domain values to exclude from observable extraction. | | `parameters.ip_cidr_ignore_list` | string | Optional | Comma-separated CIDR ranges to exclude from observable extraction. | | `parameters.regex_ignore` | string | Optional | Regex pattern — any observable value matching this pattern is excluded. | | `parameters.ioc_ignore_paths` | array | Optional | Array of slash-separated field paths to strip from each alert before extracting observables. Supports wildcards (*) and nested paths. Example: \["processCommandLine", "context/*/ipAddress"]. | ### Input Example `{"parameters":{"filterBy":"updatedAt","from":"string","to":"string","limit":1000,"offset":123,"return_as_turbine_schema":true,"alert_organization":"string","ioc_types":["string"],"domains_ignore_list":"string","ip_cidr_ignore_list":"string","regex_ignore":"string","ioc_ignore_paths":["string"]}}` ### Output | **Parameter** | **Type** | **Description** | | ---------------------------- | -------- | ------------------------------------------------------------------ | | `status_code` | integer | HTTP status code of the response. | | `incidents` | array | Raw list of incidents (when return\_as\_turbine\_schema is false). | | `incidents.id` | string | Unique identifier | | `incidents.display_id` | integer | Unique identifier | | `incidents.summary` | string | Unique identifier | | `incidents.status` | string | Unique identifier | | `incidents.severity` | string | Unique identifier | | `incidents.confidence` | string | Unique identifier | | `incidents.priority` | string | Unique identifier | | `incidents.is_prevented` | boolean | Unique identifier | | `incidents.followUp` | boolean | Unique identifier | | `incidents.assignee` | string | Unique identifier | | `incidents.assigneeName` | string | Unique identifier | | `incidents.assigneeEmail` | string | Unique identifier | | `incidents.tenantId` | string | Unique identifier | | `incidents.created_at` | string | Unique identifier | | `incidents.updated_at` | string | Unique identifier | | `incidents.firstSeen` | string | Unique identifier | | `incidents.lastSeen` | string | Unique identifier | | `incidents.mitre_tactics` | array | Unique identifier | | `incidents.mitre_techniques` | array | Unique identifier | | `incidents.sensors` | array | Unique identifier | | `incidents.indicators` | array | Unique identifier | | `incidents.indicators.type` | string | Unique identifier | | `incidents.indicators.value` | string | Unique identifier | ### Output Example `{"incidents":[{"id":"12345678-1234-1234-1234-123456789abc","display_id":123,"summary":"string","status":"active","severity":"string","confidence":"string","priority":"string","is_prevented":true,"followUp":true,"assignee":"string","assigneeName":"Example Name","assigneeEmail":"string","tenantId":"string","created_at":"string","updated_at":"string"}],"Alerts":[{"alert_uid":"string","alert_title":"string","alert_description":"string","alert_severity":"string","alert_priority":"string","alert_creat...` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |