Check Point Avanan: email threats, quarantine and protected users
5 min read · Updated Oct 19, 2026
Check Point Avanan, also called Harmony Email & Collaboration, protects your customers' Microsoft 365 and Google mailboxes. This connector reads each customer's email threats, the email Avanan holds in quarantine, and how many users are protected, every 15 minutes, and hangs it all off the matching company, so a phishing attack shows up where your team already looks.
What Current reads
| Data set | What Current stores | Where it lands |
|---|---|---|
| Customers | Each customer your API key reaches, and its user counts when Check Point's MSP tenant list returns them: users protected and users licensed. | The mapping panel on the Avanan card, and the company's Avanan card |
| Threats | The last 90 days of security events: phishing, malware, malicious links, data loss and anomalies, with their severity and whether they are still open. For an open critical or high threat, also the email's subject, sender and first recipient. | The company's Security cluster and Avanan card, and the security alert |
| Quarantine | The email Avanan holds in quarantine from the last 30 days: subject, sender, first recipient, when it arrived, and whether someone asked for it to be released. | The company's Avanan card |
Note
What Current deliberately does not store
Current never reads an email's body, attachments, links or headers, and never downloads a message. Subjects are kept short and shown to your staff only; they never reach a business review or an AI prompt.
Connect it
- 11 · Create an API key in the Infinity PortalSign in to the Check Point Infinity Portal as an MSP administrator, open Global Settings, then API Keys, and create a key for the Email & Collaboration service. Check Point shows the Secret Key once, so copy it before you close the window.
- 22 · Pick your regionPick the region your Infinity Portal account is in: United States, Europe, Canada, Australia, United Kingdom, United Arab Emirates or India. A key only works in the region it was created in.
- 33 · Paste the key and press Test connectionIn Current open Integrations, find Check Point Avanan under Security, paste the Client ID and the Secret Key, and press Test connection. Current signs in to Check Point, reads your customer list to prove the key works, and only then stores the key, server-side.
Note
Your key only ever goes to Check Point
You pick a region from a list, and Current sends the key only to that region's Check Point gateway. There is no address to type, and Current never follows a redirect to anywhere else.
Map customers to your companies
After the first sync, Current matches each Avanan customer to a company by its name. Names are compared with punctuation and suffixes like Inc and LLC removed, and a customer is matched only when exactly one company fits.
- 1Open the mapping panelIntegrations, then Check Point Avanan, then Manage, then Customer mapping. It opens on the Unmapped tab.
- 2Check the automatic matchesThe Mapped tab lists every linked customer. Unmap a wrong match and map it to the right company; a mapping you set by hand is never overwritten by a later sync.
- 3Map or ignore the restPress Map on an unmapped customer and pick its company. A customer that should never map (a test tenant, your own office) can be ignored.
The alert it raises
An open critical or high email threat counts toward the company's critical security alert, beside your EDR and SOC tools. It clears when the threat is resolved or dismissed in Avanan. Dangerous emails Avanan caught also count toward the phishing numbers on the company page and in business reviews.
When something looks wrong
| What you see | What it means |
|---|---|
| Test connection says Check Point rejected the key | The key and the region must match. Check that the key was created for the Email & Collaboration service in the region you picked, and create a new key if you are not sure. |
| The key reaches no customers | The key was probably created inside one customer's account rather than at the MSP level. Create it as an MSP administrator so it reaches every customer. |
| Users protected shows a dash | Check Point did not return the MSP tenant list for this key, or this customer was not on it. Current shows a dash rather than guessing a number. |
| A threat closed in Avanan still shows as open | Current re-reads open threats every 15 minutes. If it still shows after the next sync, press Sync now on the card. |
Note
Who can do this, and disconnecting
Connecting, testing, mapping and disconnecting are Tenant Admin actions. Disconnect stops the sync; the customers, threats and quarantined email already read stay where they are, and reconnecting picks up from there. Partner (read-only) viewers never see any of this data; it is blocked at the database, not just hidden.
Was this helpful?