SaaS platform to query: office365_emails or google_mail
Yes
office365_emails
lookback_days
(SearchBySender/ByDomain/ByURL/BySenderIP) How many days back to search
No
90
portal_url
Portal base URL for direct links to emails (for example https://COMPANYID.checkpointcloudsec.com)
No
N/A
The search analyzers query a single page of results from the HEC API. If more results exist, the report sets results_truncated: true and the email-count taxonomy shows a + suffix (for example Emails: 100+). Narrow the lookback_days window or check the Infinity Portal for the full list.
Observable type: file (.eml) or other (Message-ID string, with or without angle brackets)
Description: Extracts the Message-ID from an .eml file (or takes it directly from an other observable), searches for the email in HEC, and returns full details including security verdicts, email metadata, links, and status flags.
When emails are reported by users to a security mailbox and then imported into TheHive, the .eml is typically a forwarded envelope where the reporter appears as the sender. This analyzer automatically detects if the .eml contains an attached original email (message/rfc822 MIME part) and extracts the Message-ID from the inner message instead. If no inner message is found, it falls back to the outer envelope's Message-ID. This requires no configuration; it works transparently.
Description: Searches HEC for all emails from a given sender address. Returns a count, verdict breakdown, and a list of all matching emails with their verdicts and status. When run on an .eml file, the sender address is extracted automatically (with forwarded email unwrapping).
Useful for assessing whether a sender is a repeat offender or broadly compromised.
Description: Searches HEC for all emails from a given sender domain. Returns the same result structure as SearchBySender. When run on an .eml file, the sender domain is extracted automatically (with forwarded email unwrapping).
Useful for evaluating domain-level reputation across the mailbox estate.
Description: Searches HEC for all emails containing a specific URL. Returns matching emails with their verdicts and exposure status.
Critical during phishing campaigns to gauge blast radius: how many users received an email with that link, how many read it, how many are still exposed.
Description: Searches HEC for all emails sent from a given server IP. When run on an .eml file, the sender IP is extracted from the first Received header (with forwarded email unwrapping), skipping private IPs when possible.
Useful when sender addresses rotate but the sending infrastructure stays the same.
Search for all emails from a sender domain in Check Point Harmony Email & Collaboration. Accepts a domain observable or an .eml file (sender domain is extracted automatically, with forwarded email support).
Search for an email in Check Point Harmony Email & Collaboration and retrieve its security verdict, phishing confidence, classification and scan results. Accepts an .eml file or a Message-ID as an 'other' observable.
Search for all emails from a sender IP in Check Point Harmony Email & Collaboration. Accepts an IP observable or an .eml file (sender IP is extracted from Received headers, with forwarded email support).
Search for all emails from a sender address in Check Point Harmony Email & Collaboration. Accepts a mail observable or an .eml file (sender is extracted automatically, with forwarded email support).