Data Source: Check Point Harmony Email Logs | Detection.FYI

Elastic Defend and Email Alerts Correlation

Sep 19, 2026 · Use Case: Threat Detection Rule Type: Higher-Order Rule Resources: Investigation Guide Data Source: Elastic Defend Data Source: Check Point Harmony Email & Collaboration Domain: Email Domain: Endpoint Noise: Low Performance: Fast Profile: Recommended Rule Type: ES|QL Data Source: Check Point Harmony Email Logs ·
Share on:

This rule correlates any Elastic Defend alert with an email security related alert by target user name. This may indicate the successful execution of a phishing attack.

Read More