Adding Checkpoint HEC response integration by chkp-arvidb · Pull Request #707 · chronicle/content-hub

chkp-arvidb · 2026-04-21T15:58:56Z

Title (Please follow the convention below)

Please use a clear and concise title that summarizes your changes.
If this PR is related to an internal Buganizer ticket, please include its ID at the beginning.

Convention: [Optional Buganizer ID: 123456789] Short, descriptive title of changes

Examples:

Fix: Resolve issue with API endpoint returning 500 error
[Buganizer ID: 987654321] Feature: Add support for custom data types
Docs: Update README with installation instructions

Description

Please provide a detailed description of your changes. This helps reviewers understand your work and its context.

What problem does this PR solve?
(e.g., "Fixes a bug where X was happening," "Implements feature Y to allow Z," "Improves performance of function A.")

How does this PR solve the problem?
(e.g., "Modified algorithm in src/foo.js," "Added new component Bar.vue," "Updated dependency baz to version 1.2.3.")

Any other relevant information (e.g., design choices, tradeoffs, known issues):
(e.g., "Chose approach A over B due to performance considerations," "This change might affect X in certain edge cases," "Requires manual migration steps for existing users.")

Checklist:

Please ensure you have completed the following items before submitting your PR.
This helps us review your contribution faster and more efficiently.

General Checks:

I have read and followed the project's contributing.md guide.
My code follows the project's coding style guidelines.
I have performed a self-review of my own code.
My changes do not introduce any new warnings.
My changes pass all existing tests.
I have added new tests where appropriate to cover my changes. (If applicable)
I have updated the documentation where necessary (e.g., README, API docs). (If applicable)

Open-Source Specific Checks:

My changes do not introduce any Personally Identifiable Information (PII) or sensitive customer data.
My changes do not expose any internal-only code examples, configurations, or URLs.
All code examples, comments, and messages are generic and suitable for a public repository.
I understand that any internal context or sensitive details related to this work are handled separately in internal systems (Buganizer for Google team members).

For Google Team Members and Reviewers Only:

I have included the Buganizer ID in the PR title or description (e.g., "Internal Buganizer ID: 123456789" or "Related Buganizer: go/buganizer/123456789").
I have ensured that all internal discussions and PII related to this work remain in Buganizer.
I have tagged the PR with one or more labels that reflect the pull request purpose.

Screenshots (If Applicable)

If your changes involve UI or visual elements, please include screenshots or GIFs here.
Ensure any sensitive data is redacted or generalized.

Further Comments / Questions

Any additional comments, questions, or areas where you'd like specific feedback.

google-cla · 2026-04-21T15:59:14Z

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

gemini-code-assist · 2026-04-21T15:59:28Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new integration for Check Point HEC, enabling users to interact with the platform directly from the SOAR environment. It provides a suite of actions for managing security exceptions, searching for emails, and performing remediation actions on entities, significantly enhancing the automation capabilities for security operations teams.

Highlights

New Integration: Added a comprehensive Check Point HEC integration, including support for managing exceptions, searching emails, and performing actions on entities.
Action Support: Implemented a wide range of actions such as creating, updating, and deleting exceptions for various security tools (Anti-Phishing, Anti-Malware, Avanan DLP/URL) and managing Click Time Protection lists.
API Client Infrastructure: Established a robust API client structure supporting both Cloud Infrastructure and Smart API authentication methods.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces the Check Point HEC integration, which includes actions for email searching, event management, and exception handling for various security tools. The review feedback highlights several critical improvements needed to meet repository standards, such as correcting parameter extraction logic, preventing PII leakage in logs, and providing mandatory unit tests and JSON result examples. Additionally, the feedback identifies multiple style guide violations concerning imports, docstrings, and standard Ping action messages, while also advising the removal of commented-out code and placeholder text in the project configuration.

gemini-code-assist · 2026-04-21T16:02:06Z

+[project]
+name = "CheckPointHEC"
+version = "1.0"
+description = "Add your description here"
+requires-python = ">=3.11,<3.12"
+dependencies = [
+    "cached-property>=2.0.1",
+    "dateparser>=1.3.0",
+    "environmentcommon",
+    "python-jose>=3.5.0",
+    "requests>=2.32.5",
+    "tipcommon",
+]
+
+[dependency-groups]
+dev = [
+    "pytest>=9.0.2",
+    "soar-sdk",
+    "integration-testing",
+    "pytest-json-report>=1.5.0",
+]
+
+[tool.pytest.ini_options]
+pythonpath = "."
+
+[tool.uv.sources]
+soar-sdk = { git = "https://github.com/chronicle/soar-sdk" }
+tipcommon = { path = "../../../../../packages/tipcommon/whls/TIPCommon-2.3.1-py3-none-any.whl" }
+environmentcommon = { path = "../../../../../packages/envcommon/whls/EnvironmentCommon-1.0.3-py3-none-any.whl" }
+integration-testing = { path = "../../../../../packages/integration_testing_whls/integration_testing-2.3.1-py3-none-any.whl" }


New integrations added to content/response_integrations/** must include corresponding unit tests using pytest. Please add a tests/ directory with test suites modeled after the reference examples in the style guide.

References

All new features, bug fixes, or integrations added to content/response_integrations/** must include corresponding unit tests. ^(link)

gemini-code-assist · 2026-04-21T16:02:06Z

+ERROR_MESSAGE: str = "Failed creating Anomaly exception!"
+
+
+class CreateAnomalyException(BaseAction):


Classes and methods should have Google-style docstrings to improve maintainability and readability.

References

Follow the Google Style Docstrings for all modules, classes, and functions. ^(link)

gemini-code-assist · 2026-04-21T16:02:06Z

+    def _perform_action(self, _=None) -> None:
+        request_json = json.loads(self.params.request_json)
+        added_by = self.params.added_by
+        self.json_results = self.api_client.create_anomaly_exception(request_json=request_json, added_by=added_by)


Since this action assigns a value to self.json_results, a corresponding JSON example file must be provided in the resources/ directory following the naming convention: resources/create_anomaly_exc_JsonResult_example.json.

References

If a JSON result is detected, a corresponding JSON example file must exist in the integration's resources/ directory. ^(link)

Adding Checkpoint HEC response integration

414b566

gemini-code-assist Bot reviewed Apr 21, 2026

View reviewed changes

chkp-arvidb added 2 commits April 21, 2026 14:23

Address checks

35cf294

Merge branch 'main' into checkpoint-hec-soar

8a2402b

chkp-arvidb marked this pull request as ready for review April 21, 2026 18:35

chkp-arvidb requested a review from a team as a code owner April 21, 2026 18:35

Merge branch 'main' into checkpoint-hec-soar

b456011

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding Checkpoint HEC response integration#707

Adding Checkpoint HEC response integration#707
chkp-arvidb wants to merge 4 commits intochronicle:mainfrom
CheckPointSW:checkpoint-hec-soar

chkp-arvidb commented Apr 21, 2026

Uh oh!

google-cla Bot commented Apr 21, 2026

Uh oh!

gemini-code-assist Bot commented Apr 21, 2026

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist Bot Apr 21, 2026

Uh oh!

Uh oh!

gemini-code-assist Bot Apr 21, 2026

Uh oh!

gemini-code-assist Bot Apr 21, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

		ERROR_MESSAGE: str = "Failed creating Anomaly exception!"


		class CreateAnomalyException(BaseAction):

Conversation

chkp-arvidb commented Apr 21, 2026

Title (Please follow the convention below)

Description

Checklist:

General Checks:

Open-Source Specific Checks:

For Google Team Members and Reviewers Only:

Screenshots (If Applicable)

Further Comments / Questions

Uh oh!

google-cla Bot commented Apr 21, 2026

Uh oh!

gemini-code-assist Bot commented Apr 21, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

gemini-code-assist Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gemini-code-assist Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Apr 21, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant