Skip to content

CheckPoint: rename Check Point NGFW and change its automation module#2203

Open
squioc wants to merge 2 commits intodevelopfrom
feat/CheckPointQuantumn
Open

CheckPoint: rename Check Point NGFW and change its automation module#2203
squioc wants to merge 2 commits intodevelopfrom
feat/CheckPointQuantumn

Conversation

@squioc
Copy link
Collaborator

@squioc squioc commented Jan 29, 2026

  • Rename the format
  • Link the format to the Quantum product line

Related to: SEKOIA-IO/automation-library#1962

Summary by Sourcery

Rename the Check Point firewall integration to Check Point NGFW and align its metadata and automation linkage with the Quantum product line.

Enhancements:

  • Update the ingest parser format name to checkpoint-ngfw and relocate it under the new Check Point NGFW integration folder.
  • Introduce a new metadata manifest for Check Point NGFW with updated slug, description, data sources, and automation module UUID while removing the legacy manifest.

@squioc squioc requested review from a team and adavid-sekoia January 29, 2026 14:57
@squioc squioc added the enhancement New feature or request label Jan 29, 2026
@sourcery-ai
Copy link
Contributor

sourcery-ai bot commented Jan 29, 2026

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Renames the existing Check Point ingestion format to a new checkpoint-ngfw format, migrates its manifest to a new location under that name, and updates the linked automation module and product metadata to refer to the Check Point NGFW / Quantum product line.

Sequence diagram for updated Check Point NGFW log processing and automation module

sequenceDiagram
  actor Admin as Admin
  participant CheckPointNGFW as Check Point NGFW
  participant IngestionEndpoint as Sekoiaio_ingestion_endpoint
  participant Parser_checkpoint_ngfw as Parser_checkpoint_ngfw
  participant SekoiaPlatform as Sekoiaio_platform
  participant AutomationModule_af67e28c as Automation_module_af67e28c

  Admin->>CheckPointNGFW: Configure log forwarding
  CheckPointNGFW->>IngestionEndpoint: Send firewall logs
  IngestionEndpoint->>Parser_checkpoint_ngfw: Route logs to checkpoint-ngfw format
  Parser_checkpoint_ngfw->>SekoiaPlatform: Emit normalized events
  SekoiaPlatform->>AutomationModule_af67e28c: Invoke updated automation module
  AutomationModule_af67e28c-->>SekoiaPlatform: Automation results
  SekoiaPlatform-->>Admin: Display alerts and insights
Loading

File-Level Changes

Change Details Files
Rename the Check Point ingestion format from a generic cef name to checkpoint-ngfw and move it under a new directory.
  • Change the parser format name field from cef to checkpoint-ngfw
  • Relocate the parser configuration from the old Checkpoint/checkpoint path to Checkpoint/checkpoint-ngfw
Checkpoint/checkpoint/ingest/parser.yml
Checkpoint/checkpoint-ngfw/ingest/parser.yml
Introduce a new manifest for the checkpoint-ngfw integration and remove the old manifest.
  • Create a new _meta/manifest with updated UUID, name, slug, description, and data_sources tailored to Check Point NGFW / Quantum
  • Set the automation_module_uuid in the new manifest to point to the new automation module
  • Delete the legacy manifest associated with the previous Check Point integration
Checkpoint/checkpoint-ngfw/_meta/manifest.yml
Checkpoint/checkpoint/_meta/manifest.yml

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@github-actions
Copy link

🤖 Copilot Automated Review

Changed Intake Formats

The following intake formats were modified:

  • 'Checkpoint/checkpoint-ngfw'

Changed File Types

  • .json files: 1

🔒 Security Scan - Sensitive Information Check

⚠️ IMPORTANT: This is a public repository. All test data must be anonymized.

No test files in this PR

📋 Contribution Checklist

Please ensure your PR meets the following requirements:

  • No sensitive information in test files (emails, passwords, API keys, real IPs, PII)
  • Test data is properly anonymized (use example.com, TEST-NET IPs, fake credentials)
  • Code is linted with Prettier
  • Parser test coverage is at least 75%
  • Logo files included for new modules/formats
  • README.md files present and updated
  • Smart-descriptions provided for new formats

🔍 Next Steps

GitHub Copilot can help you with:

  • Security review: Tag @copilot to scan for additional sensitive data
  • Anonymization help: Ask Copilot to suggest anonymized replacements
  • Code review: Request specific review feedback
  • Test suggestions: Ask Copilot to suggest additional test cases

For more details, see the Contribution Guidelines.

@github-actions
Copy link

⚠️ Intake Format Checks Failed

Format Errors

  • Checkpoint/checkpoint-ngfw
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Username - value: LASTNAME3, Firstname3 (ABC12345) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Username - value: Firstname1, LASTNAME1 ( FLASTNAME1) Firstname2, Lastname2 (ADM) (FOO12345) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Username - value: LASTNAME3, Firstname3 (ABC12345) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json - data type: Username - value: Firstname1, LASTNAME1 ( FLASTNAME1) Firstname2, Lastname2 (ADM) (FOO12345) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/Generic_tcp_allow.json - data type: Domain - value: FOOBAR-HOST-01 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_proxy_src.json - data type: Domain - value: 9.10.11.12 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_proxy_src.json - data type: Domain - value: 9.10.11.12 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_proxy_src.json - data type: URL - value: http://9.10.11.12/.git/config - reason: Not using accepted anonymized domain in URL
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_proxy_src.json - data type: URL - value: http://9.10.11.12/.git/config - reason: Not using accepted anonymized domain in URL
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json - data type: Username - value: USER-LASTNAME USER-FIRSTNAME (ULUF10004820) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json - data type: Username - value: USER-LASTNAME USER-FIRSTNAME (ULUF10004820) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json - data type: Username - value: USER-LASTNAME USER-FIRSTNAME (ULUF10004820) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json - data type: Username - value: USER-LASTNAME USER-FIRSTNAME (ULUF10004820) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: Domain - value: subdomain.domain.fr - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: Domain - value: subdomain.domain.fr - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0025465) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0025465) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0025465) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0025465) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: URL - value: https://subdomain.domain.fr:443 - reason: Not using accepted anonymized domain in URL
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json - data type: URL - value: https://subdomain.domain.fr:443 - reason: Not using accepted anonymized domain in URL
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF.json - data type: Domain - value: 4.4.4.4 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF.json - data type: Domain - value: 4.4.4.4 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/Generic_icmp_decrypt.json - data type: Domain - value: 2.2.2.2 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_ApplicationControl.json - data type: URL - value: https://foo.bar.com:443 - reason: Not using accepted anonymized domain in URL
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_ApplicationControl.json - data type: URL - value: https://foo.bar.com:443 - reason: Not using accepted anonymized domain in URL
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_drop.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_drop.json - data type: Domain - value: [email protected] - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_drop.json - data type: Username - value: FIRSTNAME LASTNAME (FILA10052418) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_drop.json - data type: Username - value: FIRSTNAME LASTNAME (FILA10052418) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_drop.json - data type: Username - value: FIRSTNAME LASTNAME (FILA10052418) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_drop.json - data type: Username - value: FIRSTNAME LASTNAME (FILA10052418) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_reject.json - data type: Username - value: LASTNAME FIRSTNAME (CORPO10004953) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_reject.json - data type: Username - value: LASTNAME FIRSTNAME (CORPO10004953) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_reject.json - data type: Username - value: LASTNAME FIRSTNAME (CORPO10004953) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_reject.json - data type: Username - value: LASTNAME FIRSTNAME (CORPO10004953) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/Generic_tcp_drop.json - data type: Domain - value: FOOBAR-HOST-01 - reason: Not in accepted anonymized domain patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_network_protocol.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0000583) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_network_protocol.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0000583) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_network_protocol.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0000583) - reason: Not in accepted anonymized username patterns
    • Anonymization Error - code: anonymization_missing - file: Checkpoint/checkpoint-ngfw/tests/CEF_network_protocol.json - data type: Username - value: LASTNAME FIRSTNAME (CORP0000583) - reason: Not in accepted anonymized username patterns

@github-actions
Copy link

Smart descriptions generated from the latest tests at 2026-01-29 14:58:36:

Test File Smart Description
Checkpoint/checkpoint-ngfw/tests/CEF.json 5.5.5.5 redirect to 3.3.3.3
Checkpoint/checkpoint-ngfw/tests/CEF_ApplicationControl.json accept to https://foo.bar.com:443
Checkpoint/checkpoint-ngfw/tests/CEF_accept.json 10.20.30.40 accept to 5.6.7.8
Checkpoint/checkpoint-ngfw/tests/CEF_allow.json 3.3.3.3 allow to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/CEF_cs2_2_times.json 10.0.11.11 accept to 172.16.111.111
Checkpoint/checkpoint-ngfw/tests/CEF_decrypt.json 10.1.11.111 decrypt to 192.168.111.111
Checkpoint/checkpoint-ngfw/tests/CEF_drop.json 3.3.3.3 drop to 4.4.4.4
Checkpoint/checkpoint-ngfw/tests/CEF_drop_1.json 1.2.3.4 drop to 3.4.5.6
Checkpoint/checkpoint-ngfw/tests/CEF_geo_protection.json 1.1.1.1 accept to 3.3.3.3
Checkpoint/checkpoint-ngfw/tests/CEF_https_bypass.json 1.1.1.1 https bypass to 3.3.3.3
Checkpoint/checkpoint-ngfw/tests/CEF_network_protocol.json 3.3.3.3 accept to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/CEF_proxy_src.json 5.6.7.8 detect to 1.2.3.4
Checkpoint/checkpoint-ngfw/tests/CEF_reject.json 3.3.3.3 reject to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/CEF_syslog.json 1.2.3.4 detect to 5.6.7.8
Checkpoint/checkpoint-ngfw/tests/CEF_tcp_accept.json 3.3.3.3 accept to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/CEF_user_agent.json 192.168.222.222 accept to 192.168.111.111
Checkpoint/checkpoint-ngfw/tests/Generic_icmp_decrypt.json 3.3.3.3 decrypt to 1.1.1.1
Checkpoint/checkpoint-ngfw/tests/Generic_tcp_allow.json 2.2.2.2 accept to 1.1.1.1
Checkpoint/checkpoint-ngfw/tests/Generic_tcp_drop.json 1.1.1.1 drop to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/Syslog.json 3.3.3.3 drop to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/Syslog_icmp.json 3.3.3.3 accept to 2.2.2.2
Checkpoint/checkpoint-ngfw/tests/Syslog_key.json 1.1.1.1 key install to 1.1.1.1
Checkpoint/checkpoint-ngfw/tests/Syslog_nat.json 3.3.3.3 accept to 192.168.99.111

Copy link
Contributor

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue

Prompt for AI Agents
Please address the comments from this code review:

## Individual Comments

### Comment 1
<location> `Checkpoint/checkpoint-ngfw/_meta/manifest.yml:4` </location>
<code_context>
+uuid: f0a10c21-37d1-419f-8671-77903dc8de69
+name: Check Point NGFW
+slug: checkpoint-firewall
+description: "Check Point NGFWs are sophisticated security equipments.\nSending your firewall logs, especially the allowed events, to Sekoia.io will help you discovering potential network security threats."
+data_sources:
+  Network device logs: Check Point NGFW can record traffic events flowing through their firewall.
</code_context>

<issue_to_address>
**nitpick (typo):** Polish the description wording for readability and correctness.

Suggested rewording:

"Check Point NGFWs are sophisticated security equipment.
Sending your firewall logs, especially the allowed events, to Sekoia.io will help you discover potential network security threats."

This keeps the meaning but fixes the English phrasing in the UI text.

```suggestion
description: "Check Point NGFWs are sophisticated security equipment.\nSending your firewall logs, especially the allowed events, to Sekoia.io will help you discover potential network security threats."
```
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

uuid: f0a10c21-37d1-419f-8671-77903dc8de69
name: Check Point NGFW
slug: checkpoint-firewall
description: "Check Point NGFWs are sophisticated security equipments.\nSending your firewall logs, especially the allowed events, to Sekoia.io will help you discovering potential network security threats."
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nitpick (typo): Polish the description wording for readability and correctness.

Suggested rewording:

"Check Point NGFWs are sophisticated security equipment.
Sending your firewall logs, especially the allowed events, to Sekoia.io will help you discover potential network security threats."

This keeps the meaning but fixes the English phrasing in the UI text.

Suggested change
description: "Check Point NGFWs are sophisticated security equipments.\nSending your firewall logs, especially the allowed events, to Sekoia.io will help you discovering potential network security threats."
description: "Check Point NGFWs are sophisticated security equipment.\nSending your firewall logs, especially the allowed events, to Sekoia.io will help you discover potential network security threats."

Copy link
Collaborator

@TOUFIKIzakarya TOUFIKIzakarya left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGFM.
Maybe the sourcery comments can be applied

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants