In short: Harmony Endpoint EDR is included in every edition of Check Point Endpoint Security. It builds a forensics report automatically for each detection, maps events to MITRE ATT&CK, supports threat hunting across all devices, and lets you isolate devices and remediate files. Infinity XDR for Endpoint, in Elite or as an add-on, adds incident correlation and Playblocks automation.
EDR in every Harmony Endpoint edition
Endpoint detection and response is part of Harmony Endpoint Advanced, so every current edition includes it. XDR, which correlates incidents across products and automates responses, comes with Harmony Endpoint Elite or as the Infinity XDR/XPR add-on.
| Capability | Advanced | Complete | Elite |
|---|---|---|---|
| Automated forensics reports | Yes | Yes | Yes |
| MITRE ATT&CK mapping | Yes | Yes | Yes |
| Threat hunting | Yes | Yes | Yes |
| Isolation and file remediation | Yes | Yes | Yes |
| Infinity XDR for Endpoint with Playblocks | Add-on | Add-on | Yes |
For a vendor-neutral explanation of what EDR and XDR are, see our endpoint security and XDR guide on cloud-security.cloud. This page focuses on how Check Point does it.
Automated forensics reports
When Harmony Endpoint detects a malicious file or event, for example through anti-ransomware or Behavioural Guard, forensics analysis starts automatically. The result is a report of the whole attack sequence rather than a single alert:
- Entry point: how the suspicious file got into your systems
- Business impact: which files were affected and what was done to them
- Remediation: which files were treated and what their status is now
- Suspicious activity: the unusual behaviour the attack caused
- Incident details: a visual map of the attack's path through the device
You can open the report in the console or download it as JSON, and forensics data can also be sent to a third-party analytics tool.
For ransomware, the same analysis drives clean-up: every element of the attack is quarantined and encrypted files are restored automatically, as described on our Check Point anti-ransomware page. If an on-premises management server loses internet access, forensics data is held and sent for evaluation once it reconnects.
MITRE ATT&CK mapping and threat hunting
The MITRE ATT&CK view shows which tactics and techniques Harmony Endpoint has observed across your estate, so you can see at a glance whether activity looks like initial access, persistence, credential theft or lateral movement.
Threat hunting is a setting in the Analysis & Remediation policy and relies on the Forensics, Behavioural Guard and anti-ransomware components being active. It works with cloud management in the Check Point Portal, and Check Point lists the United Kingdom among its supported tenant regions. The agent collects raw and detected events from every device, and you can query them, drill down and pivot along a timeline. A hunt can start from your own query, from Check Point's predefined queries, or from a technique in the MITRE ATT&CK view, and useful queries can be saved as bookmarks with email notifications.
From the results you can act straight away: terminate a process, quarantine a file, trigger a forensic analysis or isolate the machine. Indicators you find (domains, IP addresses, URLs and MD5 or SHA1 file hashes) can be added to IOC management so they are blocked on every endpoint, and ThreatCloud AI shares new verdicts across Check Point products.
Containment and remediation
From the console you can act on one device or many using push operations:
| Action | What it does | Platforms |
|---|---|---|
| Isolate computer | Cuts the device off the network except for DHCP, DNS and traffic to the management server, so you can still investigate it. Needs the Firewall component | Windows, macOS |
| Release computer | Ends isolation once the device is clean | Windows, macOS |
| File remediation | Quarantines malicious files and remediates them, ending related processes | Windows, macOS, Linux |
| Quarantine management | Review, restore or delete quarantined items | From the console |
Remediation can also run automatically by policy. You choose the confidence level at which files are remediated, what happens to malicious, suspicious and unknown files (quarantine, delete, back up and delete, or no action), and whether suspicious processes are terminated, so detections are dealt with without waiting for an administrator. By default, quarantined items are kept for 90 days.
Infinity XDR for Endpoint and Playblocks
Infinity XDR for Endpoint takes EDR detections and adds:
- Incident management: related detections are grouped into one incident with a single timeline
- Event correlation: endpoint events are linked with those from other Check Point products, such as Harmony Email and Collaboration and Check Point firewalls
- Infinity Playblocks for Endpoint: automated playbooks that act on an incident, for example blocking an IP address or device across enforcement points, quarantining files or notifying the right team, including through ticketing tools such as Jira and ServiceNow
XDR is included in Harmony Endpoint Elite and available as an add-on to Advanced and Complete. It sits in the Check Point Portal alongside your other Check Point products.
Adding a 24/7 team with Check Point MDR
EDR and XDR give you the evidence and the tools; someone still has to look at them, including at 3am on a Sunday. Check Point MDR adds Check Point's own security experts, who monitor, investigate and respond around the clock, with incident response included, across endpoints, email, network, cloud and identity, including data from third-party tools.
Forever Systems sets up EDR policies, alert routing and SIEM forwarding, tunes out noise and can triage alerts for you, with MDR as an option for full round-the-clock cover. Ask us for a quote. Contact us to discuss detection and response on Harmony Endpoint.
How Forever Systems supplies and supports Check Point Harmony
We supply and support the whole Check Point Harmony suite, now marketed as Check Point Workspace Security, for UK organisations: from a single product to endpoint, email, SaaS, mobile, browser and SASE together, with Check Point MDR if you want round-the-clock cover.
- Scoping and licensing: the right products, editions and plans for your users, devices and risk, and a clear view of what the old Harmony names now mean
- Proof of value: trial deployments that show what Harmony finds in your own mailboxes, devices and traffic
- Deployment: endpoint agents and policies, the Microsoft 365 or Google Workspace connection, mobile roll-out through your MDM, browser extensions and SASE access policies
- Migration: moving from another endpoint, email or VPN product, or from Harmony Connect to Harmony SASE
- Ongoing support: policy tuning, alert triage, upgrades and renewals, managed in the Check Point Portal
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, including other options if Harmony is not right for you.
Want a Check Point Harmony quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Harmony Endpoint include EDR?
Yes. EDR, with automated forensics reports, MITRE ATT&CK mapping and threat hunting, is included in every current edition: Advanced, Complete and Elite.
What is the difference between Harmony Endpoint EDR and Infinity XDR?
EDR investigates and responds on endpoints. Infinity XDR for Endpoint adds incident management, correlates endpoint events with other Check Point products, and automates responses with Playblocks. XDR is in Elite or available as an add-on.
Can Harmony Endpoint isolate an infected device?
Yes. The Isolate Computer push operation blocks all traffic except DHCP, DNS and the connection to the management server, so you can investigate without the threat spreading. It is available on Windows and macOS and needs the Firewall component installed.
Does Harmony Endpoint threat hunting need cloud management?
Yes. Check Point documents threat hunting as a cloud-only feature of the Check Point Portal, switched on in the Analysis & Remediation policy, with the Forensics, Behavioural Guard and anti-ransomware components active. The United Kingdom is one of the supported tenant regions.
Do I need Check Point MDR if I have Harmony Endpoint EDR?
Not necessarily. EDR gives your team the tools, and many organisations manage it themselves or with us. MDR makes sense when you need people watching and responding 24/7 and do not have your own security operations team.