Help us improve
Share bugs, ideas, or general feedback.
From checkpoint-avanan
Manages Checkpoint Harmony Email (Avanan) security incident workflows: lifecycle, status transitions, triage, investigation, escalation, remediation, and closure.
npx claudepluginhub wyre-technology/msp-claude-plugins --plugin checkpoint-avananHow this skill is triggered — by the user, by Claude, or both
Slash command
/checkpoint-avanan:incidentsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Checkpoint Harmony Email & Collaboration (Avanan) provides an incident management system for tracking and investigating email security events. Incidents are created when threats require coordinated investigation and response beyond simple quarantine actions. This skill covers the full incident lifecycle from creation through investigation, remediation, and closure.
Manages Huntress security incidents: lists, triages, investigates, resolves them, and handles remediations with bulk approve/reject workflows.
Analyzes Checkpoint Harmony Email (Avanan) threats including phishing, malware, BEC, ATO; extracts IOCs, builds threat timelines, assesses severity for email security investigations.
Manages RocketCyber security incidents through searching, triaging, investigating, and resolving. Covers lifecycle states, verdicts (Malicious/Suspicious/Benign), severity levels, SOC triage patterns, and PSA ticket correlation.
Share bugs, ideas, or general feedback.
Checkpoint Harmony Email & Collaboration (Avanan) provides an incident management system for tracking and investigating email security events. Incidents are created when threats require coordinated investigation and response beyond simple quarantine actions. This skill covers the full incident lifecycle from creation through investigation, remediation, and closure.
| Status ID | Name | Description | Business Logic |
|---|---|---|---|
| NEW | New | Newly created incident | Default for auto-generated incidents |
| TRIAGING | Triaging | Under initial assessment | Analyst evaluating scope and severity |
| INVESTIGATING | Investigating | Active investigation underway | Evidence being collected and analyzed |
| REMEDIATING | Remediating | Threat confirmed, remediation in progress | Containment and cleanup actions active |
| WAITING | Waiting on Info | Waiting for additional information | Pending customer/vendor response |
| ESCALATED | Escalated | Escalated to senior analyst or vendor | Requires higher-tier expertise |
| RESOLVED | Resolved | Investigation complete, threat remediated | All remediation actions completed |
| CLOSED | Closed | Incident closed after review | Final documentation complete |
| FALSE_POSITIVE | False Positive | Determined not to be a real threat | Detection was incorrect |
NEW ──────────────────────────────────> CLOSED
│ ↑
↓ │
TRIAGING ─────────────────────────────> FALSE_POSITIVE
│ ↑
↓ │
INVESTIGATING ────────────────────────>───┤
│ │ │
│ ↓ │
│ WAITING ──────> INVESTIGATING │
│ │
↓ │
REMEDIATING ──────────────────────────> RESOLVED ──> CLOSED
│
↓
ESCALATED ──────> INVESTIGATING ──────> REMEDIATING
Validation Rules:
| Severity | Name | Response SLA | Description | Examples |
|---|---|---|---|---|
| P1 | Critical | 1 hour | Active data breach or widespread compromise | ATO with data exfiltration, ransomware delivery |
| P2 | High | 4 hours | Confirmed targeted attack or limited compromise | Successful phishing, BEC with financial impact |
| P3 | Medium | 24 hours | Detected threat, no confirmed compromise | Quarantined phishing campaign, blocked malware |
| P4 | Low | 72 hours | Minor security event, informational | Spam campaign, policy violation, anomaly |
| Field | Type | Description |
|---|---|---|
incidentId | string | Unique incident identifier |
title | string | Brief incident summary |
description | string | Detailed incident description |
status | string | Current status (see codes above) |
severity | string | P1, P2, P3, P4 |
assignedTo | string | Analyst assigned to the incident |
createdDate | datetime | When incident was created |
modifiedDate | datetime | Last modification timestamp |
| Field | Type | Description |
|---|---|---|
category | string | PHISHING, MALWARE, BEC, ATO, DLP, OTHER |
subcategory | string | More specific classification |
attackVector | string | EMAIL_ATTACHMENT, EMAIL_LINK, EMAIL_CONTENT, ACCOUNT_COMPROMISE |
source | string | AUTO_DETECTED, USER_REPORTED, ADMIN_CREATED |
affectedUsers | string[] | List of affected user email addresses |
affectedUserCount | int | Number of affected users |
| Field | Type | Description |
|---|---|---|
relatedThreats | string[] | Threat IDs associated with this incident |
relatedQuarantineEntries | string[] | Quarantine entry IDs |
relatedPolicies | string[] | Policies that triggered |
iocs | object[] | Indicators of compromise collected |
| Field | Type | Description |
|---|---|---|
remediationSummary | string | Summary of remediation actions taken |
remediationActions | object[] | List of actions with timestamps |
rootCause | string | Root cause analysis |
lessonsLearned | string | Post-incident lessons learned |
falsePositiveReason | string | Justification if marked false positive |
resolvedDate | datetime | When marked as resolved |
closedDate | datetime | When incident was closed |
| Tool | Description | Key Parameters |
|---|---|---|
avanan_incidents_list | List incidents with filters | startDate, endDate, status, severity, category, limit, offset |
avanan_incidents_get | Get detailed incident information | incidentId |
avanan_incidents_create | Create a new incident | title, description, severity, category, relatedThreats |
avanan_incidents_update | Update incident status and fields | incidentId, status, severity, assignedTo, etc. |
avanan_incidents_add_note | Add investigation note to incident | incidentId, note, noteType, visibility |
avanan_incidents_add_evidence | Attach evidence to incident | incidentId, evidenceType, data, description |
avanan_incidents_list_notes | List all notes for an incident | incidentId |
avanan_incidents_timeline | Get incident activity timeline | incidentId |
avanan_incidents_stats | Get incident statistics | startDate, endDate, groupBy |
List open critical incidents:
{
"tool": "avanan_incidents_list",
"parameters": {
"status": "NEW,TRIAGING,INVESTIGATING,REMEDIATING",
"severity": "P1",
"limit": 50
}
}
Create incident from detected threat:
{
"tool": "avanan_incidents_create",
"parameters": {
"title": "Targeted phishing campaign against finance team",
"description": "Multiple phishing emails detected targeting finance@company.com with credential harvesting links impersonating DocuSign.",
"severity": "P2",
"category": "PHISHING",
"relatedThreats": ["threat-abc123", "threat-def456"]
}
}
Add investigation note:
{
"tool": "avanan_incidents_add_note",
"parameters": {
"incidentId": "inc-abc123",
"note": "Confirmed 3 users clicked the phishing link. Password resets initiated for all 3 accounts. Checking for signs of credential use.",
"noteType": "INVESTIGATION",
"visibility": "INTERNAL"
}
}
Update incident to resolved:
{
"tool": "avanan_incidents_update",
"parameters": {
"incidentId": "inc-abc123",
"status": "RESOLVED",
"remediationSummary": "All phishing emails quarantined. 3 affected users had passwords reset. No evidence of credential use. Sender domain added to block list."
}
}
| Type | Code | Description | Visibility |
|---|---|---|---|
| Triage | TRIAGE | Initial assessment notes | Internal |
| Investigation | INVESTIGATION | Investigation findings | Internal |
| Remediation | REMEDIATION | Actions taken | Internal |
| Communication | COMMUNICATION | Stakeholder updates | Internal or External |
| Review | REVIEW | Post-incident review notes | Internal |
| Code | Message | Resolution |
|---|---|---|
| 400 | Invalid status transition | Check allowed transitions in diagram above |
| 400 | Missing required field | RESOLVED requires remediationSummary |
| 401 | Unauthorized | Check API credentials and token expiry |
| 403 | Insufficient permissions | API key needs incident management scope |
| 404 | Incident not found | Verify incident ID exists |
| 409 | Incident locked | Another analyst is editing the incident |
| 422 | Invalid severity | Use P1, P2, P3, or P4 |
| 429 | Rate limited | Implement exponential backoff |
| Error | Cause | Fix |
|---|---|---|
| Status transition not allowed | Invalid state change | Follow transition diagram |
| Remediation summary required | Resolving without summary | Add remediationSummary field |
| False positive reason required | Marking FP without justification | Add falsePositiveReason field |
| Escalation reason required | Escalating without reason | Add escalation note first |