Checkpoint

The CrowdSec Checkpoint integration connects CrowdSec's hosted blocklist endpoint to your Checkpoint firewall.
Check Point calls this feature Custom Intelligence (IoC) Feeds, which provide the ability to add custom cyber intelligence feeds into the Threat Prevention engine.

Ensure your Checkpoint device supports Custom Intelligence (IoC) Feeds.
The vendor documentation is available in the References section below.

Setup a Checkpoint Integration Endpoint

1- Create an integration

Step 1 — Create an integration in the CrowdSec Console

In your CrowdSec Console account, navigate to the Blocklist tab in the top menu bar, then select the Integrations sub-menu. Choose the integration type you need, then click Connect.

If you don't have a CrowdSec Console account, sign up here. On mobile, use the menu icon in the top-right corner, tap Blocklist, then Integrations.

2- Remediation Component

Step 2 — Fill in integration details

Name the integration (must be unique to your account) Optionally, add a description and tags to help you identify it later. Then click Create.

3- Save your credentials

Step 3 — Copy your credentials

The credentials shown next are displayed only once. Copy them before closing this screen. If you lose your credentials, you can regenerate them via Configure → Regenerate Credentials on the integration page.

With this HTTPS endpoint and Basic Auth credentials, you can verify the endpoint with any HTTP client, for example:

curl -u 'usr:pass' https://admin.api.crowdsec.net/v1/integrations/$integID/content

4- Subscribe to blocklists

Step 4 — Subscribe to Blocklists

The integration endpoint will serve the deduplicated blocklists it's subscribed to. After creation, a subscription pop-up appears automatically. You can also access it later via the Add Blocklist button.

Select one or more blocklists available for your plan, then click Confirm Subscription. The blocklist name(s) will appear in the integration tile once subscribed.

---

Configure Checkpoint

In the Gateways and Servers tab, double-click the gateway you want to configure.

In the properties menu, select Threat Prevention (Custom), then activate at least Anti-Bot or Anti-Virus.

Go to the Security policies tab and click New IOC Feed.

Click Custom Policy, then Indicators. Add your feed information using the endpoint URL with Basic Auth credentials embedded:

https://<username>:<password>@admin.api.crowdsec.net/v1/integrations/<integration_id>/content

You can use the Raw IP List format and set the data column to 1. Click Test Feed.

Select the gateway and click Test Feed.

Verify the feed is working, then save the configuration.

Format example

The CrowdSec blocklist is served in Checkpoint format, with one entry per line:

Accessobserv2,192.168.38.187,IP,high,high,AB,C&C server IP
Accessobserv2,192.168.38.188,IP,high,high,AB,C&C server IP

Format: UNIQ-NAME, VALUE, TYPE, CONFIDENCE, SEVERITY, PRODUCT, COMMENT

Manage integration size limits with pagination

If you want to learn how to manage integration size limits with pagination, please refer to the Managing integrations size limits with pagination section.

References

• Check Point — Custom Intelligence (IoC) Feeds documentation

Next Steps

Subscribe to blocklists in the Blocklist Catalog to populate your integration.