How to Review Security Reports and Dashboard in Harmony Email

Check Point Harmony Email & Collaboration provides comprehensive dashboards and reporting capabilities to monitor your organization's email security posture. This guide covers navigating the Overview Dashboard, analyzing security events, and generating reports for stakeholders and compliance requirements.

Prerequisites

Before reviewing security reports, ensure you have:

• Harmony Email & Collaboration connected to Microsoft 365 or Google Workspace
• Administrator or Read-Only Admin access to the Check Point Infinity Portal
• Active protection policies generating security events
• Understanding of your reporting requirements (compliance, executive, operational)

Understanding the Dashboard Structure

Harmony Email provides several dashboard views:

Dashboard	Purpose	Primary Users
Overview	Security posture at a glance	All administrators
User Interaction	User reporting and requests	Help desk, security team
Events	Detailed security event logs	Security analysts
Reports	Scheduled and custom reports	Management, compliance

Step 1: Access the Overview Dashboard

The Overview Dashboard is your landing page for security visibility.

Navigate to the Dashboard

1. Sign in to https://portal.checkpoint.com
2. Navigate to Harmony > Email & Collaboration
3. Click Overview in the left menu (default landing page)

Dashboard Layout

The Overview Dashboard displays:

• Protection Summary: Total protected users and applications
• Threat Overview: Threats detected in the selected time period
• Pending Actions: Items requiring administrator attention
• Recent Activity: Timeline of security events

Step 2: Review Protection Summary

Protected Assets Widget

View your protection coverage:

1. Locate the Protected Assets section
2. Review protected counts:
   • Mailboxes: Email accounts protected
   • Applications: Connected SaaS apps (Teams, OneDrive, etc.)
   • Users: Unique users covered
3. Click on any count to drill down into details

Connection Status

1. Check SaaS Status widget
2. Verify all connected applications show Connected
3. Timestamps show last successful sync
4. Click View Details for connection health information

Step 3: Analyze Threat Overview

Threat Detection Metrics

1. Locate the Threats Detected section
2. View key metrics:

Metric	Description
Total Threats	All security events in the period
Phishing	Detected phishing attempts
Malware	Malicious attachments caught
BEC Attempts	Business email compromise blocked
Suspicious URLs	Malicious links detected
DLP Violations	Data loss prevention events

3. Select time range: 24 hours, 7 days, 30 days, or Custom

Threat Trend Graph

1. Review the Threat Trends chart
2. Identify patterns:
   • Spikes in attack volume
   • Day-of-week patterns
   • Correlation with events (holidays, announcements)
3. Hover over data points for specific values

Threat Breakdown

1. View the Threats by Type pie chart
2. Understand distribution:
   • What percentage is phishing vs. malware?
   • Are DLP violations significant?
   • How much spam is being caught?

Step 4: Review Pending Actions

The dashboard highlights items requiring your attention.

Pending Actions Widget

1. Locate Pending Actions section
2. Review categories:
   • Quarantine Restore Requests: Users requesting email release
   • Reported Phishing: User-reported suspicious emails
   • Anomaly Alerts: Potential account compromise indicators
3. Click each category to take action

Processing Pending Items

1. Click on a pending action category
2. Review items requiring attention
3. Take appropriate action:
   • Approve or deny restore requests
   • Confirm or dismiss reported phishing
   • Investigate anomaly alerts
4. Return to dashboard to verify pending count decreases

Step 5: Explore Security Events

Access Events Section

1. Click Events in the left menu
2. View the event list with all security detections

Filter Events

Use filters to find specific events:

1. Time Range: Select period to analyze
2. Event Type: Filter by category:
   • Phishing
   • Malware
   • Malicious URL
   • DLP
   • Anomaly
   • Spam
3. Action Taken: Filter by outcome (quarantined, blocked, alerted)
4. User: Search for specific recipient
5. Severity: High, Medium, Low

Event Details

Click any event to view details:

Field	Information
Timestamp	When event occurred
Event Type	Threat classification
Sender	Original sender address
Recipient	Affected user
Subject	Email subject line
Confidence	Detection confidence level
Action	What action was taken
Detection Engine	Which engine detected (AV, Threat Emulation, etc.)

Export Events

1. Apply desired filters
2. Click Export
3. Choose format:
   • CSV: For spreadsheet analysis
   • JSON: For SIEM integration
4. Download file

Step 6: Use the User Interaction Dashboard

Monitor user-initiated activities and help desk tasks.

Access User Interaction

1. Click User Interaction in the left menu
2. Click Dashboard

Dashboard Widgets

Widget	Description
Phishing Reports	Emails reported by users
Restore Requests	Quarantine release requests
Top Users	Most active reporters/requesters
SLA Trend	Help desk response time metrics

Identify High-Risk Users

1. Review Top Users widget
2. Identify users who:
   • Report many phishing emails (security aware)
   • Request many restores (may need training)
   • Click many malicious URLs (definite training need)
3. Export user list for training prioritization

Monitor Help Desk SLA

1. Review SLA Trend widget
2. Track response time for:
   • Phishing report handling
   • Restore request processing
3. Identify trends and staffing needs

Step 7: Generate Security Reports

Create reports for stakeholders and compliance.

Access Reports Section

1. Click Reports in the left menu
2. View available report types

Available Report Types

Report	Content	Audience
Executive Summary	High-level threat overview	Leadership
Threat Analysis	Detailed threat breakdown	Security team
User Risk	At-risk user identification	Training team
Compliance	Audit-ready event logs	Compliance officers
DLP Summary	Data loss prevention events	Data governance

Generate an Executive Summary

1. Click Executive Summary report
2. Select Time Period: Last week, month, quarter
3. Configure content:
   • Include threat volume trends
   • Include comparison to previous period
   • Include top targeted users
4. Click Generate Report
5. Download as PDF or View Online

Generate a Threat Analysis Report

1. Click Threat Analysis report
2. Select time period
3. Configure filters:
   • Threat types to include
   • Severity levels
   • User groups
4. Click Generate
5. Review detailed findings

Step 8: Schedule Automated Reports

Set up recurring reports delivered automatically.

Create Report Schedule

1. In Reports section, click Scheduled Reports
2. Click Create New Schedule
3. Configure schedule:
   • Report Type: Select from available reports
   • Frequency: Daily, Weekly, or Monthly
   • Day/Time: When to generate
   • Recipients: Email addresses to receive report
4. Click Save

Manage Scheduled Reports

1. View list of scheduled reports
2. For each schedule:
   • Edit: Modify settings
   • Pause: Temporarily stop delivery
   • Delete: Remove schedule
3. Review Last Run to verify delivery

Step 9: Configure Custom Dashboards

Create personalized views for specific needs.

Create Widget Layout

1. In Overview, click Customize
2. Add, remove, or rearrange widgets:
   • Drag widgets to new positions
   • Remove irrelevant widgets
   • Add widgets from available options
3. Click Save Layout

Create Multiple Views

1. Create different views for different audiences:
   • SOC View: Focus on events and threats
   • Executive View: High-level metrics
   • Compliance View: Policy violations
2. Switch between views as needed

Step 10: Integrate with External Systems

Export data for SIEM integration and long-term retention.

SIEM Integration

1. Go to Settings > Integrations
2. Configure SIEM connector:
   • Splunk
   • Microsoft Sentinel
   • IBM QRadar
   • Generic Syslog
3. Enter connection details
4. Select event types to forward
5. Test and enable integration

API Access

1. Navigate to Settings > API
2. Generate API credentials
3. Use API for:
   • Custom dashboards
   • Automated reporting
   • Integration with other tools

Datadog Integration

Harmony Email integrates with Datadog for visualization:

1. Enable Datadog connector in Integrations
2. Security events stream to Datadog
3. Use out-of-the-box Datadog dashboards
4. Create custom visualizations

Interpreting Key Metrics

Healthy Security Posture Indicators

Metric	Healthy Range	Action if Outside Range
Detection Rate	>95% of known threats	Review policy configuration
False Positive Rate	<5% of detections	Adjust confidence thresholds
User Report Rate	Growing over time	Indicates security awareness
Mean Time to Respond	<4 hours for critical	Add automation or staff
Click Rate on Malicious URLs	Decreasing trend	Continue security training

Warning Signs

Watch for these indicators:

1. Sudden drop in detections: May indicate configuration issue
2. Spike in specific threat type: Targeted attack in progress
3. Increase in restore requests: False positives or user confusion
4. Decline in user reports: Training effectiveness declining

Best Practices

1. Review daily: Check dashboard each morning for overnight events
2. Weekly deep-dive: Analyze trends and patterns weekly
3. Monthly reporting: Generate executive reports monthly
4. Track trends: Compare month-over-month metrics
5. Share insights: Communicate security wins to stakeholders
6. Act on data: Use reports to drive security improvements
7. Automate routine reports: Schedule recurring delivery
8. Retain exports: Archive reports for compliance audits

Troubleshooting Common Issues

Dashboard Not Loading Data

Symptoms: Widgets show no data or loading errors.

Solutions:

1. Verify connection status to email platforms
2. Check that protection policies are active
3. Clear browser cache and refresh
4. Try a different browser
5. Contact support if issue persists

Missing Events

Symptoms: Expected events not appearing in log.

Solutions:

1. Verify time range filter includes expected period
2. Check event type filters aren't excluding events
3. Confirm policy was active when event should have occurred
4. Allow time for event processing (up to 15 minutes)

Report Generation Fails

Symptoms: Reports fail to generate or download.

Solutions:

1. Reduce time range if report is too large
2. Apply filters to reduce data volume
3. Try different export format (CSV vs PDF)
4. Check for scheduled maintenance windows

Next Steps

After mastering the dashboard and reports:

1. Set up alerts: Configure notifications for critical events
2. Integrate SIEM: Forward events for long-term retention
3. Create playbooks: Document response procedures for common events
4. Train your team: Share dashboard access with security team
5. Establish KPIs: Define metrics for measuring security program success

Additional Resources

• Overview Dashboard Documentation
• User Interaction Dashboard
• Harmony Email Datadog Integration

---

Need help interpreting your security reports? Inventive HQ provides security analysis and consulting services. Contact us for expert guidance on your email security posture.