Alliance intelligence inside Check Point.
The OneFirewall WCF Agent for Check Point pushes live Alliance threat intelligence — scored IPs, malicious domains, URLs, and file hashes — directly into your Check Point Quantum Security Gateway via SmartConsole External Feeds and EDLs.
From alliance feed to enforced policy
Generate a JWT token
Log into your OneFirewall Alliance dashboard, go to API Access, and generate a JWT Bearer token. This authenticates all feed requests from Check Point to the Alliance API.
Create indicator feeds in SmartConsole
In Check Point SmartConsole, go to Security Policies → Threat Prevention → Indicators → External Feeds. Create four feeds — one each for IP, domain, URL, and file hash — pointing at the Alliance API endpoint with your JWT Bearer token as the Authorization header. Set refresh to 5 minutes.
Define security policies
Use the created feeds as source or destination objects in your Check Point security policies. Assign enforcement actions — Drop, Reject, or Prevent — and install the policy to your Quantum Security Gateways.
Four Indicator feeds, one token
- Malicious IP addresses — scored IPv4 indicators from the Alliance feed
- Malicious domains
- Malicious URLs
- Malicious file hashes — MD5, SHA1 and SHA256 digests
Each feed type uses its own Alliance API endpoint and is added as a separate External Feed Indicator in SmartConsole, so IP, domain, URL and hash enforcement can run in independent rules or a single combined Threat Prevention policy.
What you need on the Check Point side
- Check Point Gaia OS running R80.10 or later
- SmartConsole admin access to create External Feed objects
- Outbound HTTPS (443) from the gateway to app.onefirewall.com
- A OneFirewall Alliance API token (JWT Bearer)