> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/firewalls/check-point-infinity-portal-firewall.md).

# Check Point Infinity Portal - Firewall

By integrating **Check Point Quantum Smart-1 Cloud** with ThreatDefence via the Infinity Portal **Logs as a Service API**, you can ingest your Check Point firewall events into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

* Firewall traffic and the policy decisions made on it
* NAT, VPN and remote access activity
* Application control, URL filtering and threat prevention events

It enables more effective detection of network intrusions, policy violations and suspicious traffic across your Check Point gateways.

***

### Before you begin

* You need an **Infinity Portal** account with permission to create **account API keys**.
* Your Security Gateways must be managed by **Quantum Smart-1 Cloud**.
* This integration collects one dataset:
  * **Firewall** — the events your gateways log to Smart-1 Cloud.
* Collection reads the events already held in the Infinity Portal. Nothing is installed on your gateways.

{% hint style="info" %}
**Note:** If your gateways are managed by an on-premises Security Management Server rather than Smart-1 Cloud, contact us before onboarding.
{% endhint %}

***

### Step 1: Prepare Smart-1 Cloud

1. **Connect your gateways to Smart-1 Cloud**
   * The Security Gateways you want monitored must be connected to your Smart-1 Cloud environment and have policy installed from it. Their logs are then held in the Infinity Portal, with nothing further to enable.
2. **Make sure your rules log**
   * In SmartConsole, open each Access Control and Threat Prevention rule you want visible and set its **Track** column to **Log** (or **Detailed Log** / **Extended Log**). A rule with **Track** set to **None** produces no events.
   * Click **Install Policy** after making changes.
3. **Confirm**
   * Open the **Logs** view in SmartConsole and check that traffic and threat events from your gateways are arriving.

***

### Step 2: Create an API key

1. **Open the API Keys page**
   * Sign in to the Infinity Portal at [https://portal.checkpoint.com](https://portal.checkpoint.com/).
   * Click the **Global Settings** icon, then select **API Keys**.
2. **Create a new account API key**
   * Click **New**, then select **New account API key**.
   * **Service:** select **Logs as a Service**.
   * **Role:** select **Admin**. Logs as a Service offers no read-only role, and the key can only be used to search logs.
   * **Expiration:** set an expiry date and note it, as the key must be replaced before it expires.
   * **Description:** enter a descriptive name, for example `ThreatDefence SIEM`.
   * Click **Create**.
3. **Copy the three values shown**
   * **Client ID**
   * **Secret Key**
   * **Authentication URL**

{% hint style="warning" %}
**Important:** The **Secret Key** and **Authentication URL** are shown only once, in the window that opens when the key is created. Copy both before you click **Close**; if you lose them, you will need to create a new key.
{% endhint %}

{% hint style="info" %}
**Note:** The service must be **Logs as a Service**. A key created for any other service, including the older **Infinity Events** service, is refused.
{% endhint %}

For more information, refer to the Check Point documentation: [Infinity Portal API Keys](https://sc1.checkpoint.com/documents/Infinity_Portal/WebAdminGuides/EN/Infinity-Portal-Admin-Guide/Content/Topics-Infinity-Portal/API-Keys.htm)

***

### Step 3: Identify your region

The **Authentication URL** shows the region your Infinity Portal account is hosted in. Find its address in the table below and note the region code.

| Authentication URL begins with                   | Region code |
| ------------------------------------------------ | ----------- |
| `https://cloudinfra-gw.ap.portal.checkpoint.com` | `AU`        |
| `https://cloudinfra-gw.portal.checkpoint.com`    | `EU`        |
| `https://cloudinfra-gw-us.portal.checkpoint.com` | `US`        |
| `https://cloudinfra-gw.ae.portal.checkpoint.com` | `UAE`       |
| `https://cloudinfra-gw.in.portal.checkpoint.com` | `IN`        |

***

### Onboarding the integration

Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the **Check Point Infinity Portal** integration. You will need:

* **Region** - the region code from Step 3
* **Client ID**
* **Client Secret** - the **Secret Key** from Step 2

{% hint style="info" %}
**Note:** On its first run, the integration collects the last 2 hours of firewall events. After that, firewall events are collected every 5 minutes.
{% endhint %}

{% hint style="info" %}
**Note:** If the Check Point Infinity Portal integration is already onboarded for another Check Point product, do not onboard it again: it collects firewall events with the same key from its next run.
{% endhint %}

***

If you encounter difficulties with onboarding, please email the following to <support@threatdefence.com>:

* Client ID
* Secret Key - please send this via [PrivatShare](https://share.threatdefence.io/) , not plain email
* Authentication URL, or the region code from Step 3

{% hint style="info" %}
**Note:** Collection stops when the API key expires or is deleted. Before the expiry date, create a new key and send us its values so that collection continues without a gap.
{% endhint %}


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/firewalls/check-point-infinity-portal-firewall.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.