What is our primary use case?
I work with Check Point Harmony SaaS, as our customer has Check Point Harmony SaaS, and we work on monitoring as we are working as a SOC, that Security Operations Center. We do have that device for monitoring perspective.
We only monitor our customers. The logs that we receive from it are being monitored.
I want to clarify that for Check Point Harmony SaaS, we only monitor the logs for it. If any suspicious detection is detected, the alert triggers, and we monitor that. That part is what I am aware of because I work as a consultant engineer there, and I am not well aware of the implementation or onboarding part of it.
What is most valuable?
I have gone through the portal multiple times for investigation purposes, and the highlighted points I will say are the threat protection of Check Point Harmony SaaS, which provides excellent visibility along with centralized management reporting.
Identification of zero-day threats is a tough part, but when we have such features for random threat identification, it helps us strengthen the security posture. We have not highlighted any incidents with respect to this to the customer yet, but this is a really useful feature that all the next-generation SIEMs and EDRs have, and we are really impressed with that.
We track user behavior with Check Point Harmony SaaS's visibility features, including any unusual behavior detection along with location tracking. If a user has logged in from a different location or device type, that observation raises the risk threshold of that particular user account, and post that, detection will focus on user behavior analysis or user entity behavior analysis. All those features are important for us, and we are utilizing them to highlight critical users to the customer.
What needs improvement?
The one improvement I would suggest is for reporting customization and alert tuning, so whatever the weekly charts I have to fetch for detection incidents, or particularly for host-specific alerts, I need to collect reports from post-detection on how many connections have been established. Such customization can be done on the report, and if that can be implemented, it will be a better hand for the security analyst.
I will rate the overall product as a nine. I will not rate it as a ten because of some customized reporting and the customizable dashboard issues. If those parts could be improved, it would be a ten out of ten.
For how long have I used the solution?
We are familiar with Check Point Harmony SaaS for almost one and a half years, like one year and eight months. We do have that finance customer with us who is using this one, and we are monitoring that device for one year and eight months.
How are customer service and support?
I will not be the right person to report technical support, but whenever we face glitches on the portal or anything, those issues get resolved within a shorter time. Once our admin team reaches out to the support team, they resolve it within almost two to three business hours. So that was really quick support, and I would rate it as a nine out of ten.
How would you rate customer service and support?
How was the initial setup?
For initial setup, it will be done in a few hours, but based on the organization or integrating that particular device on the agent, it will take almost one to two business days at most.
What about the implementation team?
In terms of implementation, our implementation team has not faced any issues or reported any issues while integrating it because we already have multiple Check Point Firewalls, and they are very familiar with all process documents or the documentation provided by Check Point itself. So there was not any issue for implementation.
I am not the person who implemented that one, so I work only on the SIEM console, and I am not sure exactly on what basis it is implemented.
What other advice do I have?
I have almost 6.7 years of experience in security. I currently work as a Security Operation Consultant, so I have almost six years of experience in cybersecurity.
Our team is a SOC admin team with almost eight people.
I currently work as a Security Operation Consultant, which was my job title before the promotion at SecureView.
It is not an issue, and I am glad we could have this conversation.
Thank you, and I wish you a good day. I will rate this review a nine out of ten overall.
Disclosure: My company has a business relationship with this vendor other than being a customer. Integrator