servosity/msp-skills/avanan

Avanan - Claude Code Skill

Prerequisites: Install the CLI

This skill drives the avanan-cli binary. You must verify the CLI is installed before invoking any command from this skill. If it is missing, install it first:

1. macOS / Linux:

``bash bash <(curl -fsSL https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/avanan/install.sh) ``

1. Windows (PowerShell):

``powershell iwr -useb https://raw.githubusercontent.com/Servosity/msp-skills/main/skills/avanan/install.ps1 | iex ``

1. Verify: avanan-cli --version
2. Ensure ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows) is on $PATH.

The installer downloads the avanan-cli and avanan-mcp binaries into ~/.local/bin (macOS / Linux) or %LOCALAPPDATA%\Programs\msp-skills (Windows). It does not register the skill with your agent and writes no MCP client config - see mcp-install.md for that wire-up.

If --version reports "command not found" after install, the runtime cannot see the binary directory on $PATH. Do not proceed with skill commands until verification succeeds.

Avanan (Check Point Harmony Email and Collaboration) answers one scope and one page at a time, so the questions an MSP actually asks span calls the portal never joins. This CLI types the whole Smart API surface, mirrors events, entities and exceptions into local SQLite, and adds commands built on that mirror: triage buckets a shift's detections, campaign clusters them into phishing campaigns, exceptions find checks all seven engines at once, and remediate waits for the async task and reports the real outcome.

When to Use This CLI

Use this CLI for Avanan / Check Point Harmony Email & Collaboration work: investigating phishing and malware detections, searching mail and SaaS entities, quarantining or restoring messages, managing allow and block exceptions across all seven policy engines, and running MSP tenant, license, and usage operations. Run mirror --since 7d before the offline commands (triage, campaign, timeline, exceptions find, exceptions audit) and sync --resources msp-tenants before msp fleet; those commands read the local mirror only and will report empty results against an unpopulated store. It is the right tool when a question spans more than one tenant or more than one point in time, because the mirror answers without spending API quota.

Anti-triggers

Do not use this CLI for:

• Do not use this CLI for Check Point system or audit logs; the vendor exposes those through the separate Infinity Portal API, not this one
• Do not use this CLI for Check Point firewall, endpoint, or network security products; it covers email and SaaS collaboration only
• Do not use this CLI to read mail from Microsoft 365 or Google Workspace directly; it only sees messages Avanan has scanned
• Do not use this CLI to change Avanan security policy rules or engine configuration; only exceptions are exposed through the API
• Do not use this CLI to reach a tenant in another region; credentials are region-scoped and cross-region access is refused by design

Unique Capabilities

Local state that compounds

• `triage` - See everything detected in a window you choose, bucketed by threat type, severity, and state, with the sender domains driving the volume.

_Reach for this at the start of a shift instead of re-querying the same window and eyeballing which detections you already handled._

``bash avanan-cli triage --since 24h --agent ``

• `campaign` - Group detections into candidate phishing campaigns by sender domain and normalized subject, showing recipient spread and how many are still un-remediated.

_Reach for this when triage shows volume and you need to know whether forty detections are one campaign or forty problems._

``bash avanan-cli campaign --since 7d --agent ``

• `timeline` - Reconstruct one message's history from what this CLI mirrored and did: detection, the latest mirrored state, actions this CLI submitted, task outcomes, and restore disposition, in order. Actions taken in the Avanan portal or by another tool are not in the mirror and will not appear.

_Reach for this when a user disputes a quarantine or a ticket needs evidence of what actually happened to a message._

``bash avanan-cli timeline f05b74da3ee859eea41aeac40aaad3c2 --agent ``

Collapsing the seven-headed exception system

• `exceptions find` - Ask whether a domain, sender, URL, or hash is excepted anywhere across all seven engines and ten exception tables at once.

_Reach for this before adding an allowlist entry, or when a phish got through and you need to know whether one of your own exceptions let it._

``bash avanan-cli exceptions find partner.example.com --agent ``

• `exceptions audit` - Flag exceptions that contradict each other across sub-systems, exact duplicates, and entries that have not matched traffic in the mirrored window.

_Reach for this on a policy review to find the contractor domain nobody removed and the string that is allowlisted in one engine and blocked in another._

``bash avanan-cli exceptions audit --agent ``

MSP scale

• `msp fleet` - One ranked table across every tenant joining licensed seats, add-ons, usage, and detection volume.

_Reach for this to spot tenants over their seat count or with an unusual detection week without walking the tenant list by hand._

``bash avanan-cli msp fleet --agent ``

Fixing the API's worst footgun

• `remediate` - Quarantine or restore a batch, wait for the async task to finish, and report the real per-item outcome.

_Reach for this instead of firing an action and polling by hand, and to turn the single-scope 400 into an error that names your actual scopes._

``bash avanan-cli remediate quarantine --entity f05b74da3ee859eea41aeac40aaad3c2 --wait --dry-run ``

Command Reference

action - Manage action

• avanan-cli action post-entity - Post Entity Action.
• avanan-cli action post-event - Post Event Action.

avanan-search - Manage avanan search

• avanan-cli avanan-search get-saas-entity - Get Saas Entity.
• avanan-cli avanan-search query-saas-entity - Query Saas Entity.

download - Manage download

• avanan-cli download <entity_id> - Download the raw .eml for a SaaS entity.

download-large-email - Manage download large email

• avanan-cli download-large-email <entity_id> - Return a presigned URL for downloading a message too large to stream inline.

event - Manage event

• avanan-cli event get - Get Event.
• avanan-cli event query - Query Event.

exceptions - Manage exceptions

• avanan-cli exceptions create - Create Ap Exception Blacklist.
• avanan-cli exceptions create-whitelist - Create Ap Exception Whitelist.
• avanan-cli exceptions get-ap - Get Ap Exception.
• avanan-cli exceptions get-ap-exctype - Get Ap Exception.
• avanan-cli exceptions update - Update Ap Exception Blacklist.
• avanan-cli exceptions update-whitelist - Update Ap Exception Whitelist.

msp - Manage msp

• avanan-cli msp create - Create Msp.
• avanan-cli msp create-tenants - Create Tenant.
• avanan-cli msp create-users - Create User.
• avanan-cli msp delete - Delete Msp.
• avanan-cli msp delete-tenants - Delete Tenant.
• avanan-cli msp delete-users - Delete User.
• avanan-cli msp describe-tenant - Describe Tenant.
• avanan-cli msp describe-user - Describe User.
• avanan-cli msp list - List Msps.
• avanan-cli msp list-addons - List Addons.
• avanan-cli msp list-daily-usages - List Daily Usages.
• avanan-cli msp list-licenses - List Licenses.
• avanan-cli msp list-monthly-usages - List Monthly Usages.
• avanan-cli msp list-tenants - List Tenants.
• avanan-cli msp list-users - List Users.
• avanan-cli msp update - Update User.
• avanan-cli msp update-or-create-tenant-license - Update Or Create Tenant License.

report - Manage report

• avanan-cli report - Report that one or more entities were mis-classified (phishing, spam, clean, or marketing email).

scopes - Manage scopes

• avanan-cli scopes - Get Scopes.

sectool-exceptions - Manage sectool exceptions

• avanan-cli sectool-exceptions create - Create an exception for the named security engine.
• avanan-cli sectool-exceptions delete - Delete an exception for the named security engine.
• avanan-cli sectool-exceptions update - Update an existing exception for the named security engine.

sectools - Manage sectools

• avanan-cli sectools create-anomaly-exception - Create an Anomaly engine exception rule.
• avanan-cli sectools create-ctp-item - Add an entry to a Click-Time Protection exception list.
• avanan-cli sectools delete-anomaly-exceptions - Delete Anomaly engine exception rules by rule ID.
• avanan-cli sectools delete-ctp-item - Delete one Click-Time Protection exception entry.
• avanan-cli sectools delete-ctp-items - Delete multiple Click-Time Protection exception entries by ID.
• avanan-cli sectools delete-ctp-lists - Delete every Click-Time Protection exception list.
• avanan-cli sectools get-ctp-item - Get one Click-Time Protection exception entry by ID.
• avanan-cli sectools get-ctp-list - Get one Click-Time Protection exception list by ID.
• avanan-cli sectools list-anomaly-exceptions - List the Anomaly engine's exception rules.
• avanan-cli sectools list-ctp-items - List the individual entries across Click-Time Protection exception lists.
• avanan-cli sectools list-ctp-lists - List the Click-Time Protection exception lists.
• avanan-cli sectools update-ctp-item - Update one Click-Time Protection exception entry.
• avanan-cli sectools update-ctp-items - Update Click-Time Protection exception list entries.

soar - Manage soar

• avanan-cli soar get-entity - Retrieve the decoded email record for a SaaS entity, including headers and body.
• avanan-cli soar post-notify - Send an exposure notification about a specific entity to a list of email addresses.

task - Manage task

• avanan-cli task <task_id> - Get Task.

campaign

• avanan-cli campaign - Group detections into candidate phishing campaigns by sender domain and normalized subject, showing recipient spread and how many are still un-remediated.

exceptions

• avanan-cli exceptions find - Ask whether a domain, sender, URL, or hash is excepted anywhere across all seven engines and ten exception tables at once.

• avanan-cli exceptions audit - Flag exceptions that contradict each other across sub-systems, exact duplicates, and entries that have not matched traffic in the mirrored window.

msp

• avanan-cli msp fleet - One ranked table across every tenant joining licensed seats, add-ons, usage, and detection volume.

remediate

• avanan-cli remediate - Quarantine or restore a batch, wait for the async task to finish, and report the real per-item outcome.

timeline

• avanan-cli timeline - Reconstruct one message's history from what this CLI mirrored and did: detection, the latest mirrored state, actions this CLI submitted, task outcomes, and restore disposition, in order. Actions taken in the Avanan portal or by another tool are not in the mirror and will not appear.

triage

• avanan-cli triage - See everything detected in a window you choose, bucketed by threat type, severity, and state, with the sender domains driving the volume.

Finding the right command

When you know what you want to do but not which command does it, ask the CLI directly:

avanan-cli which "<capability in your own words>"