In short
Check Point EDR is built into Check Point Endpoint Security, the product formerly called Harmony Endpoint, in every edition. It provides automated forensics reports mapped to MITRE ATT&CK, threat hunting and remediation alongside anti-ransomware with file restoration. Infinity XDR, in the Elite edition or as an add-on, correlates endpoint events with the rest of your Check Point estate, and Check Point MDR adds Check Point's own analysts 24/7.
Get a quote for Check Point EDR
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Where EDR sits in Check Point's range
Check Point's endpoint product began as SandBlast Agent, became Harmony Endpoint and is now called Check Point Endpoint Security on Check Point's website, which describes EPP, EDR and XDR capabilities in a single client. Quotes and renewals may use any of these names.
Unlike vendors that sell detection and response as a separate upgrade, Check Point includes EDR in every edition. That changes the buying question. You are not deciding whether to pay for EDR; you are deciding how far beyond the endpoint you want to see, and who will act on what the agent finds.
For the product in depth, including deployment, our Check Point specialist site covers Check Point Endpoint Security and its EDR and XDR features. For antivirus on its own, see our sister site endpointprotection.uk.
What Check Point EDR gives you
The detection and response side of the agent covers the investigation work that follows an alert:
- Automated forensics reports: when the agent detects an attack, it builds a report of how it started, what it touched and what was remediated, so a smaller team does not have to piece the story together by hand
- MITRE ATT&CK mapping: detections are described against the MITRE ATT&CK framework, which gives analysts a shared language for what stage an attack has reached
- Threat hunting: search across endpoint data in the console for indicators and techniques, so you can look for activity that did not trigger an alert
- Remediation: quarantine files, stop processes and clean up from the console
- Anti-ransomware with file restoration: the agent watches for ransomware behaviour, stops it and restores files the attack encrypted
- ThreatCloud AI: verdicts draw on Check Point's threat intelligence service, which also feeds its email, mobile and network products
Because prevention and EDR live in one agent and one console, an alert, the forensics report and the response actions sit together. Our guide to endpoint detection and response explains how EDR works in general, and how to prevent ransomware attacks covers the wider controls around file restoration.
Editions and where XDR comes in
Every edition uses the same agent; the licence decides which components are switched on. Each edition includes everything to its left:
| Capability | Basic | Advanced | Complete | Elite |
|---|---|---|---|---|
| Anti-ransomware, anti-malware, anti-exploit, anti-bot | Yes | Yes | Yes | Yes |
| EDR: forensics, MITRE ATT&CK mapping, threat hunting | Yes | Yes | Yes | Yes |
| Threat Emulation (sandboxing) and Threat Extraction (file sanitisation) | No | Yes | Yes | Yes |
| Full disk encryption and removable media encryption | No | No | Yes | Yes |
| Infinity XDR, posture management, DLP and GenAI controls | No | No | No | Yes |
Check Point's current solution brief lists Advanced, Complete and Elite; Basic, with prevention and EDR but no sandboxing, is also available through us. Infinity XDR correlates endpoint events with what your Check Point firewalls, email security and other products see, and Check Point also sells it as an add-on to lower editions. If you need two or more of XDR, posture management and DLP, it is worth comparing the add-ons against Elite. Our extended detection and response guide sets out when XDR adds real value.
Not sure which edition fits? Ask us
Tell us what you need and we will recommend the right edition for your organisation, with a quote.
Check Point MDR: Check Point's own analysts
EDR raises alerts, and someone has to act on them out of hours. Check Point MDR is Check Point's managed service: its analysts watch the telemetry from your security tools around the clock, decide which alerts are real, investigate and act, for example by isolating a device or blocking an indicator. Check Point describes it as covering:
- 24/7 detection and response, including automated containment
- Proactive threat hunting for activity that has not triggered an alert
- Incident response included in the service
- Identity threat detection, with native support for Microsoft Active Directory, Microsoft Entra ID and Okta
- Endpoints, email, network, cloud and identity, with integrations for third-party EDR, firewalls and cloud services as well as Check Point products
It can be bought per endpoint as a standalone service, or as an add-on to Check Point Endpoint Security licences. Before go-live you agree escalation contacts and what the analysts may do without asking. Read more on Check Point MDR on our Check Point site.
Platforms and management
Check Point lists Windows workstations, Windows Server, macOS, the major Linux distributions and VDI and terminal server environments. Feature coverage is fullest on Windows, and some features, such as device isolation, vary by platform, so we check your estate against Check Point's current support list before quoting.
Management is normally in the cloud through the Check Point Portal, with nothing to host; organisations that must keep management in-house can use an on-premises management server. Check Point lists Microsoft Intune and Jamf for deploying the client, which fits the pilot-then-enforce approach in our EDR deployment guide.
Is Check Point EDR the right fit for you?
We will check it against your systems and requirements and recommend the right option.
How Check Point is licensed
Check Point Endpoint Security is a subscription counted per protected device. You can license groups of devices at different editions, for example Complete for laptops that leave the office and Advanced for servers where disk encryption is not wanted, and moving up is a licence and policy change on the same agent.
Through Forever Systems it is provisioned in your own Check Point Portal tenant and can be billed monthly on the devices in use, with terms confirmed at quote. Licensing detail is on our Harmony Endpoint licensing and Check Point MDR licensing pages, and our Check Point site compares the Harmony Endpoint editions.
Who Check Point EDR suits
Check Point's approach fits organisations that:
- want prevention and EDR in one agent without paying separately for detection and response
- already run Check Point firewalls or Check Point email security and want endpoint events in the same portal, with Infinity XDR as the next step
- put ransomware recovery high on the list and value file restoration on the device
- want the option of a vendor-run MDR service that can also take in non-Check Point tools
Comparing it with other platforms? See best EDR solutions and our endpoint security vendors page, including Sophos detection and response and Cisco EDR.
How Forever Systems helps
We can count your devices, recommend an edition, run a trial in your own tenant if you want one, deploy the agent, tune policies and agree with you how alerts are handled, whether by your team or by Check Point MDR. Licence changes and renewals then sit on one Forever Systems account.
Contact us to talk about Check Point EDR for your organisation.
How Forever Systems helps with endpoint security
We are an independent UK IT and cyber security provider. We supply and support endpoint security from several vendors, so we can recommend what fits your devices, your people and your budget rather than one vendor's answer to everything.
- Start with what you have: we can review your current antivirus, EDR and Microsoft 365 licences before suggesting anything new
- Vendor-aware advice on EDR, XDR and managed detection and response, including CrowdStrike, SentinelOne, WatchGuard, Bitdefender, Sophos, Check Point, TrendAI and Cisco
- Deployment help: planning a rollout, replacing an existing product and setting sensible policies for device control, encryption and patching
- Policies and compliance: we help you map your controls to Cyber Essentials and the NCSC's device guidance
- Ongoing support options, such as policy tuning, renewals and regular reviews, agreed and confirmed at quote
We work with businesses, schools, charities and public sector organisations. Tell us about your devices and we will suggest a sensible next step.
Frequently asked questions
Does Check Point Endpoint Security include EDR?
Yes. Detection and response, with automated forensics reports, MITRE ATT&CK mapping, threat hunting and remediation, is included in every edition of Check Point Endpoint Security, the product formerly called Harmony Endpoint.
Is Check Point Harmony Endpoint EDR the same as Check Point EDR?
Yes. Harmony Endpoint is now called Check Point Endpoint Security on Check Point's website, and its EDR is the same capability. Older quotes and renewals may use the Harmony Endpoint or SandBlast Agent names.
What is the difference between Check Point EDR and XDR?
EDR works on the endpoint: it detects, investigates and responds on each device. Infinity XDR, in the Elite edition or as an add-on, correlates endpoint events with the rest of your Check Point estate, such as firewalls and email security.
What does Check Point MDR cover?
Check Point describes 24/7 detection and response with automated containment, threat hunting, included incident response and identity threat detection, across endpoints, email, network, cloud and identity, including some third-party tools.
Which platforms does Check Point EDR support?
Check Point lists Windows workstations, Windows Server, macOS, the major Linux distributions and VDI environments. Some features vary by platform, so we check your estate against the current support list.
How much does Check Point EDR cost?
It depends on the number of devices, the edition and whether you add MDR. Through us it can be billed monthly, with terms confirmed at quote. Ask us for a quote.
Still have a question about Check Point EDR?
Ask us and a member of our team will reply by email.
More endpoint security guides
Sophos detection and responseSophos EDR, Sophos XDR and Sophos MDR on one agent: what each tier adds and who it suits.
Cisco EDRCisco Secure Endpoint's detection and response, Talos threat hunting, Cisco XDR and the Breach Protection Suite.