Integration remediation permissions and customer approval workflow
PURPOSE
This guide explains the remediation permission options available for an integration and the customer actions associated with each option. The configured permission determines whether a Check Point MDR analyst may perform remediation, must obtain approval, or may proceed automatically.
Remediation Permission Options
| Setting | Analyst authorization | Required customer action |
| Do not perform remediations | Check Point MDR analysts are not authorized to perform remediation, either automatically or upon request. This is the default setting. | No approval workflow applies because remediation is not authorized. |
| Requires approval | A Check Point MDR analyst must receive customer approval for each instance that qualifies for remediation. | Review each request under Operations > Pending Approvals, then approve or reject it. |
| Always approve | A Check Point MDR analyst is automatically authorized to remediate a host. | No per-instance approval is required. IP addresses and hostnames on the blacklist remain excluded. |
Customer Approval Workflow
When Requires approval is enabled, please complete the following steps
| 1 | Go to Operations: Select the Operations tab. |
| 2 | Review pending requests: Locate remediation requests listed under Pending Approvals. |
| 3 | Take action: Review the request details and approve or reject each remediation instance. |
Approval Summary
If Requires approval is enabled for your integration, remediation requests will appear in the Operations tab under Pending Approvals. Please review each request and approve or reject it as appropriate. Notification behavior is being validated; until confirmed, please monitor the Pending Approvals queue for new requests.