diff --git a/agent_based/checkpoint_threat_emulation.py b/agent_based/checkpoint_threat_emulation.py
index e2179094c0fa4a0c68e71aaa01f2d2220e9d4edd..d17fff297f9f0b2074df268fd7db63c6de198b32 100644
--- a/agent_based/checkpoint_threat_emulation.py
+++ b/agent_based/checkpoint_threat_emulation.py
@@ -16,6 +16,7 @@
 # 2020-06-08: changed snmp-scan function
 # 2021-08-27: rewritten for CMK 2.0
 # 2022-09-08: fixed check_default_parameters
+#             fixed levels for remaining quota in cloud, use lower instead of upper
 #
 
 # snmpwalk sample
@@ -145,7 +146,6 @@ def check_checkpoint_threat_emulation(params, section: CheckpointTeStatus) -> Ch
 
     for levels, metric, label, value in [
         (params.get('used_monthly_quota_levels'), 'monthly_quota_on_cloud_used', 'Used quota on cloud', section.monthly_quota_on_cloud_used),
-        (params.get('remaining_quota_levels'), 'remaining_quota_on_cloud', 'Remaining quota on cloud', section.remaining_quota_on_cloud),  # max: quota_on_cloud
         (params.get('files_waiting_levels'), 'current_files_waiting_for_emulation', 'Current files waiting for emulation', section.current_files_waiting_for_emulation),  # max: quota_on_cloud
     ]:
         if value:
@@ -157,6 +157,18 @@ def check_checkpoint_threat_emulation(params, section: CheckpointTeStatus) -> Ch
                 render_func=lambda v: f'{v:.0f}'
             )
 
+    for levels, metric, label, value in [
+        (params.get('remaining_quota_levels'), 'remaining_quota_on_cloud', 'Remaining quota on cloud', section.remaining_quota_on_cloud),  # min: quota_on_cloud
+    ]:
+        if value:
+            yield from check_levels(
+                value=value,
+                label=label,
+                levels_lower=levels,
+                metric_name=metric,
+                render_func=lambda v: f'{v:.0f}'
+            )
+
     for metric, value in section.metric_count:
         yield Metric(
             value=value,
diff --git a/checkpoint_threat_emulation.mkp b/checkpoint_threat_emulation.mkp
index 877920ec73eda1ed23d1de792b54247e98bd9288..57ab82e46a3382726d99b6535b5ba5f736db996b 100644
Binary files a/checkpoint_threat_emulation.mkp and b/checkpoint_threat_emulation.mkp differ