Twilio Sendgrid

By integrating Twilio SendGrid with ThreatDefence via the SendGrid v3 API, you can seamlessly ingest email activity and account access data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

• Email delivery and message activity

• IP access attempts against the account

• Account and API usage behavior

It enables more effective detection of account compromise, credential misuse, and abuse of email-sending infrastructure.

---

Before you begin:

• Only users with the Admin role on the SendGrid account (or a Teammate granted API Keys access) can create API keys. The key must be generated on the same account whose activity you want to collect.

• This integration collects two datasets from your SendGrid account:

  • Email Activity Logs — message-level email events. This requires the Email Activity Feed feature to be enabled on your account (included on some plans, an add-on on others).

  • IP Access Attempts — the access-management activity feed showing which IPs have attempted to access the account.

---

Step 1: Identify your account region

SendGrid serves two regional API endpoints. The integration must point at the one your account lives on.

1. Log in to the SendGrid app

   • Go to https://app.sendgrid.com.

   • Sign in with your SendGrid account.

2. Determine your region

   • Global accounts use https://api.sendgrid.com (this is the default).

   • EU accounts (created under SendGrid's EU data residency) use https://api.eu.sendgrid.com.

   • If you are unsure, check Settings → Account Details, or simply note which region was selected when the account was created.

Note: Most accounts are Global. Only record the region if your account is hosted in the EU — it is needed so the integration queries the correct endpoint.

---

Step 2: Create an API Key

1. Navigate to API Keys

   • From the SendGrid app, go to Settings → API Keys.

2. Create a new API key

   • Click Create API Key.

   • Enter a descriptive name (e.g., "ThreatDefence Audit Logs").

   • Choose Restricted Access (recommended over Full Access) and grant read permission to:

     • Email Activity (for Email Activity Logs)

     • IP Management / IP Access Management (for IP Access Attempts)

   • Click Create & View, then Copy the API key immediately — it is shown only once and cannot be retrieved again.

Important: API keys are account-level credentials. Store the key securely; if it is lost you must generate a new one. The key does not expire on its own, but it can be revoked from Settings → API Keys at any time, so coordinate before deleting old keys.

---

Onboarding the integration

Please follow the Managing Integrations instructions and onboard the integration. The credentials saved above are required in this process.

If you encounter difficulties with onboarding, please email the following credentials to [e-mail]

• API Key

• Account Region (Global or EU) — only if your account is hosted in the EU