> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/email-security/twilio-sendgrid.md).

# Twilio Sendgrid

By integrating Twilio SendGrid with ThreatDefence via the SendGrid v3 API, you can seamlessly ingest email activity and account access data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

* Email delivery and message activity
* IP access attempts against the account
* Account and API usage behavior

It enables more effective detection of account compromise, credential misuse, and abuse of email-sending infrastructure.

***

#### Before you begin:

* Only users with the **Admin** role on the SendGrid account (or a Teammate granted **API Keys** access) can create API keys. The key must be generated on the same account whose activity you want to collect.
* This integration collects two datasets from your SendGrid account:
  * **Email Activity Logs** — message-level email events. This requires the **Email Activity Feed** feature to be enabled on your account (included on some plans, an add-on on others).
  * **IP Access Attempts** — the access-management activity feed showing which IPs have attempted to access the account.

***

#### Step 1: Identify your account region

SendGrid serves two regional API endpoints. The integration must point at the one your account lives on.

1. **Log in to the SendGrid app**
   * Go to [https://app.sendgrid.com](https://app.sendgrid.com/).
   * Sign in with your SendGrid account.
2. **Determine your region**
   * **Global** accounts use `https://api.sendgrid.com` (this is the default).
   * **EU** accounts (created under SendGrid's EU data residency) use `https://api.eu.sendgrid.com`.
   * If you are unsure, check **Settings → Account Details**, or simply note which region was selected when the account was created.

> **Note:** Most accounts are Global. Only record the region if your account is hosted in the EU — it is needed so the integration queries the correct endpoint.

***

#### **Step 2: Create an API Key**

1. **Navigate to API Keys**
   * From the SendGrid app, go to **Settings → API Keys**.
2. **Create a new API key**
   * Click **Create API Key**.
   * Enter a descriptive name (e.g., `"ThreatDefence Audit Logs"`).
   * Choose **Restricted Access** (recommended over Full Access) and grant **read** permission to:
     * **Email Activity** (for Email Activity Logs)
     * **IP Management** / **IP Access Management** (for IP Access Attempts)
   * Click **Create & View**, then **Copy** the API key immediately — it is shown only once and cannot be retrieved again.

> **Important:** API keys are account-level credentials. Store the key securely; if it is lost you must generate a new one. The key does not expire on its own, but it can be revoked from **Settings → API Keys** at any time, so coordinate before deleting old keys.

***

#### **Onboarding the integration**

Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The credentials saved above are required in this process.

If you encounter difficulties with onboarding, please email the following credentials to <support@threatdefence.com>

* API Key
* Account Region (Global or EU) — only if your account is hosted in the EU


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/email-security/twilio-sendgrid.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.