> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/email-security/twilio-sendgrid.md).

# Twilio Sendgrid

By integrating Twilio SendGrid with ThreatDefence via the SendGrid v3 API, you can seamlessly ingest email activity and account access data into ThreatDefence for centralized monitoring and response.

This integration enhances visibility into:

* Email delivery and message activity
* IP access attempts against the account
* Account and API usage behavior

It enables more effective detection of account compromise, credential misuse, and abuse of email-sending infrastructure.

***

#### Before you begin:

* Only users with the **Admin** role on the SendGrid account (or a Teammate granted **API Keys** access) can create API keys. The key must be generated on the same account whose activity you want to collect.
* This integration collects two datasets from your SendGrid account:
  * **Email Activity Logs** — message-level email events. This requires the **Email Activity Feed** feature to be enabled on your account (included on some plans, an add-on on others).
  * **IP Access Attempts** — the access-management activity feed showing which IPs have attempted to access the account.

***

#### Step 1: Identify your account region

SendGrid serves two regional API endpoints. The integration must point at the one your account lives on.

1. **Log in to the SendGrid app**
   * Go to [https://app.sendgrid.com](https://app.sendgrid.com/).
   * Sign in with your SendGrid account.
2. **Determine your region**
   * **Global** accounts use `https://api.sendgrid.com` (this is the default).
   * **EU** accounts (created under SendGrid's EU data residency) use `https://api.eu.sendgrid.com`.
   * If you are unsure, check **Settings → Account Details**, or simply note which region was selected when the account was created.

> **Note:** Most accounts are Global. Only record the region if your account is hosted in the EU — it is needed so the integration queries the correct endpoint.

***

#### **Step 2: Create an API Key**

1. **Navigate to API Keys**
   * From the SendGrid app, go to **Settings → API Keys**.
2. **Create a new API key**
   * Click **Create API Key**.
   * Enter a descriptive name (e.g., `"ThreatDefence Audit Logs"`).
   * Choose **Restricted Access** (recommended over Full Access) and grant **read** permission to:
     * **Email Activity** (for Email Activity Logs)
     * **IP Management** / **IP Access Management** (for IP Access Attempts)
   * Click **Create & View**, then **Copy** the API key immediately — it is shown only once and cannot be retrieved again.

> **Important:** API keys are account-level credentials. Store the key securely; if it is lost you must generate a new one. The key does not expire on its own, but it can be revoked from **Settings → API Keys** at any time, so coordinate before deleting old keys.

***

#### **Onboarding the integration**

Please follow the [Managing Integrations](/platform-management/managing-integrations.md) instructions and onboard the integration. The credentials saved above are required in this process.

If you encounter difficulties with onboarding, please email the following credentials to <support@threatdefence.com>

* API Key
* Account Region (Global or EU) — only if your account is hosted in the EU


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.threatdefence.com/siem-integrations/email-security/twilio-sendgrid.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.