<h2 id="c4q56o73plw" data-toc-id="c4q56o73plw">About this integration</h2>The KSIEM/SaaS Alerts integration streams INKY email security events to your KSIEM/SaaS Alerts instance in real time. Inbound analysis results, user reports, outbound analysis events, and workflow actions are automatically sent to KSIEM/SaaS Alerts, enabling your security team to monitor email threats from a centralized dashboard alongside data from other security sources.<callout-component color="Accent">KSIEM / SaaS Alerts Integration requires an INKY Pro or INKY Advanced subscription and is gated as a beta feature. Contact your account team to have it enabled for your organization.</callout-component>To configure the integration, see the applicable documentation:<ul><li><a target="_blank" rel="noreferrer noopener" class="Hyperlink SCXW129087548 BCX8 link" href="https://help.saasalerts.kaseya.com/help/Content/Integrations/inky-integration.htm">Integration: SaaS Alerts and INKY</a> in the SaaS Alerts Help system.</li><li><a target="_blank" rel="noreferrer noopener" class="Hyperlink SCXW261145010 BCX8 link" href="https://help.siem.kaseya.com/help/Content/integrations-and-data-sources/saas-and-cloud-sources/inky-integration.htm">Integration: Kaseya SIEM and INKY</a> in the Kaseya SIEM Help system.</li></ul>

Integration: KSIEM/SaaS Alerts & INKY 

Feedback

Changelog

Matt Sywulak

Everything about running an INKY trial — what it includes, getting mail flowing, reading your results, and what happens when it ends.

INKY Trial

Your INKY trial: what you get and how long it lasts

Getting protected: the nine setup steps

Your trial home page

Guided walkthroughs in the INKY console

Getting more from your trial: the eight tracks

What INKY has found: reading your trial results

Continuing with INKY after your trial

Trial FAQ and troubleshooting

Eric Heller

Getting started with INKY

Logging into INKY

Installing INKY for your organization’s own team is a great way to become familiar with INKY’s features and deployment strategies. The key procedures include generating a license and installing INKY in your email platform.

Installing INKY for your organization's own team

The key procedures include generating a license and installing INKY in the client's email platform.

Installing INKY for a customer organization

Reference guide covering how INKY detects threats, what warning banners mean, bundle differences, and core concepts.

Understanding INKY Basics

Compare features across INKY's tiers to find the right level of protection for your organization.

INKY Email Security Bundles

Connect INKY to your email platform in 20-30 minutes. No MX changes required, no business continuity risk.

Platform Setup Guide

Monitoring email while in Journal mode

Understand how to roll out INKY protection using Journal Mode for monitoring, then phased INKY-Users group expansion for full protection.

Deployment Strategy

Successfully deploy INKY to users through clear communication, phased rollout, and effective adoption strategies.

End-User Rollout Guide

Find your way around the INKY App Dashboard—where settings live, how to access key features, and what each section controls.

Dashboard Navigation

Command Palette (Cmd+K)

The main navigation bar provides access to all major INKY sections.

Top Navigation Menu

The Overview page is your security command center—see threat trends, user reporting activity, and attack patterns at a glance.

Dashboard Overview

Control which team's data you're viewing and the timeframe for all dashboard metrics.

Switching Teams & Time Ranges

Observations is INKY's detailed email analysis view. Every email INKY processes appears here with complete threat intelligence, delivery routing, and remediation options.

Observations

Pre-built reports for tracking threat patterns, user engagement, and risky behavior.

Pre-built Reports

Account structure, admin access control, organization hierarchy, and settings inheritance across teams

Administration & Hierarchy

Organization settings cascade down to child teams automatically. Lower-level settings override higher ones.

Organization Settings & Inheritance

INKY's Admin List lets Super Admins control who can access and modify your INKY environment. Add admins individually by email or assign roles to entire groups.

Admin Management

Track all changes and actions performed in the INKY Dashboard. Super Admins get complete oversight of who changed what and when.

Audit Log

Michel Young

Nathan McCurley

Core phishing protection features, banner system configuration, user reporting tools, and threat detection guides for securing your organization's email.

Email Security

Smart Insights feature guide

Phish Fence is INKY's core anti-phishing engine that analyzes every inbound, internal, and outbound email to detect and block threats before they reach your users. It combines multiple detection methods—including AI, computer vision, sender authentication, and behavioral analysis—to identify phishing attempts, malware, and social engineering attacks that traditional security tools miss.

Phish Fence Explained

Configure how INKY handles simulated phishing emails from your security awareness training platform so tests reach users without interference—while keeping your SOC queue clean.

Phishing Awareness Training

Quarantine Features

Enable Graymail filtering for Google Workspace

The Sign-In Events page provides visibility into user authentication activity, helping detect compromised accounts and investigate suspicious access attempts.

Sign-In Events

Control email delivery by explicitly trusting or blocking specific senders. These lists override INKY's automated threat detection, giving administrators direct control over which emails reach users and which get quarantined.

Allow and Block List

Allow List entries suppress specific INKY warnings for trusted senders. Use this when legitimate emails are incorrectly flagged.

Allow List Overview

Block List entries force INKY to classify specific senders as spam or phishing, overriding automated threat detection. Use this to permanently block known threats or unwanted senders.

Block List Overview

Create custom rules that automatically classify threats based on URLs, attachments, and email properties. Advanced Block List provides granular control beyond basic sender blocking.

Advanced Block List

Modify existing entries to fix mistakes or adjust authentication settings. You can change everything except the result type.

Editing Allow and Block List Entries

Users can create personal Allow and Block List entries that apply only to their mailbox. Admins can also create and manage user-specific entries.

User-Level Allow and Block Lists

Copy an existing Allow or Block List entry up to the organization so it applies to every team — current and future — instead of just one.

Applying an Allow or Block List Entry to All Teams

INKY's threat detection and email analysis features. Covers spoofing detection, spam/graymail controls, sender verification, and detection settings.

Analysis Configuration

Burst Detection

VIP Spoofing Protection escalates threats to Danger level when attackers impersonate your highest-risk targets—executives, board members, and frequently-spoofed employees. This is more aggressive than standard Internal Name Spoofing Protection.

VIP Spoofing Protection

INKY detects when attackers impersonate your employees by comparing email display names against your organization's directory (Microsoft 365 or Google Workspace). No manual lists required.

Internal Name Spoofing Protection

INKY rewrites all links in emails to route clicks through real-time analysis. This catches threats that become active after delivery and helps users evaluate risks before reaching dangerous sites.

Link Rewriting

INKY combines its own spam detection with results from Microsoft EOP or Google Workspace. Configure how aggressively INKY classifies spam and whether to use upstream provider results.

Spam Settings

INKY identifies legitimate bulk mail (newsletters, promotions, notifications) and moves it aside so users can focus on important messages. Unlike spam or phishing, graymail is mail users may have subscribed to but doesn't need immediate attention.

Graymail Protection

Mark trusted business partners and vendors as "Known External" so users see blue banners instead of gray on their authenticated emails.

Known External Senders

Prevent false spoofing alerts when third-party services send mail on behalf of your domain without proper authentication.

Trusted Third-Party Senders

Tell INKY which security filter sits upstream so it can track the correct mail hop. INKY scans after the MX record, so it needs to know where mail came from to check that specific hop accurately.

Upstream Provider

Configure specialized detection rules for QR codes, new domains, geographic blocking, and suspicious TLDs.

Additional Analysis Settings

Learning Mode adjusts INKY during initial deployment to encourage user feedback and reduce false positives while the system learns your email patterns.

Learning Mode

Configure how INKY handles mail from your domains arriving through external systems—critical for accurate spoofing detection.

Internal Mail Detection

Find prebuild comma separated value lists for blocking countries from your tenant.

Block Countries csv lists

All things related to the configuration and control of the Email Assistant.

Email Assistant (INKY Banner)

INKY's color-coded banners appear directly in emails to warn users about phishing threats. Think of them as traffic signals for email security: red means danger, yellow means caution, blue shows trusted external contacts, and gray provides neutral context.

INKY Email Assistant Explained

One-click email reporting makes it easy for users to classify threats and train INKY's detection engine. Instead of navigating through multiple screens, users can report messages as Safe, Spam, Phish, or Graymail directly from the banner with a single click.

Quick Action Reporting Links

INKY's banners use standard language for consistency, but administrators can customize branding, links, and display behavior.

Banner Customization

Common Banner Questions

Banner Troubleshooting

Common Questions

This guide covers common scenarios for finding specific emails in INKY.

How to Search for Emails

Calendar Invites Bypassing INKY

Guides for scanning outbound email, encrypting sensitive messages, and configuring data protection policies.

Outbound Protection and Encryption

INKY's Outbound Mail Protection (OMP) detects sensitive information in outgoing email and applies policy-driven actions before messages leave your organization.

Outbound Mail Protection

Workflow rules define which outbound messages trigger actions. When INKY detects conditions you specify, it applies the actions you choose.

Configure Workflow Rules

Workflow approvers review and approve outbound messages that match OMP rules. Define sender-to-approver relationships to automate routing.

Set Up Workflow Approvers

INKY encrypts outbound email and delivers it through a secure portal. Recipients access messages via authentication, keeping sensitive content protected.

Email Encryption Setup

Personalize the encryption portal and notification emails to match your organization's branding and security requirements.

Customize Encryption Portal

Control what information appears in OMP notifications sent to senders and approvers.

Configure Notification Settings

OMP Approve & Encrypt

OCR in Outbound DLP Scans

Outbound FAQ

Tag external-bound mail with a custom header in Microsoft 365, then key your INKY Outbound Mail Protection (OMP) rules off that header so they only fire on traffic leaving the organization.

Scope Outbound Protection Rules to External Recipients in Microsoft 365

Platform-specific guides and troubleshooting

Platform Integrations

Autotask Ticketing Integration

Gradient MSP Integration

Comprehensive guides for creating, managing, and deploying professional email signatures across your organization.

Email Signatures

Overview

This guide walks you through creating your first email signature in just 10 minutes.

Getting Started with Email Signatures

Learn how to create targeted signatures for different teams and control how they're deployed.

Profiles & Deployment Strategies

Build custom email signature layouts that automatically populate with user and company data. The Layout Builder lets you control exactly which fields appear in signatures, how they're arranged, and when they're displayed.

Signature Layout Builder Guide

Set up core company details, website links, and promotional calls-to-action that appear across all email signatures, ensuring consistent branding and messaging for your entire organization.

Company Information & Call-to-Action Links

Add professional branding and promotional visuals to email signatures with company logos and footer images. INKY handles sizing, placement, and ensures images display properly across email clients.

Logos & Footers

Add social media profiles to email signatures with customizable display options. Recipients can click these links to connect with your team on professional and social platforms.

Social Media Links

Add personalized headshots to email signatures by pulling profile photos directly from your Microsoft 365 or Google Workspace directory.

User Profile Photos

Add custom text to the bottom of email signatures for disclaimers, taglines, compliance notices, or additional company information. Footer text appears below all signature content and images.

Footers and Disclaimers

Advanced signature management features for enterprise deployments. Delegate signature administration to non-IT staff, display signatures in users' Sent Items folders (Microsoft 365), and automatically convert plain-text emails to HTML for proper banner and signature formatting. Available with Email Signatures add-on.

Advanced Signature Features

Your organization uses INKY to automatically add professional signatures to your outbound emails. This page lets you personalize your signature with your current contact information.

Update End-User Email Signature Information

Solutions to common issues and frequently asked questions.

Troubleshooting Guide

Control the visual appearance of email signatures across your organization. Set fonts, colors, width, and formatting options that apply to all profiles.

Signature Styling & Formatting

User Signature Visibility

The User Center is where you manage your personal INKY settings. Customize how INKY handles email for your mailbox without affecting team-wide policies.

User Center

Customize how INKY handles specific senders for emails delivered to you individually.

Personal Allow List & Block List

Your team uses INKY's Email Signatures for consistent outbound branding. Personalize your signature data while maintaining company formatting.

Graymail Protection identifies bulk newsletters and promotional mail that isn't dangerous but clutters your inbox.

INKY's Email Encryption protects sensitive information by routing messages through a secure portal instead of standard email. Recipients authenticate once and reply securely without plugins.

Email Encryption

A guide for anyone who has received a secure message from someone using INKY Email Encryption.

How to Open an INKY Encrypted Email

License generation, initial INKY installation procedures, deployment steps, and essential configuration tasks for getting your email security system up and running.

Team Setup & Maintenance

Team Setup lets you generate licenses, onboard new customers, and manage INKY deployments for Microsoft 365 and Google Workspace environments—all from one unified dashboard.

Getting Started

Installation of an M365 is an incredibly streamlined process now using our Team Setup process. After you created the License from the previous step here you can begin the install process following the steps below. 

Microsoft 365

The Google Workspace setup process is now streamlined. You can generate and redeem an INKY license directly from the Partner Center. After completing the initial configuration, return to the installation guide to finish the setup.

Google Workspace

This process completely removes a team from INKY and unredeems their license. Use this when a customer cancels their subscription or you need to fully remove INKY from their environment.

Offboard and Uninstall a Client

INKY now supports migration from legacy mail-enabled security groups to Microsoft 365 Groups, unlocking advanced management capabilities and modernizing your email security infrastructure.

Microsoft 365 Groups Migration

The Group Management Interface provides direct control over user assignments, group membership, and sync settings for INKY-protected users.

Group Management

Setup and configuration guides for deploying INKY in Google Workspace environments.

Google Workspace Setup

This documentation is for a standard quick install of INKY in Google workspace.

