KSIEM / SaaS Alerts Integration
Written By Matt Sywulak
Last updated 1 day ago
The KSIEM / SaaS Alerts integration streams all INKY email security events to your SaaS Alerts instance in real-time. Once connected, inbound analysis results, user reports, outbound analysis, and workflow actions are sent automatically — giving your security team a unified view of email threats alongside other data sources in SaaS Alerts.
This integration requires a Kaseya license that includes KSIEM / SaaS Alerts. Contact your sales representative if you don't see it available.
KSIEM / SaaS Alerts Integration requires INKY Pro and is gated as a beta feature. Contact your account team to have it enabled for your organization.
Before you start
You'll need:
An active SaaS Alerts account
Admin access in SaaS Alerts to configure webhook integrations
How it works
INKY generates a dedicated API key for SaaS Alerts. You paste that key into SaaS Alerts under Settings → Integrations → INKY. SaaS Alerts then establishes a webhook subscription back to INKY, and from that point on INKY pushes events automatically. No polling, no scheduled exports.
Setting up the integration
You should setup the Integration at the Root Level of your entire team. If you have the hierarchy it should have BUILDING ICON next to the name in the team selector. Doing it at this level ensures your SaaS Alerts Integration works for all your teams that have the appropriate level of permissions.
Navigate to Settings → Integrations and click the KSIEM / SaaS Alerts card to open the setup wizard.
Step 1: Overview
Review what the integration does and what you'll need, then click Get Started.
Step 2: Generate API Key
Click Generate API Key. INKY creates a dedicated integration key and displays it once. Copy it immediately — you cannot retrieve the full key value again after leaving this page.
Once copied, paste the key into your SaaS Alerts dashboard under Settings → Integrations → INKY. Then click I've Pasted the Key — Verify Connection.
Step 3: Verify connection
INKY listens for the first webhook event from SaaS Alerts. This typically takes a few seconds after you paste the key. The page shows a live status:
Waiting — listening for SaaS Alerts to connect
Taking longer than expected — no connection detected after 2 minutes; confirm the key is pasted correctly in SaaS Alerts, then try again
Error — a verification error occurred; retry or skip and verify later
If you need to proceed without waiting, click Skip Verification. Setup will complete but a caution banner will indicate the connection hasn't been confirmed yet.
Step 4: Complete
When SaaS Alerts connects successfully the page shows Connected Successfully! with the connection timestamp. INKY is now streaming events.
If you skipped verification, the page shows Setup Complete without a connection timestamp. You can return to the integration card at any time to check whether the connection has been established.
Connection status
The KSIEM / SaaS Alerts card on the integrations list shows one of three states:
Connected — SaaS Alerts has established a webhook subscription and is receiving events
Pending — a key has been generated but SaaS Alerts hasn't connected yet
Not connected — no key is active
Organization-level inheritance
If a SaaS Alerts integration is configured at the organization level, child teams are covered by that connection automatically. An "Connected via organization" banner appears when you open the integration for a child team. Child teams can optionally set up their own team-specific integration alongside the org-level one.
Managing your integration key
From the Complete step (or the integration card if already connected), you have two key management actions:
If a key exists but SaaS Alerts hasn't connected (orphaned key state), the wizard shows a Previously Generated Key screen instead of the normal overview. From there you can regenerate or revoke the key to start fresh.