Email Threat Data in Your Product.
Without Custom Connectors.
Synqly connects your product to email security platforms so you can pull phishing detections, malware findings, and email-borne threat data, and correlate it with identity, endpoint, and SIEM data, through a single API.
Bi-Directional Integrations with Email Security Platforms
Email is consistently one of the top initial access vectors for attackers. Phishing campaigns, malware attachments, business email compromise, all of these generate detection data in email security platforms that security products need to access, correlate, and act on.
Synqly’s Email Security connector gives your product normalized access to email threat data from the platforms your customers use. Query phishing detections, malware findings, and suspicious message data. Correlate email-based attacks with identity, endpoint, and SIEM data from other Synqly connectors, so your product can see the full attack chain from initial email through to endpoint compromise or lateral movement.
Phishing investigation
Pull email threat detections into your product to investigate phishing campaigns, correlated with identity data to identify targeted users and endpoint data to assess compromise.
Attack chain reconstruction
Trace attacks from initial email delivery through credential theft or malware execution by combining email threat data with identity audit logs and endpoint telemetry from other Synqly connectors.
Automated response coordination
When an email security platform detects a phishing attack targeting a specific user, automatically trigger identity and endpoint response actions through connected Synqly integrations.
Threat intelligence enrichment
Feed indicators extracted from email threats, including sender domains, URLs, and attachment hashes, into SIEM platforms and threat intelligence workflows via connected Synqly integrations.
Synqly Trusted
Email Security Partners
Email Security Integration Technical Capabilities
Get Threat Details
Returns the details of the threat matching `{threatId}` from the token-linked Email Security provider. If a provider allows for the gathering of more detailed information about a threat, the response will include the additional information. Otherwise, the response will only include the basic information about the threat returned by the query_threats endpoint.
Query Email Events
Returns a list of email events matching the query from the token-linked Email Security provider. Defaults to the last 30 days of email events. This can be overridden by using the `time` filter. Note that some providers may have a maximum time range limit.
Query Threats
Returns a list of threats matching the query from the token-linked Email Security provider. Defaults to the last 30 days of threats. This can be overridden by using the `time` filter. Note that some providers may have a maximum time range limit. A threat is an automated detection that was deemed to be a threat by the Email Security provider.
