Inky: receive phishing and threat events into Current

Inky is the one connector in Current that works backwards from all the others. Every other reporting integration is a key you paste so Current can go and read the vendor. Inky has no such API to read — its only way to send data out is its Custom SIEM Feed, which POSTs each email-security event to a URL you give it. So instead of Current reaching into Inky, you point Inky at Current. You enable a receiver here, copy the URL it gives you, and paste that URL into Inky.

1. 1
   Open Integrations → Inky → Manage

   Integrations sits under Admin in the left sidebar, so this is a Tenant Admin action.
2. 2
   Press Enable receiver

   Current generates a unique, secret feed URL for your workspace and stores it. Nothing is sent anywhere yet — the receiver is simply now listening.
3. 3
   Copy the feed URL

   The drawer shows the full URL with a Copy button. Anyone who has this URL can post events into your stats, so treat it like a password. It's shown here (not hidden) on purpose, so your team can re-copy it later without regenerating it.

1. 1
   Open Inky's Custom SIEM Feed

   In Inky, go to Settings → Integrations → Custom SIEM Feed and choose Configure.
2. 2
   Paste the URL and choose JSON

   Enter the URL you copied from Current as the webhook / endpoint URL, and set the format to JSON. If Inky offers event filters, you can scope which event types it sends.
3. 3
   Save and send a test event

   Save the feed, then use Inky's test/send option. The Current card flips from Awaiting feed to Receiving within seconds of the first event landing.

Each event carries a recipient — the protected mailbox — and Current uses that recipient's domain to decide which company it belongs to. A domain that uniquely matches one of your Current companies (by the website on the company profile) is linked automatically; a domain that matches none, or more than one, is left unmapped and still stored. Current never overwrites a mapping you set by hand.

Current keeps 90 days of Inky events. Older entries are pruned automatically as new events arrive, so the feed stays a rolling three-month window rather than growing forever. This doesn't affect your reporting: the counts shown in business reviews and alerts all use windows that fit inside those 90 days — a 90-day review total, plus 30-day and 7-day lookbacks for phishing-spike alerts — so pruning older events never changes a number you see.