Skip to content
Current

Inky: receive phishing and threat events into Current

Inky has no pull API. It pushes events to Current. Enable the receiver, copy the feed URL into Inky's Custom SIEM Feed, and phishing catches and user reports flow in as threat signals (never email contents), mapped to each customer by domain.

Updated 5 min read
On this page · 5 sections
  1. Step 1, Enable the receiver in Current
  2. Step 2, Paste the URL into Inky
  3. How events map to your customers
  4. Data retention
  5. Troubleshooting

Inky is the one connector in Current that works backwards from all the others. Every other reporting integration is a key you paste so Current can go and read the vendor. Inky has no such API to read. Its only way to send data out is its Custom SIEM Feed, which POSTs each email-security event to a URL you give it. So instead of Current reaching into Inky, you point Inky at Current. You enable a receiver here, copy the URL it gives you, and paste that URL into Inky.

Note
What Current stores, and what it never stores
Current keeps threat signals only: the event type and verdict, a threat level and category, when it happened, and the sender and recipient DOMAINS (never the full addresses if it can avoid it). It never stores email bodies, subjects' contents, HTML, or attachments. Those are stripped the moment an event arrives, before anything is written.

Step 1, Enable the receiver in Current

SCREENSHOT — coming soon
The Inky card's Manage drawer with the Enable receiver button.
  1. 1
    Open Integrations → Inky → Manage
    Integrations sits in Settings, so this is a Tenant Admin action.
  2. 2
    Press Enable receiver
    Current generates a unique, secret feed URL for your workspace and stores it. Nothing is sent anywhere yet, the receiver is now listening.
  3. 3
    Copy the feed URL
    The drawer shows the full URL with a Copy button. Anyone who has this URL can post events into your stats, so treat it like a password. It's shown here (not hidden) on purpose, so your team can re-copy it later without regenerating it.

Step 2, Paste the URL into Inky

  1. 1
    Open Inky's Custom SIEM Feed
    In Inky, go to Settings → Integrations → Custom SIEM Feed and choose Configure.
  2. 2
    Paste the URL and choose JSON
    Enter the URL you copied from Current as the webhook / endpoint URL, and set the format to JSON. If Inky offers event filters, you can scope which event types it sends.
  3. 3
    Save and send a test event
    Save the feed, then use Inky's test/send option. The Current card flips from Awaiting feed to Receiving within seconds of the first event landing.
Note
Awaiting feed vs Receiving
Right after you enable it, the card reads Awaiting feed. The receiver is armed but Inky hasn't sent anything yet. Once the first event arrives it turns to Receiving and shows a running total and the time of the last event. If it stays on Awaiting feed, the URL hasn't been saved in Inky (or hasn't matched a real event yet).

How events map to your customers

Each event carries a recipient (the protected mailbox), and Current uses that recipient's domain to decide which company it belongs to. A domain that uniquely matches one of your Current companies (by the website on the company profile) is linked automatically; a domain that matches none, or more than one, is left unmapped and still stored. Current never overwrites a mapping you set by hand.

Data retention

Current keeps 90 days of Inky events. Older entries are pruned automatically as new events arrive, so the feed stays a rolling three-month window rather than growing forever. This doesn't affect your reporting: the counts shown in business reviews and alerts all use windows that fit inside those 90 days (a 90-day review total, plus 30-day and 7-day lookbacks for phishing-spike alerts), so pruning older events never changes a number you see.

Troubleshooting

What you seeWhat it means
Card stays on Awaiting feedInky hasn't delivered an event to the URL yet. Re-check that the exact URL from Current is saved in Inky's Custom SIEM Feed, the format is JSON, and any event filter isn't excluding everything. Use Inky's test-send to confirm.
Inky reports the feed failed / a 404The URL is wrong or the receiver was disconnected in Current. Re-copy the URL from the Inky card (Manage) and paste it again. If you pressed Disconnect in Current, the feed stops accepting events until you enable it again.
Events arrive but aren't on any companyTheir recipient domain didn't uniquely match a Current company. Add the company's website to its Current profile so the domain can match, or map it by hand, new events on that domain then attach automatically.
You regenerated the URLThe old URL stops working immediately. Paste the new URL into Inky, or events will silently stop arriving. Only regenerate if the URL was exposed.
Heads up
The feed URL is a secret
The token in the URL is what authorizes Inky to post to your workspace. Anyone with the full URL could inject events into your own tenant's stats (they can never reach another tenant, and never read anything). If it's ever exposed, press Regenerate URL on the card and re-paste the new one into Inky.
Note
Who can do this, and disconnecting
Enabling, regenerating, and disconnecting the Inky feed are Tenant Admin actions. Disconnect stops Current accepting events immediately; the events already received stay put, and you can enable the receiver again at any time (which mints a fresh URL to paste into Inky).
Was this helpful?
← Previous
Backup Radar: every backup job's latest result and SLA state
Next →
Ticket-queue noise: which queues and boards to sync, and which to mute

Related articles