> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rad.security/llms.txt
> Use this file to discover all available pages before exploring further.

# Email Security Integrations

> Connect your email security platforms to RAD Security for unified email threat detection and email activity visibility.

# Email Security Integrations

Integrate your email security platforms with RAD Security to bring email threat detections — and, where available, email activity events — into a single, correlated view alongside your runtime, cloud, and Kubernetes security data.

These integrations are **read-only**. RAD Security pulls email threats (and email activity events for supported providers) from your platform on a scheduled basis to power unified threat detection and investigation. RAD never writes to, modifies, or deletes anything in your email security platform.

## Benefits

<CardGroup cols={2}>
  <Card title="Email Threat Visibility" icon="radar">
    Surface email threat detections — phishing, malware, and impersonation — alongside runtime, cloud, and Kubernetes signals.
  </Card>

  <Card title="Email Activity" icon="wave-pulse">
    Ingest email activity events (Defender for Office 365) to see message flow across your tenant.
  </Card>

  <Card title="Correlated Analysis" icon="diagram-venn">
    Correlate email threats and activity with runtime and identity detections to prioritize what matters.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Let RADBot triage email threats by real-world impact.
  </Card>
</CardGroup>

## Supported Integrations

<AccordionGroup>
  <Accordion title="Microsoft Defender for Office 365" icon="microsoft">
    **Status:** Available

    [View Setup Guide →](/rad-security/integrations/email-security/defender-for-office-setup)

    Connect Microsoft Defender for Office 365 to RAD Security to ingest email threats and email activity events.

    **Key Features:**

    * Email threat detections (OCSF Detection Finding)
    * Email activity events (OCSF Email Activity)
    * Azure AD app (OAuth) client-credentials authentication
    * Scheduled, read-only data ingestion
  </Accordion>

  <Accordion title="Mimecast Cloud Gateway" icon="envelope">
    **Status:** Available

    [View Setup Guide →](/rad-security/integrations/email-security/mimecast-setup)

    Connect Mimecast Cloud Gateway to RAD Security to ingest email threats.

    **Key Features:**

    * Email threat detections (OCSF Detection Finding)
    * Mimecast API 2.0 OAuth2 client-credentials authentication
    * Scheduled, read-only data ingestion

    **Note:** Mimecast provides email threats only — it does not provide email activity events.
  </Accordion>
</AccordionGroup>

## What Data is Collected

<AccordionGroup>
  <Accordion title="Email Threats" icon="radar">
    * Email threat detections — phishing, malware, impersonation, and spam (both providers)
    * Mapped to OCSF Detection Finding and stored as security findings, queryable in RAD
  </Accordion>

  <Accordion title="Email Activity Events" icon="wave-pulse">
    * Email message events across your tenant (**Microsoft Defender for Office 365 only**)
    * Mapped to OCSF Email Activity and stored alongside RAD's other activity feeds

    Mimecast Cloud Gateway does **not** provide email activity events.
  </Accordion>
</AccordionGroup>

## Use Cases

<CardGroup cols={2}>
  <Card title="Threat Investigation" icon="magnifying-glass">
    Investigate email threats with context from runtime, cloud, and identity detections.
  </Card>

  <Card title="Email Activity Monitoring" icon="wave-pulse">
    Track email activity events (Defender for Office 365) to understand message flow.
  </Card>

  <Card title="Correlated Detection" icon="diagram-project">
    Correlate email threats with RAD runtime and identity signals to cut through the noise.
  </Card>

  <Card title="RADBot Prioritization" icon="robot">
    Leverage RADBot to prioritize email threats based on real-world impact.
  </Card>
</CardGroup>

## Getting Started

<Steps>
  <Step title="Choose Your Platform">
    Select your email security platform from the supported integrations above.
  </Step>

  <Step title="Generate API Credentials">
    Create API credentials with read access in your email security platform.
  </Step>

  <Step title="Configure in RAD Security">
    Add the integration in your RAD Security workspace with the generated credentials.
  </Step>

  <Step title="Verify Connection">
    Confirm the integration is active and data is being synced.
  </Step>
</Steps>

## Next Steps

<CardGroup cols={2}>
  <Card title="Defender for Office 365 Setup" icon="microsoft" href="/rad-security/integrations/email-security/defender-for-office-setup">
    Connect Microsoft Defender for Office 365 for email threats and activity
  </Card>

  <Card title="Mimecast Setup" icon="envelope" href="/rad-security/integrations/email-security/mimecast-setup">
    Connect Mimecast Cloud Gateway for email threats
  </Card>

  <Card title="Data Sources Overview" icon="database" href="/rad-security/integrations/data-sources">
    Explore all available data sources
  </Card>
</CardGroup>