Ironscales Email Security
Integration
Ironscales Email Security logo
Visit website
Integration guide

Overview

Ironscales is AI-driven email security built for MSPs since 2015. It connects to Microsoft 365 and Google Workspace through an API, with no MX record changes, and learns how each user normally communicates. That lets it catch phishing, business email compromise, and credential theft attempts that carry no malicious link or attachment. Automated remediation clusters and removes related threats across mailboxes, and more than 3,500 MSP partners manage it from one multi-tenant console.

‍

The HaloPSA integration links each Ironscales tenant to its HaloPSA client and handles two jobs. For billing, Ironscales writes seat and add-on counts to a HaloPSA subscription every day, so recurring invoices bill from actual usage instead of a typed quantity. For ticketing, Ironscales opens a HaloPSA ticket for account takeover, user-challenged, and quarantine release incidents. When the incident is resolved, it closes the ticket with an internal note that records the verdict. Setup runs through a guided wizard in the Ironscales console.

Features & Benefits

The Ironscales and HaloPSA integration puts email security billing and incident response inside the PSA your team already works in, so MSPs spend less time reconciling seats and chasing alerts. Connecting the two gives you:

‍

  • Usage-based billing: Ironscales syncs seat and add-on counts to each client’s HaloPSA subscription daily. Recurring invoice lines take their quantity from that record, so invoices track real usage without manual seat reconciliation.
  • Automatic incident tickets: Account takeover incidents and quarantine release requests open a HaloPSA ticket right away. User-challenged messages open one when Ironscales reaches a verdict. Incidents that resolve automatically create no ticket, which keeps queues clear.
  • Hands-off ticket closure: When an incident is resolved, Ironscales applies your Closed status and adds an internal note with the verdict. If the verdict changes later, a “VERDICT UPDATED” note is added. Close notes are never visible to end users.
  • Your workflow, your SLAs: You choose the ticket type, team, open and closed statuses, and default priority, so Ironscales tickets follow the queues and SLAs you already run. If technicians should log time, pick a closed status that leaves the ticket open for review.
  • Clear ticket naming: Each ticket title includes the event type, report ID, and affected user (for example, IRONSCALES-Account Takeover-IS-123456-john.doe@acme.com), so technicians can triage from the queue view.
  • Guided setup with a test ticket: The wizard maps tenants to clients, matches products to your HaloPSA catalog items, and sends a test ticket to confirm your settings before you activate. Billing and ticketing can be turned on separately.
No items found.
No items found.
No items found.