Mailbox investigation, Simulation delivery, Reporting, Behaviour signals
Keepnet + Google Workspace integration
Investigate, deliver, report and read sign-in signals with one connection.
Keepnet integrates with Google Workspace to investigate, deliver, report and read sign-in signals with one connection.
What you get
- Find and remove a reported email across Gmail mailboxes
- Create simulations in mailboxes with Direct Email Creation (DEC)
- Employees report from Gmail with the Keepnet add-on
- Sign-in and token audit events become behaviour signals
How it works
- Connect with Gmail and Admin Directory APIs
- Keepnet reads the directory and mailboxes, and audit events if you turn them on
- Investigation, delivery and reporting run on the same connection
Data and permissions
| Data | Direction | Detail |
|---|---|---|
| Gmail mailboxes | Two-way | Search, label and delete |
| Directory (employees) | In | Read only |
| Admin Reports (login, token) | In | Optional |
| Simulation emails | Out | Created through the Gmail API (DEC) |
What you need
- Google Workspace super admin
Set up
Authorise Keepnet in the Admin console, then choose the services to use.
Related integrations
- Works with
- Incident Responder, Phishing Simulator, Phishing Reporter, Secure Behaviour Dashboard
- Built by
- Keepnet
- Last updated
- October 2026
