Event subscriptions
Push email, account, OAuth, and data events into a SIEM, SOAR, or data lake as they happen.
Material sees email, identity, and data across Google Workspace and Microsoft 365. Integrate with it and your product gets that context. Joint customers get one response path instead of two.

The case
Material already knows which account was phished, which OAuth grant it approved, and which files it can reach. A SIEM, SOAR, or identity platform that receives that context can act on it without an analyst stitching it together by hand.
Integrations run both ways. Material pushes detections and posture findings out through event subscriptions and the API, and accepts signals and response actions back in. A joint customer’s workflow doesn’t stop at the edge of either product.
How integrations work
Push email, account, OAuth, and data events into a SIEM, SOAR, or data lake as they happen.
Query detections, posture findings, and message data, and trigger remediation from inside your product.
One integration covers customers on Google Workspace and Microsoft 365.
A development environment with test data, so you can test builds against real-world conditions before launch.
Integration guides published in both companies’ docs, listed where customers already look.
A named technical contact on Material’s side through build, certification, and launch.
What your integration can reach
Email, OAuth, accounts, and data are four views of the same environment. A phishing detection knows what data the targeted account can reach. An OAuth grant is scored by the blast radius of the account that approved it. An account alert arrives with the exposed files already identified. An integration with Material inherits all of it.
For joint customers: malicious messages found after delivery and removed from every mailbox at once.
For your product: message-level verdicts and indicators that enrich your own detections.
For joint customers: every AI tool and third-party app connected to the workspace, and what each one can reach.
For your product: app inventory and risk scores to inform access and governance decisions.
For joint customers: compromise caught and contained from either console.
For your product: account risk signals your platform can act on, and response actions it can trigger.
For joint customers: sensitive files identified before an incident, and exposure answered after one.
For your product: classification context that makes your alerts specific.
Why partner with Material
Material customers ask which tools connect to it. A listed integration answers that before the sales call.
Joint announcements, solution briefs, and webinars for the integrations customers actually use.
Material’s sellers know the integration and bring it into deals where it fits.
Engineering access during the build, and partner support after launch.
Tell us what you want to build and which customers it’s for.
Get API access, a sandbox tenant, and a technical contact.
Certify the integration, publish the documentation, and announce it jointly.
Technology partners
By clicking “Accept”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. View our Privacy Policy for more information.