Connect Gmail to Elastic Security

Both apps 35Gmail 25Elastic Security 10

• Trigger
  Email Sent

  Fires when an email is sent from the mailbox (optionally filtered by query).

• Trigger
  New Gmail Message

  Fires when a new email arrives (optionally filtered by query/labels).

• Action
  Add Label To Email

  Adds and/or removes specified gmail labels for a message; ensure `message id` and all `label ids` are valid (use 'listlabels' for custom label ids).

• Action
  Create Email Draft

  Creates a gmail email draft, supporting to/cc/bcc, subject, plain/html body (ensure `is html=true` for html), attachments, and threading.

• Action
  Create Label

  Creates a new label with a unique name in the specified user's gmail account.

• Action
  Delete Draft

  Permanently deletes a specific gmail draft using its id; ensure the draft exists and the user has necessary permissions for the given `user id`.

• Action
  Delete Message

  Permanently deletes a specific email message by its id from a gmail mailbox; for `user id`, use 'me' for the authenticated user or an email address to which the authenticated user has delegated access.

• Action
  Fetch Emails

  Fetches a list of email messages from a gmail account, supporting filtering, pagination, and optional full content retrieval.

• Action
  Fetch Message By Message Id

  Fetches a specific email message by its id, provided the `message id` exists and is accessible to the authenticated `user id`.

• Action
  Fetch Message By Thread Id

  Retrieves messages from a gmail thread using its `thread id`, where the thread must be accessible by the specified `user id`.

• Action
  Get Attachment

  Retrieves a specific attachment by id from a message in a user's gmail mailbox, requiring valid message and attachment ids.

• Action
  Get Contacts

  Fetches contacts (connections) for the authenticated google account, allowing selection of specific data fields and pagination.

• Action
  Get People

  Retrieves either a specific person's details (using `resource name`) or lists 'other contacts' (if `other contacts` is true), with `person fields` specifying the data to return.

• Action
  Get Profile

  Retrieves key gmail profile information (email address, message/thread totals, history id) for a user.

• Action
  List Drafts

  Retrieves a paginated list of email drafts from a user's gmail account. use verbose=true to get full draft details including subject, body, sender, and timestamp.

• Action
  List Labels

  Retrieves a list of all system and user-created labels for the specified gmail account.

• Action
  List Threads

  Retrieves a list of email threads from a gmail account, identified by `user id` (email address or 'me'), supporting filtering and pagination.

• Action
  Modify Thread Labels

  Adds or removes specified existing label ids from a gmail thread, affecting all its messages; ensure the thread id is valid.

• Action
  Move To Trash

  Moves an existing, non-deleted email message to the trash for the specified user.

• Action
  Patch Label

  Patches the specified label.

• Action
  Remove Label

  Permanently deletes a specific, existing user-created gmail label by its id for a user; cannot delete system labels.

• Action
  Reply To Thread

  Sends a reply within a specific gmail thread using the original thread's subject, requiring a valid `thread id` and correctly formatted email addresses. supports attachments via the `attachment` parameter with valid `s3key`, `mimetype`, and `name`.

• Action
  Search People

  Searches contacts by matching the query against names, nicknames, emails, phone numbers, and organizations, optionally including 'other contacts'.

• Action
  Send Draft

  Sends the specified, existing draft to the recipients in the to, cc, and bcc headers.

• Action
  Send Email

  Sends an email via gmail api using the authenticated user's google profile display name, requiring `is html=true` if the body contains html and valid `s3key`, `mimetype`, `name` for any attachment.

• Action
  Add case comment

  Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case.

• Action
  Add detection rule

  Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning).

• Action
  Add exception list item

  Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts.

• Action
  Delete detection rule

  Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule.

• Action
  Find cases

  Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date.

• Action
  Find detection rules

  Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state.

• Action
  Get detection rule

  Returns a detection rule's full details, looked up by its internal id or its stable rule_id.

• Action
  Get exception list item

  Returns one exception list item, looked up by its id or its human-readable item ID.

• Action
  Update case

  Updates an existing case's title, description, status, severity, tags, assignees and other fields.

• Action
  Update detection rule

  Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.