Connect Google BigQuery to Elastic Security

Both apps 24Google BigQuery 14Elastic Security 10

• Trigger
  New Job Completed

  Triggers when a BigQuery job in the project finishes, whether it succeeded or failed.

• Trigger
  New Row

  Triggers when a new row is added to a table. New rows are detected by a column you name that increases for newer rows, such as a creation time or a sequential ID.

• Trigger
  Query Job Completed (With Row Data)

  Triggers when a SELECT query job in the project finishes successfully, and includes its result rows.

• Trigger
  Updated Row

  Triggers when a row in a table is added or changed, detected by a last-updated timestamp column you name.

• Action
  Create Row

  Creates a new row of data in a table. Note: Does not create a job.

• Action
  Create Rows

  Creates new rows of data in a table (accepts line items). Note: Does not create a job.

• Action
  Delete Rows

  Deletes every row in a table whose match column equals the value you give.

• Action
  Find One Row

  Finds the first row in a table whose column equals the value you give.

• Action
  Get Rows for Job Completed

  Returns the result rows of a finished query job.

• Action
  Import Data

  Imports a JSON, CSV, Avro or Parquet file from Cloud Storage into a table. Waits up to about 40 seconds for the import to finish; larger imports keep running in BigQuery and return state RUNNING.

• Action
  List Datasets

  Returns the datasets in a Google Cloud project.

• Action
  List Tables

  Returns the tables in a BigQuery dataset.

• Action
  Run a Query

  Runs a SQL query against a table in BigQuery.

• Action
  Update Row(s)

  Updates every row in a table whose match column equals the value you give, setting the columns you choose.

• Action
  Add case comment

  Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case.

• Action
  Add detection rule

  Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning).

• Action
  Add exception list item

  Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts.

• Action
  Delete detection rule

  Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule.

• Action
  Find cases

  Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date.

• Action
  Find detection rules

  Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state.

• Action
  Get detection rule

  Returns a detection rule's full details, looked up by its internal id or its stable rule_id.

• Action
  Get exception list item

  Returns one exception list item, looked up by its id or its human-readable item ID.

• Action
  Update case

  Updates an existing case's title, description, status, severity, tags, assignees and other fields.

• Action
  Update detection rule

  Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.