Connect Halo Service Solutions to Elastic Security

Both apps 26Halo Service Solutions 16Elastic Security 10

• Trigger
  New Ticket

  Triggers when a new ticket is logged in Halo.

• Trigger
  Ticket Updated

  Triggers when a ticket is created or updated in Halo.

• Action
  Add action to ticket

  Adds a new action (note, update or outcome) to an existing Halo ticket.

• Action
  Add project

  Creates a new project in Halo and returns the created project record.

• Action
  Create Site

  Creates a new site for a customer in Halo.

• Action
  Create Ticket

  Creates a new ticket in Halo with a summary, description and optional customer, user, type, priority, status and assignment.

• Action
  Create User

  Creates a new end user in Halo under the chosen site.

• Action
  Get customer

  Returns a single Halo customer (client) by its ID, optionally with extra details and ticket activity.

• Action
  Get project

  Returns a single Halo project by its ID, including its details and custom fields.

• Action
  Get ticket

  Returns a single Halo ticket by its ID, optionally with extra details and its last action.

• Action
  Get user

  Returns a single Halo user (end-user contact) by ID, with optional details, ticket activity and pop-ups.

• Action
  List customers

  Returns a list of customers (clients) in Halo, optionally filtered by search text or top level.

• Action
  List tickets

  Returns tickets from Halo, optionally filtered by customer, agent, status, dates, search text and more.

• Action
  List users

  Returns the users (end-user contacts) in Halo, optionally filtered by customer, site, search text and other criteria.

• Action
  Update ticket

  Updates an existing Halo ticket's summary, details, customer, assignment, status, priority and category. Fields left blank are not changed.

• Action
  Update user

  Updates an existing Halo user's name, site, email or phone number. Fields left blank keep their current values.

• Action
  Add case comment

  Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case.

• Action
  Add detection rule

  Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning).

• Action
  Add exception list item

  Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts.

• Action
  Delete detection rule

  Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule.

• Action
  Find cases

  Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date.

• Action
  Find detection rules

  Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state.

• Action
  Get detection rule

  Returns a detection rule's full details, looked up by its internal id or its stable rule_id.

• Action
  Get exception list item

  Returns one exception list item, looked up by its id or its human-readable item ID.

• Action
  Update case

  Updates an existing case's title, description, status, severity, tags, assignees and other fields.

• Action
  Update detection rule

  Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.