Connect incwo to Elastic Security

Both apps 28incwo 18Elastic Security 10

• Trigger
  New invoice

  Triggered when a new invoice is created

• Action
  Add invoice

  Creates a draft invoice (or credit note) with its lines in incwo in one atomic call. incwo always creates invoices as drafts; numbering happens when the invoice is confirmed in incwo.

• Action
  Add opportunity

  Create a lead/opportunity (CRM: Leads and opportunities). POST to the opportunities collection .xml per docs.

• Action
  Create Contact

  Creates a Contact

• Action
  Create Firm

  Creates a Firm

• Action
  Create Task

  Creates a Task

• Action
  Find Contact

  Finds a contact

• Action
  Find Firm

  Searches your incwo firms (companies) by keyword and returns the ones that match.

• Action
  Get contact

  Retrieves a single incwo contact by its ID.

• Action
  Get firm

  Get a firm by id.

• Action
  Get invoice

  Returns one incwo invoice (or draft credit note) with its party, lines, totals and progress.

• Action
  Get opportunity

  Returns one incwo opportunity (lead) with its topic, client, stage, amount and confidence.

• Action
  Get task

  Returns one incwo task by its id, with its title, content, due date, assignment and status.

• Action
  List contacts

  List contacts, paginated with ?page=N and date filters.

• Action
  List firms

  Lists firms (companies) in incwo, optionally narrowed by search text or field filters and sorted.

• Action
  Update contact

  Update a contact.

• Action
  Update firm

  Update a firm.

• Action
  Update task

  Update a project task.

• Action
  Add case comment

  Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case.

• Action
  Add detection rule

  Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning).

• Action
  Add exception list item

  Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts.

• Action
  Delete detection rule

  Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule.

• Action
  Find cases

  Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date.

• Action
  Find detection rules

  Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state.

• Action
  Get detection rule

  Returns a detection rule's full details, looked up by its internal id or its stable rule_id.

• Action
  Get exception list item

  Returns one exception list item, looked up by its id or its human-readable item ID.

• Action
  Update case

  Updates an existing case's title, description, status, severity, tags, assignees and other fields.

• Action
  Update detection rule

  Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.