--- title: "Connect QuickBooks Online to Elastic Security - APIANT.ai" description: "When \"New bill\" fires in QuickBooks Online, your agent runs \"Add case comment\" in Elastic Security." canonical: "https://apiant.ai/connect/quickbooks-online-to-elastic-security" --- # Connect QuickBooks Online to Elastic Security When **New bill** fires in [QuickBooks Online](https://apiant.ai/connections/quickbooks-online), your agent runs **Add case comment** in [Elastic Security](https://apiant.ai/connections/elastic-security). Describe the whole flow and it is built, tested on every scenario and kept running. QuickBooks Online **11** triggers QuickBooks Online **45** actions Elastic Security **10** actions What the catalog holds today. Ask for anything missing and your agent reads the API documentation and adds it. ## What do you want QuickBooks Online and Elastic Security to do together? Give your AI client this address. `https://mcp.apiant.ai` One connection does both: ask your client to act in an app once, or have it build an automation that keeps running. Any client that takes a remote MCP server. Nothing to install. Create your free account, then sign in once in your browser. ### Set it up in your client ### Claude Code Run this in the directory you want to work in. `claude mcp add --transport http -s project apiant-ai https://mcp.apiant.ai` Start Claude Code there, approve the server, and sign in in the browser page it opens. [Claude Code guide (opens in a new tab)](https://apiant.ai/docs/mcp/claude-code) ### Claude, web and desktop Open Customize, then Connectors, then Add custom connector, and paste the address. On Team and Enterprise an owner adds it first. [Setup guide (opens in a new tab)](https://apiant.ai/docs/mcp) ### Cursor Add the address to your MCP configuration as a server URL. Cursor signs you in in your browser. [Setup guide (opens in a new tab)](https://apiant.ai/docs/mcp) ### Zed Open Settings, then AI, then MCP Servers, then Add Server, then Add Remote Server. [Setup guide (opens in a new tab)](https://apiant.ai/docs/mcp) ### Codex and the ChatGPT desktop app Open Settings, then MCP servers, then Add server, and choose Streamable HTTP. From the terminal, Codex takes the address with its own add command and then signs you in. [Setup guide (opens in a new tab)](https://apiant.ai/docs/mcp) ### Any other MCP client Paste the address where the client asks for a remote MCP server URL, and name the server apiant-ai where it lets you. APIANT's skills reach the client over the same connection. [Setup guide (opens in a new tab)](https://apiant.ai/docs/mcp) Example flows ## What QuickBooks Online can start in Elastic Security - When **New bill** in QuickBooks Online then **Add case comment** in Elastic Security - When **New customer** in QuickBooks Online then **Add exception list item** in Elastic Security Starting points drawn from the triggers and actions in the catalog today. Describe the flow you need, at any depth, and your agent builds it and tests every scenario before it ships. Everything your agent can do with QuickBooks Online and Elastic Security ## Triggers and actions 11 triggers · 55 actions - Trigger **New bill** Polls for newly created bills (accounts payable), most recent first. - Trigger **New customer** Polls for newly created customers, most recent first. - Trigger **New estimate** Fires when a new estimate is created in QuickBooks Online. - Trigger **New invoice** Polls for newly created invoices, most recent first. - Trigger **New or updated customer** Fires when a QuickBooks customer is created or any of its details change. - Trigger **New or updated estimate** Fires when a QuickBooks estimate is created or edited. - Trigger **New or updated invoice** Fires when a QuickBooks invoice is created or edited — line items, amounts, due date, or status. - Trigger **New or updated item** Fires when a QuickBooks product or service item is created or edited. - Trigger **New or updated vendor** Fires when a QuickBooks vendor is created or any of its details change. - Trigger **New paid invoice** Polls for invoices that are fully paid (Balance = 0), most recently updated first. - Trigger **New payment** Polls for newly created customer payments, most recent first. - Action **Create account** Create an account in the QuickBooks chart of accounts — name, account type, and detail type. - Action **Create bill** Creates a new bill (accounts payable) for a vendor with a single account-based line item. - Action **Create credit memo** Creates a new credit memo for a customer with a single line item. - Action **Create customer** Creates a new customer in QuickBooks Online. - Action **Create estimate** Create a QuickBooks Online estimate (quote) for a customer. - Action **Create expense (purchase)** Creates a new expense (Purchase) paid from a bank/credit-card account with one account-based line. - Action **Create invoice** Creates a new invoice for a customer with a single line item. - Action **Create item (product/service)** Creates a new product or service item. - Action **Create journal entry** Create a QuickBooks journal entry with balanced debit and credit lines against the chart of accounts. - Action **Create payment** Records a customer payment, optionally applied against a specific invoice. - Action **Create refund receipt** Creates a new refund receipt for a customer with a single line item. - Action **Create sales receipt** Creates a new sales receipt for a customer with a single line item. - Action **Create vendor** Creates a new vendor in QuickBooks Online. - Action **Delete bill** Permanently delete a QuickBooks bill by Id. - Action **Delete credit memo** Permanently delete a QuickBooks credit memo by Id. - Action **Delete estimate** Permanently delete a QuickBooks estimate by Id. - Action **Delete invoice** Permanently delete a QuickBooks invoice by Id. Unlike voiding, this removes the transaction entirely. - Action **Delete sales receipt** Permanently delete a QuickBooks sales receipt by Id. - Action **Find account by name** Look up an account in the QuickBooks chart of accounts by its name. - Action **Find customer by name** Searches for a customer by display name and returns its Id and SyncToken. - Action **Find invoice by number** Look up a QuickBooks invoice by its document number (the invoice number customers see) rather than its internal Id. - Action **Find item by name** Look up a QuickBooks product or service item by its name. - Action **Find vendor by name** Look up a QuickBooks Online vendor by display name. - Action **Get bill balance** Returns the outstanding balance for a bill by its Id. - Action **Get customer by ID** Retrieves a single customer by its Id. - Action **Get estimate by ID** Retrieve a QuickBooks Online estimate by its ID. - Action **Get estimate PDF** Download the rendered PDF of a QuickBooks estimate by Id. - Action **Get invoice by ID** Retrieves a single invoice by its Id, including its balance. - Action **Get invoice PDF** Download the rendered PDF of a QuickBooks invoice by Id, for emailing or archiving. - Action **List accounts** List the accounts in the QuickBooks chart of accounts, with their type, detail type, and current balance. - Action **List attachments** List the files attached to a QuickBooks transaction or record, with their download links. - Action **List employees** List employees recorded in QuickBooks Online. - Action **List items** List products and services (items) defined in QuickBooks Online. - Action **Pay bill** Records a bill payment against a vendor bill, paid from the specified bank/credit-card account. - Action **Run query** Runs an arbitrary read-only QuickBooks Online query (QBO SQL-like syntax) and returns the raw QueryResponse. - Action **Send estimate** Email a QuickBooks Online estimate to the customer. - Action **Send invoice** Emails an invoice to the supplied email address (or the invoice's billing email if omitted). - Action **Update customer** Updates an existing customer (sparse update). Requires the customer Id and current SyncToken. - Action **Update estimate** Update an existing QuickBooks estimate by Id, changing only the fields supplied. - Action **Update invoice** Update an existing QuickBooks invoice by Id — a sparse update that changes only the fields supplied and leaves the rest of the invoice intact. - Action **Update item** Update an existing QuickBooks product or service item by Id — name, description, price, income account, or active flag. - Action **Update vendor** Update an existing QuickBooks vendor by Id — contact details, billing address, terms, or active flag. - Action **Upload attachment** Upload a file to QuickBooks and attach it to a transaction or record — a receipt on an expense, a contract on an invoice. - Action **Void invoice** Voids an existing invoice. Requires the invoice Id and current SyncToken. - Action **Void payment** Voids an existing customer payment. Requires the payment Id and current SyncToken. - Action **Add case comment** Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case. - Action **Add detection rule** Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning). - Action **Add exception list item** Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts. - Action **Delete detection rule** Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule. - Action **Find cases** Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date. - Action **Find detection rules** Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state. - Action **Get detection rule** Returns a detection rule's full details, looked up by its internal id or its stable rule_id. - Action **Get exception list item** Returns one exception list item, looked up by its id or its human-readable item ID. - Action **Update case** Updates an existing case's title, description, status, severity, tags, assignees and other fields. - Action **Update detection rule** Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule. ## Each app on its own - [ **QuickBooks Online** QuickBooks Online accounting — manage customers, invoices, bills, payments, vendors, expenses, and more via...](https://apiant.ai/connections/quickbooks-online) - [ **Elastic Security** SIEM and XDR platform for detecting, investigating, and automating response to security threats across...](https://apiant.ai/connections/elastic-security) Reviews ## What our customers say ## More from QuickBooks Online - [ **QuickBooks Online to Salesforce** Salesforce is a leading enterprise customer relationship management (CRM) platform.](https://apiant.ai/connect/quickbooks-online-to-salesforce) - [ **QuickBooks Online to Stripe** Stripe is a payment processing platform for online businesses.](https://apiant.ai/connect/quickbooks-online-to-stripe) - [ **QuickBooks Online to Shopify** Shopify is a commerce platform for online stores and retail point-of-sale.](https://apiant.ai/connect/quickbooks-online-to-shopify) - [ **QuickBooks Online to ActiveCampaign** ActiveCampaign is a marketing automation, email marketing, and CRM platform.](https://apiant.ai/connect/quickbooks-online-to-activecampaign) - [ **QuickBooks Online to JIRA** Atlassian JIRA Cloud — issue tracking and project management.](https://apiant.ai/connect/quickbooks-online-to-jira) - [ **QuickBooks Online to Zoom** Zoom unifies cloud video conferencing, simple online meetings, group messaging, and a software-based...](https://apiant.ai/connect/quickbooks-online-to-zoom) ## More into Elastic Security - [ **HubSpot to Elastic Security** HubSpot is your all-in-one stop for all of your marketing software needs.](https://apiant.ai/connect/hubspot-to-elastic-security) - [ **Salesforce to Elastic Security** Salesforce is a leading enterprise customer relationship management (CRM) platform.](https://apiant.ai/connect/salesforce-to-elastic-security) - [ **Slack to Elastic Security** Slack is a messaging platform for teams. Post messages, manage channels, users, reminders, and react to...](https://apiant.ai/connect/slack-to-elastic-security) - [ **Google Sheets to Elastic Security** Google Sheets](https://apiant.ai/connect/google-sheets-to-elastic-security) - [ **Gmail to Elastic Security** Gmail is Google’s email service, featuring spam protection, search functions, and seamless integration with...](https://apiant.ai/connect/gmail-to-elastic-security) - [ **Google Calendar to Elastic Security** Google Calendar is a time management tool providing scheduling features, event reminders, and integration...](https://apiant.ai/connect/google-calendar-to-elastic-security) Questions ## QuickBooks Online and Elastic Security, answered ### ### What can start an automation from QuickBooks Online? Any of QuickBooks Online's 11 triggers in the catalog, including New bill, New customer, New estimate and New invoice. Describe the moment in plain language and your agent picks the right one. ### ### What can your agent do in Elastic Security when something happens in QuickBooks Online? Any of Elastic Security's 10 actions, including Update case, Update detection rule, Add case comment and Add detection rule. Your agent maps the data both ways and tests every scenario before it ships. ### ### Can it also run from Elastic Security to QuickBooks Online? Elastic Security has no triggers in the catalog today, so automations start in QuickBooks Online. If you need the other direction, ask: your agent reads Elastic Security's API documentation and adds it. ### ### Do I have to build a connector for QuickBooks Online or Elastic Security? No. Both are in the catalog with their triggers and actions. You describe the automation; your agent builds it, tests every scenario and keeps it running. ### ### Can my AI client use QuickBooks Online and Elastic Security without building an automation? Yes. With your AI client connected to APIANT, ask it to do something in either app once and it runs that action on the spot. Ask for an automation and your agent builds it, tests every scenario and keeps it running. One connection covers both. ### ### What happens when something fails? Your agent works that out for you. It plans the failure paths along with the happy path, then tests every scenario before it ships. ### ### Is there a free plan? Yes. Every plan includes the agent, including free, and building from your own AI client spends no assistant credits.