Connect Sorry to Elastic Security

Both apps 27Sorry 17Elastic Security 10

• Trigger
  New notice

  Triggers when a new notice (incident, maintenance or general announcement) is created on the selected Sorry status page.

• Action
  Add component

  Creates a new component on a Sorry status page, optionally nested under a parent component.

• Action
  Add notice

  Creates a new incident, maintenance or general notice on a Sorry status page, optionally linking affected components and publishing it to subscribers.

• Action
  Add notice update

  Posts a new update on an existing notice on a Sorry status page, optionally publishing it to your configured integrations.

• Action
  Add subscriber

  Adds an email or SMS subscriber to a status page, optionally limited to specific components, so they receive status notices.

• Action
  Delete notice

  Deletes a notice (incident, maintenance or general) from a Sorry status page.

• Action
  Delete subscriber

  Permanently removes a subscriber from a status page.

• Action
  Get notice

  Returns a single notice from a status page, including its type, state, subject, synopsis and link.

• Action
  Get status page

  Returns a single Sorry status page with its name, state, timezone, support details and notification settings, optionally including related brand, components, notices and more.

• Action
  List components

  Returns all components (the services or infrastructure elements) shown on a Sorry status page, with their current state.

• Action
  List notices

  Returns the notices (incidents, maintenance and general notices) posted on a Sorry status page, optionally filtered by type, state, subject or creation date.

• Action
  List notice updates

  Returns all updates posted on a notice on one of your Sorry status pages, optionally filtered by creation date or content.

• Action
  List status pages

  Returns all status pages in your Sorry account, optionally filtered by name or creation date.

• Action
  List subscribers

  Returns the subscribers on a status page, optionally only those who receive notices for a specific component.

• Action
  Update component

  Updates a component on a Sorry status page, such as its name, description, position or parent component.

• Action
  Update notice

  Updates an existing notice on a Sorry status page — change its subject or state, add a comment, set affected components or reschedule planned maintenance.

• Action
  Update status page

  Updates a status page's settings, such as its name, timezone, support contact details, search visibility and language.

• Action
  Add case comment

  Adds a user comment, or attaches an alert, to an existing Elastic Security case and returns the updated case.

• Action
  Add detection rule

  Creates a detection rule in Elastic Security (custom query, EQL, ES|QL, threshold, indicator match, new terms, saved query or machine learning).

• Action
  Add exception list item

  Creates an exception item in an existing Elastic Security exception list, so matching events stop producing detection alerts.

• Action
  Delete detection rule

  Deletes a detection rule, identified by its internal id or its stable rule ID, and returns the deleted rule.

• Action
  Find cases

  Searches cases by text in their title or description, optionally narrowed by status, severity, tags, owner, assignee, reporter, category or creation date.

• Action
  Find detection rules

  Finds detection rules in Elastic Security matching a filter, such as by name, tag or enabled state.

• Action
  Get detection rule

  Returns a detection rule's full details, looked up by its internal id or its stable rule_id.

• Action
  Get exception list item

  Returns one exception list item, looked up by its id or its human-readable item ID.

• Action
  Update case

  Updates an existing case's title, description, status, severity, tags, assignees and other fields.

• Action
  Update detection rule

  Updates selected settings of an existing detection rule, leaving any setting you leave blank unchanged. Returns the updated rule.

No trigger or action matches that. Ask your agent to add it: it reads the API documentation and builds what you describe.