Hi Robbie,

Regarding your question:

How do you capture an element that is getting stopped?

This should be possible by using a correlation rule. As alarm filter you could use the following filter:

In this case, the correlation rule is triggered by information events. You will need to enable this option:

However this implies that the action 'create a command and send it' will need to be done either through an automation script or via set parameter (using another element that can perform this action)